ICO - IC-46167-S7N1: Difference between revisions
mNo edit summary |
Isabel Hahn (talk | contribs) No edit summary |
||
| (3 intermediate revisions by 3 users not shown) | |||
| Line 32: | Line 32: | ||
|National_Law_Link_1=https://www.legislation.gov.uk/uksi/2004/3391/regulation/13/made | |National_Law_Link_1=https://www.legislation.gov.uk/uksi/2004/3391/regulation/13/made | ||
|Party_Name_1= | |Party_Name_1=Neath Port Talbot Council | ||
|Party_Link_1= | |Party_Link_1= | ||
|Party_Name_2= | |Party_Name_2= | ||
| Line 52: | Line 52: | ||
}} | }} | ||
ICO | The UK DPA (ICO) found that the Neath Port Talbot Council correctly withheld information about the name of a person submitting a complaint about another resident’s dog barking on the basis of regulation 13 of the Environmental Information Regulations (EIR). | ||
== English Summary == | ==English Summary== | ||
=== Facts === | ===Facts=== | ||
The complainant had received a letter from the Council regarding a complaint about his dog barking. He requested the name of the person who had submitted the complaint but was refused this information under regulation 13 EIR. | The complainant had received a letter from the Council regarding a complaint about his dog barking. He requested the name of the person who had submitted the complaint but was refused this information under regulation 13 EIR. | ||
=== Dispute === | ===Dispute=== | ||
Was the Council correct in withholding the information requested under regulation 13 EIR – id est (in this case, via regulation 13 (2A) a of the Data Protection Act 2018 (DPA 2018), as amended by Schedule 19 Paragraph 307(3) DPA 2018) would disclosure contravene any data protection principles as set out in Article 5 GDPR? | Was the Council correct in withholding the information requested under regulation 13 EIR – id est (in this case, via regulation 13 (2A) a of the Data Protection Act 2018 (DPA 2018), as amended by Schedule 19 Paragraph 307(3) DPA 2018) would disclosure contravene any data protection principles as set out in Article 5 GDPR? | ||
=== Holding === | ===Holding=== | ||
The Commissioner finds that the Council was correct in withholding the requested information on the basis of regulation 13 EIR. | The Commissioner finds that the Council was correct in withholding the requested information on the basis of regulation 13 EIR. | ||
| Line 71: | Line 71: | ||
Disclosure would also be necessary, including being the least intrusive means to satisfy the legitimate interest specified, she finds. | Disclosure would also be necessary, including being the least intrusive means to satisfy the legitimate interest specified, she finds. | ||
Crucially, the Commissioner states that | Crucially, the Commissioner states that in her view “a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed” and whether “disclosure would be likely to result in unwarranted damage or distress to that individual”. | ||
The Commissioner supports the Council’s consideration that complaints to the Council are generally submitted with the expectation of the submitter’s personal information not be released, noting also that a release under EIR would formally be a release into the public domain. | The Commissioner supports the Council’s consideration that complaints to the Council are generally submitted with the expectation of the submitter’s personal information not be released, noting also that a release under EIR would formally be a release into the public domain. | ||
| Line 83: | Line 83: | ||
The Commissioner concludes that the fundamental rights and freedoms of the individual whose data is concerned are not outweighed by the merely personal legitimate interest of the complainant and that accordingly, for lack of a legal basis of processing, and in particular Article 6 (1)(f), disclosure would contravene the principle of lawful processing. On this basis the Council correctly refused disclosure with reference to regulation 13 EIR. | The Commissioner concludes that the fundamental rights and freedoms of the individual whose data is concerned are not outweighed by the merely personal legitimate interest of the complainant and that accordingly, for lack of a legal basis of processing, and in particular Article 6 (1)(f), disclosure would contravene the principle of lawful processing. On this basis the Council correctly refused disclosure with reference to regulation 13 EIR. | ||
== Comment == | ==Comment== | ||
''Share your comments here!'' | ''Share your comments here!'' | ||
== Further Resources == | ==Further Resources== | ||
''Share blogs or news articles here!'' | ''Share blogs or news articles here!'' | ||
== English Machine Translation of the Decision == | ==English Machine Translation of the Decision== | ||
The decision below is a machine translation of the English original. Please refer to the English original for more details. | The decision below is a machine translation of the English original. Please refer to the English original for more details. | ||
Latest revision as of 14:06, 13 October 2020
| ICO - IC-46167-S7N1 | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(f) GDPR Regulation 13 EIR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 30.09.2020 |
| Published: | |
| Fine: | None |
| Parties: | Neath Port Talbot Council |
| National Case Number/Name: | IC-46167-S7N1 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | n/a |
The UK DPA (ICO) found that the Neath Port Talbot Council correctly withheld information about the name of a person submitting a complaint about another resident’s dog barking on the basis of regulation 13 of the Environmental Information Regulations (EIR).
English Summary
Facts
The complainant had received a letter from the Council regarding a complaint about his dog barking. He requested the name of the person who had submitted the complaint but was refused this information under regulation 13 EIR.
Dispute
Was the Council correct in withholding the information requested under regulation 13 EIR – id est (in this case, via regulation 13 (2A) a of the Data Protection Act 2018 (DPA 2018), as amended by Schedule 19 Paragraph 307(3) DPA 2018) would disclosure contravene any data protection principles as set out in Article 5 GDPR?
Holding
The Commissioner finds that the Council was correct in withholding the requested information on the basis of regulation 13 EIR.
With reference to the principles laid out in Article 5 (1) (a) GDPR, the Commissioner seeks to determine the lawfulness of a potential disclosure by examining the conditions for legitimate interest according to Article 6 (1) (f) GDPR.
The Commissioner confirms a legitimate interest of the complainant in receiving the requested information, albeit no wider one in the public accessing the information.
Disclosure would also be necessary, including being the least intrusive means to satisfy the legitimate interest specified, she finds.
Crucially, the Commissioner states that in her view “a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed” and whether “disclosure would be likely to result in unwarranted damage or distress to that individual”.
The Commissioner supports the Council’s consideration that complaints to the Council are generally submitted with the expectation of the submitter’s personal information not be released, noting also that a release under EIR would formally be a release into the public domain.
This be supported by the fact that there is no option to submit a complaint to the Council anonymously and that the submission form contains an assurance of confidentiality. This assurance was, in addition, reconfirmed personally to the submitter of the original complaint during the process of further internal investigations into the complaint.
The identity of an individual making a complaint must therefore, and due to the general rationale for and application of the practice of non-disclosure, be subject to the common law duty of confidentiality.
The individual explicitly denied consent for disclosure and, not solely based on this fact, disclosure of their identity would be “highly likely to cause damage or distress to them […]”
The Commissioner concludes that the fundamental rights and freedoms of the individual whose data is concerned are not outweighed by the merely personal legitimate interest of the complainant and that accordingly, for lack of a legal basis of processing, and in particular Article 6 (1)(f), disclosure would contravene the principle of lawful processing. On this basis the Council correctly refused disclosure with reference to regulation 13 EIR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
