ICO - IC-46167-S7N1

ICO - IC-46167-S7N1
Authority:	ICO (UK)
Jurisdiction:	United Kingdom
Relevant Law:	Article 5(1)(a) GDPR Article 6(1)(f) GDPR Regulation 13 EIR
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	30.09.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	IC-46167-S7N1
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	English
Original Source:	ICO (in EN)
Initial Contributor:	n/a

ICO finds that Neath Port Talbot Council (the Council) correctly withheld information about the name of a person submitting a complaint about another resident’s dog barking on the basis of regulation 13 of the Environmental Information Regulations (EIR).

English Summary

Facts

The complainant had received a letter from the Council regarding a complaint about his dog barking. He requested the name of the person who had submitted the complaint but was refused this information under regulation 13 EIR.

Dispute

Was the Council correct in withholding the information requested under regulation 13 EIR – id est (in this case, via regulation 13 (2A) a of the Data Protection Act 2018 (DPA 2018), as amended by Schedule 19 Paragraph 307(3) DPA 2018) would disclosure contravene any data protection principles as set out in Article 5 GDPR?

Holding

The Commissioner finds that the Council was correct in withholding the requested information on the basis of regulation 13 EIR.

With reference to the principles laid out in Article 5 (1) (a) GDPR, the Commissioner seeks to determine the lawfulness of a potential disclosure by examining the conditions for legitimate interest according to Article 6 (1) (f) GDPR.

The Commissioner confirms a legitimate interest of the complainant in receiving the requested information, albeit no wider one in the public accessing the information.

Disclosure would also be necessary, including being the least intrusive means to satisfy the legitimate interest specified, she finds.

Crucially, the Commissioner states that I her view “a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed” and whether “disclosure would be likely to result in unwarranted damage or distress to that individual”.

The Commissioner supports the Council’s consideration that complaints to the Council are generally submitted with the expectation of the submitter’s personal information not be released, noting also that a release under EIR would formally be a release into the public domain.

This be supported by the fact that there is no option to submit a complaint to the Council anonymously and that the submission form contains an assurance of confidentiality. This assurance was, in addition, reconfirmed personally to the submitter of the original complaint during the process of further internal investigations into the complaint.

The identity of an individual making a complaint must therefore, and due to the general rationale for and application of the practice of non-disclosure, be subject to the common law duty of confidentiality.

The individual explicitly denied consent for disclosure and, not solely based on this fact, disclosure of their identity would be “highly likely to cause damage or distress to them […]”

The Commissioner concludes that the fundamental rights and freedoms of the individual whose data is concerned are not outweighed by the merely personal legitimate interest of the complainant and that accordingly, for lack of a legal basis of processing, and in particular Article 6 (1)(f), disclosure would contravene the principle of lawful processing. On this basis the Council correctly refused disclosure with reference to regulation 13 EIR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.