Gloucestershire County Council – Dismissed (United Kingdom, 2020)

On 13 June 2019, the complainant asked the Council to have access to various kinds of information related to the LLFA department (funding, qualifications of the staff, headcount etc.). The Council provided some pieces of information, but it did not disclose any information related to the qualifications of the members hired for the LLFA function. From the complainant point of view, this information would be useful for them to understand the level of experience and technical qualifications held by the LLFA experts, which sometimes provide pieces of advice to the complainant for critical planning decisions. The Council provided more details on the request (in particular the job profiles for four distinct roles within the team) and confirmed the validity of the hiring process, however it did not grant the access to all the information requested on the exception laid out on section 40(2) of the FOIA. The ICO had to determine whether the Council had correctly withheld information on the basis of section 40(2)of the FOIA. First, the ICO had to assess if the requested information constituted personal data. Secondly, the ICO needed to analyse if the information to disclose would contravene the Data Protection principles established by the Art. 5 of GDPR. In particular, as far as the Art. 5 is concerned, the ICO needed to assess if the request was lawful on the basis of a 'legitimate interest' of the individual and, therefore, verify if the criteria of legitimate interest assessment were met. First, notwithstanding the fact the complainant did not want the names of the LLFA members, the ICO confirmed that the information requested (number of officers in a specific team and which qualifications are held within the team) can be considered personal data related to them. Then, the DPA evaluated if the disclosure of this information would have been lawful, fair and transparent, according to the Art. 5(1)(a) of the GDPR. With regards to the lawfulness of the request, one of the legal bases listed in Article 6(1) of the GDPR must apply to the processing. In this case, the Supervisory Authority specified that the 'legitimate interest' (art. 6(1)(f)) would underlie as the most appropriate basis. Therefore, the ICO proceeded to assess the three-part test (legitimate interest, necessity and balancing tests) to see what would be the outcome. As mentioned above, the complainant was interested in the expertise of the LLFA staff, which provide support and advice for some critical situations related to the complainant's tasks ('legitimate interest test'). Also, in its view, disclosing this information would be the only way to have access to it ('necessity test'). However, moving to the 'balancing test', the ICO interpreted this to mean that the members of the staff would not have expected that their personal data would be released to the public, in particular after having gone through the Council recruitment process and checks. The Commissioner, therefore, considered that disclosure remains beyond their expectations and would cause them some level of distress. Taking into account this evaluation, the Authority rejected the request of the complainant and confirmed the choice of the Council to withhold these pieces of information, in the light of the insufficient legitimate interest of the complainant to take priority over the data subjects’ fundamental rights and freedoms and in line with its previous decisions (such as FS50819174, FS50849126, FS50668506 and FS50849126).