Johnna Reeder – Court Ruling (United Kingdom, 2024)

Johnna Reeder is the data subject. Cardiff Bus is the controller. Following an incident on a Cardiff Bus in June 2023, Johnna Reeder requested unedited CCTV footage under the Freedom of Information Act (FOIA). Cardiff Bus refused, citing the UK GDPR and FOIA exemptions, but offered a redacted version. Reeder complained to the Information Commissioner, who upheld Cardiff Bus's decision. Reeder appealed to the First-tier Tribunal, challenging the interpretation of personal data under data protection law. The case centred on the interaction between FOIA and the data protection regime under the Data Protection Act 2018 and UK GDPR, particularly regarding the processing and disclosure of personal data. The First-tier Tribunal dismissed Reeder's appeal, affirming that the unedited CCTV footage was exempt under Section 40(2) FOIA as it contained personal data of third parties. The Tribunal applied Article 5 UK GDPR and Article 6 UK GDPR, concluding that disclosing the unedited footage would violate the principles contained in these articles. It emphasized that under data protection law, processing must be "necessary" and proportionate, which was not the case here. The Tribunal ruled that privacy rights take precedence over information rights in such cases, as per the UK GDPR's fundamental purpose of protecting individuals' privacy in data processing. It held that disclosing the unedited footage would be unlawful under the UK GDPR, and that Reeder's interests could be met through less privacy-invasive means. Accordingly, the Tribunal dismissed Reeder's appeal.