City of York Council – Dismissed (United Kingdom, 2020)

The complainant requested the Council provide details of their Conservation Officers and Flood Risk Management Team, including the nature of their employment, salary and professional qualifications. The Commissioner regulates the FOIA and Data Protection Act 2018 (DPA) and so was tasked to consider whether the Council's refusal to supply information requested, which it claimed was personal information and so exempt under Section 40(2) FOIA, was correct application of the law. whether the information requested amounted to personal information and in The ICO had to assess whether the requested information constitutes personal data according to the DPA. Then, if it is personal data, the ICO must establish whether disclosure could be justified. Article 40(2) FOIA provides an exemption against the disclosure of personal information. According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA. The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject". The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests. The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information on the basis of accountability and transparency as well as case specific interests, how