Gloucestershire County Council – Dismissed (United Kingdom, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Information Commissioner's Office dismissed a complaint against Gloucestershire County Council for not providing certain staff qualification details. The case shows that not all information requests will be granted if they involve personal data.
What happened
Gloucestershire County Council did not disclose staff qualification details requested by a complainant.
Who was affected
The complainant who requested information about the qualifications of staff in the LLFA department.
What the authority found
The ICO decided that the Council correctly withheld the information as it was considered personal data and its disclosure would not meet GDPR's lawful processing requirements.
Why this matters
This decision highlights that organizations can withhold personal data if its disclosure isn't justified under data protection rules. It underscores the balance between transparency and privacy in handling information requests.
GDPR Articles Cited
National Law Articles
On 13 June 2019, the complainant asked the Council to have access to various kinds of information related to the LLFA department (funding, qualifications of the staff, headcount etc.). The Council provided some pieces of information, but it did not disclose any information related to the qualifications of the members hired for the LLFA function. From the complainant point of view, this information would be useful for them to understand the level of experience and technical qualifications held by the LLFA experts, which sometimes provide pieces of advice to the complainant for critical planning decisions. The Council provided more details on the request (in particular the job profiles for four distinct roles within the team) and confirmed the validity of the hiring process, however it did not grant the access to all the information requested on the exception laid out on section 40(2) of the FOIA. The ICO had to determine whether the Council had correctly withheld information on the basis of section 40(2)of the FOIA. First, the ICO had to assess if the requested information constituted personal data. Secondly, the ICO needed to analyse if the information to disclose would contravene the Data Protection principles established by the Art. 5 of GDPR. In particular, as far as the Art. 5 is concerned, the ICO needed to assess if the request was lawful on the basis of a 'legitimate interest' of the individual and, therefore, verify if the criteria of legitimate interest assessment were met. First, notwithstanding the fact the complainant did not want the names of the LLFA members, the ICO confirmed that the information requested (number of officers in a specific team and which qualifications are held within the team) can be considered personal data related to them. Then, the DPA evaluated if the disclosure of this information would have been lawful, fair and transparent, according to the Art. 5(1)(a) of the GDPR. With regards to the lawfulness of the request, one of the
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for Gloucestershire County Council in UK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Gloucestershire County Council - United Kingdom (2020). Retrieved from cookiefines.eu
Last updated: