Neath Port Talbot Council – Dismissed (United Kingdom, 2020)

The complainant had received a letter from the Council regarding a complaint about his dog barking. He requested the name of the person who had submitted the complaint but was refused this information under regulation 13 EIR. Was the Council correct in withholding the information requested under regulation 13 EIR – id est (in this case, via regulation 13 (2A) a of the Data Protection Act 2018 (DPA 2018), as amended by Schedule 19 Paragraph 307(3) DPA 2018) would disclosure contravene any data protection principles as set out in Article 5 GDPR? The Commissioner finds that the Council was correct in withholding the requested information on the basis of regulation 13 EIR. With reference to the principles laid out in Article 5 (1) (a) GDPR, the Commissioner seeks to determine the lawfulness of a potential disclosure by examining the conditions for legitimate interest according to Article 6 (1) (f) GDPR. The Commissioner confirms a legitimate interest of the complainant in receiving the requested information, albeit no wider one in the public accessing the information. Disclosure would also be necessary, including being the least intrusive means to satisfy the legitimate interest specified, she finds. Crucially, the Commissioner states that in her view “a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed” and whether “disclosure would be likely to result in unwarranted damage or distress to that individual”. The Commissioner supports the Council’s consideration that complaints to the Council are generally submitted with the expectation of the submitter’s personal information not be released, noting also that a release under EIR would formally be a release into the public domain. This be supported by the fact that there is no option to submit a complaint to the Council anonymously and that the submission form contains an assurance of confidentiality. This assurance was, in addition, reconfirmed personally to the submitter of the original complaint during the process of further internal investigations into the complaint. The identity of an individual making a complaint must therefore, and due to the general rationale for and application of the practice of non-disclosure, be subject to the common law duty of confidentiality. The individual explicitly denied consent for disclosure and, not solely based on this fact, disclosure of their identity would be “highly likely to cause damage or distress to them […]” The Commissioner concludes that the fundamental rights and freedoms of the individual whose data is concerned are not outweighed by the merely personal legitimate interest of the complainant and that accordingly, for lack of a legal basis of processing, and in particular Article 6 (1)(f), disclosure would contravene the principle of lawful processing. On this basis the Council correctly refused disclosure with reference to regulation 13 EIR.