Stephen John Gullick v The Information Commissioner
[2023] UKFTT 985 (GRC)
David Little v The Information Commissioner
22 February 2023
[2023] UKFTT 169 (GRC)
First-tier Tribunal
Someone appealed because some words were hidden from a public email. The judge agreed the hidden words could be used to figure out who they were about, so keeping them hidden was okay.
Key Facts
- •David Little appealed the Information Commissioner's decision to redact two words from an email obtained under the Freedom of Information Act 2000 (FOIA) from Datchworth Parish Council (DPC).
- •The email concerned the allocation of a budget item and included discussion of costs and advice received.
- •The appeal focused solely on the redaction of these two words, which Mr. Little argued were not personal data.
- •The Information Commissioner and the Tribunal considered whether the redacted words, in context with other information, could identify an individual.
- •Mr. Little had access to the unredacted information as a former DPC councillor.
Legal Principles
General right of access to information held by public authorities under FOIA.
Freedom of Information Act 2000
Exemptions for information constituting personal data under FOIA.
Freedom of Information Act 2000
Definition of personal data.
Data Protection Act 2018
Indirect identifiability of personal data; the 'motivated intruder' test.
GDPR Recital 26, Information Commissioner v Magherafelt District Council [2013] AACR 14, NHS Business Services Authority v Information Commissioner and Spivack [2021] UKUT 192 (AAC)
Balancing test for legitimate interests against data subject's rights under Article 6(1)(e) UK GDPR.
UK GDPR Article 6(1)(e), South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55
Tribunal's role in reviewing the Commissioner's decision under FOIA.
Freedom of Information Act 2000
Outcomes
Appeal dismissed.
The Tribunal found the redacted words constituted personal data under section 40(2) FOIA, as they could be used, along with other readily available information, to indirectly identify an individual. The Tribunal determined that the public interest in disclosure was outweighed by the individual's privacy rights under Article 6(1)(e) UK GDPR.