Peter Whyton v Information Commissioner & Anor
[2022] UKFTT 518 (GRC)
Roger Bird v The Information Commissioner
16 March 2023
[2023] UKFTT 300 (GRC)
First-tier Tribunal
Someone requested a recording of a meeting. The council refused because it contained private information. The Information Commissioner agreed, but a court said the council was right to refuse because of data protection laws, not the freedom of information law.
Key Facts
- •Roger Bird (Appellant) requested a recording of a meeting from Hythe and Dibden Parish Council (Council) under Article 15 UK GDPR.
- •The Council refused, citing personal data concerns.
- •The Information Commissioner (Respondent) treated the request as a FOIA request and upheld the refusal.
- •Bird appealed, arguing the request should have been treated as a subject access request under UK GDPR.
- •The Tribunal found the Environmental Information Regulations 2004 (EIR) applied, not FOIA.
- •The recording contained personal data of Bird and third parties (residents).
Legal Principles
Environmental Information Regulations 2004 (EIR) apply to information requests concerning environmental matters.
Regulation 2(1) EIR
Under EIR, personal data of the requester is exempt from disclosure.
Regulation 5(3) EIR
Under EIR, personal data of third parties can't be disclosed if it would contravene data protection principles.
Regulation 13(1) EIR
Data protection principles require lawful, fair, and transparent processing of personal data.
Article 5(1)(a) UK GDPR
Lawful processing of personal data requires consent or a legitimate interest not overridden by the data subject's rights.
Article 6(1) UK GDPR
Consent must be freely given, specific, informed, and unambiguous.
Article 4(11) UK GDPR
The Tribunal can substitute a decision notice if the original is not in accordance with the law.
Section 58 FOIA
Outcomes
The appeal is allowed.
The Information Commissioner's Decision Notice was not in accordance with the law; it should have been handled under EIR, not FOIA.
A substitute Decision Notice is issued.
The Council was entitled to refuse disclosure under EIR due to the presence of personal data.
No steps are required.
The Council's refusal to disclose was legally justified.