Canterbury City Council – Dismissed (United Kingdom, 2019)

The complainant has requested the disclosure of information about complaints in respect of a specified property over a defined period of time. Canterbury City Council (“the Council”) withheld the information because it considered that the information within scope was the personal data of third parties and that disclosure would breach the GDPR principles. The complainant challenged the decision before the ICO. Are the information contained in the complaints sensitive personal data? Would a disclosure to the word art large and not to the complainant only, contravene GDPR principles ? The Commissioner’s decision is that, as the complainant and his family have either owned or occupied the land in question during the time period specified, all the information falling within the scope of the request is in fact the complainant’s own personal data. The ICO has therefore applied Regulation 5(3) of the Environmental Information Regulations 2004 (EIR) which prevents disclosure to the world at large of information including personal data. Also, the ICO considered that the personal data at issue were criminal offence data about the complainant, as described by Article 10 GDPR, and not special category of personal data, as described by Article 9 GDPR. The complainant requested information about members’ registers of declaration of interest. Snowdonia National Park Authority (‘the Authority’) withheld the information requested under section 40(2) of the FOIA. This provision applies as an exemption to the principle of disclosure, if there is third party personal data concerned. The Commissioner found that the Authority had incorrectly applied section 40(2) to the request. The Commissioner required the public authority to disclose the information requested by the complainant, namely, the previous copies of the members’ registered of declaration of interest. The Commission found that the information comprised declaration of personal interest forms completed by members of the Authority with the name of the members. However, the members named in these declarations of interest, are deceased. Thus, the information at issue cannot constitute personal data relating to a living identifiable individual as defined by the adaption law of the GDPR. URL: https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616245/fs50810710.pdf The ICO issued a decision related to disclosure of information held by public authorities which was likely to include personal data.