John Doran v The Information Commissioner

On considering the written representations of the parties and other documents tabled, the Tribunal unanimously determines that the appeal is dismissed. Reasons Introduction and Procedural History

1. We will refer to the Appellant by name and the Respondent as ‘the Commissioner’.

2. On 9 February 2024 Mr Doran submitted to Newry, Mourne & Down District Council (‘the Council’) a request for information under the Environmental Information Regulations 2004 (‘EIR’) in the following terms: The Request also referred to the Freedom of Information Act 2000 , but it is agreed on all sides that EIR apply. … I would like to request a digital copy of any and all information held by NMDDC on the illegal site operated in [redacted]. Please include all internal communications with DAERA, FSANI and all other bodies.’ We will refer to it as ‘the Request’.

3. On 28 February 2024 the Council responded, stating that to confirm whether the information was held would, in itself, involve disclosure of personal data of any person connected to the business referred to. Accordingly, it cited EIR reg 13(5A) to neither confirm nor deny that the information was held.

4. Mr Doran challenged the response but, following an internal review, the Council wrote to him on 23 May 2024 maintaining its position.

5. On 6 June 2024 Mr Doran complained to the Commissioner.

6. Following an investigation, the Commissioner issued a Decision Notice dated 17 December 2024 (‘the DN’), upholding the Council’s stance in citing EIR, reg 13(5A).

7. On the same day Mr Doran presented a notice of appeal challenging the Commissioner’s adjudication.

8. On 11 February 2025 the Commissioner presented a response to the appeal, standing by the reasoning in the DN.

9. Mr Doran replied by an email of 23 May 2025.

10. The appeal came before us for consideration on paper, the parties being content for it to be determined without a hearing. We were satisfied that it was just and in keeping with the overriding objective to proceed in that manner. See the First-tier Tribunal (General Regulatory Chamber) Rules 2009 (as amended), rule 2.

11. We had before us concise open and closed bundles. The Law The right to information

12. EIR, reg 5(1) enacts a general obligation on public authorities to make environmental information available on request. For most purposes, a presumption in favour of disclosure applies (reg 12(2)) but, where the information requested includes personal data of which the applicant is not the data subject, that rule is negated by reg 12(3), which prohibits disclosure otherwise than in accordance with reg 13. Unless otherwise stated, all references to regulation numbers hereafter are references to EIR.

13. Reg 13 includes: (5A) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether [the requested] information exists and is held by the public authority, whether or not it holds such information, to the extent that – (a) the condition in paragraph (5B)(a) is satisfied … (5B) The conditions mentioned in paragraph (5B)(a) are – (a) giving a member of the public the confirmation or denial – (i) would (apart from these Regulations) contravene any of the data protection principles … The language and concepts of the data protection legislation are translated into the Regulations (reg 2(1)).

14. The exception under reg (5A)(a) is unqualified. Accordingly, no public interest balancing test applies.

15. The data protection regime under the Data Protection Act 2018 (‘DPA’) and the General Data Protection Regulation (‘GDPR’) applies to this case.

16. DPA, s3 includes: (2) “Personal data” means any information relating to an identified or identifiable living individual ... (3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to — (a) an identifier such as a name, an identification number, location data or an online identifier … (4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as — … (d) disclosure by transmission, dissemination or otherwise making available … (5) “Data subject” means the identified or identifiable living individual to whom personal data relates.

17. GDPR, Article 5 sets out the data protection principles. It includes: Personal data shall be:

1. processed lawfully, fairly and in a transparent manner in relation to the data subject …

18. Article 6, so far as material, provides:

1. Processing shall be lawful only if and to the extent that at least one of the following applies: … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

19. The starting-point is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded. At para 7 he commented: In my opinion there is no presumption in favour of release of personal data under the general obligation that FOISA The proceedings were brought under the Freedom of Information ( Scotland) Act 2000 , but the remarks on the interplay between freedom of information and privacy rights are no less applicable in the context of proceedings under EIR. lays out. The references which that Act makes to provisions of [the Data Protection Act] 1998 must be understood in the light of the legislative purpose of that Act , which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data …

20. It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, ‘necessary’ means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55 . But in order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC) . Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin) , para 76. Third, in weighing the competing considerations, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC) , para 23.

21. As we have noted, the Request includes an assertion of illegal conduct on the part of the business which Mr Doran identifies. This adds an extra layer of protection for the data subject (over and above that provided under reg 12(3) and reg 13 read with the generally-applicable data protection legislation already discussed), engaging the criminal offence data provisions which prohibit processing of information in relation to criminal offences (or alleged offences) , save where any condition in any one or more of three categories, namely (a) ‘employment, health, research etc conditions’, (b) ‘substantial public interest conditions’, and (c) ‘criminal offence data conditions’, applies (DPA, s10(4) and (5) and s11(2) and GDPR, Article 10). Here, Mr Doran seems to invoke the ‘substantial public interest’ conditions (DPA, sch 1, paras 6-28), but does not identify an applicable provision, much less one underpinned by an ‘appropriate policy document’, as all but three require (sch 1, para 5). Instead, he appears to appeal to a general public interest in protecting public health, ensuring compliance with environmental regulations and promoting transparency and accountability in local government enforcement measures (see his reply of 25 May 2025). But this is to read into the legislation a public interest balancing test that does not exist. As for the ‘employment, health, research etc conditions’ and the ‘criminal offence data conditions’ (DPA, sch 1, paras 1-4 and 29-37 respectively) Mr Doran does not argue that any was in play. Confusingly, and rather against his own case, Mr Doran did contend that the criminal offence data provisions were not in point – apparently on the basis that wrongdoing by the data subject was not merely ‘alleged’ but established. The Tribunal’s powers

22. The appeals are brought pursuant to the Freedom of Information Act 2000 , s57 . The Tribunal’s powers in determining the appeal are delineated in s58 as follows: (1) If on an appeal under section 57 the Tribunal consider – (a) that the notice against which the appeal is brought is not in accordance with the law; or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based. Analysis

23. In our view, this is a very straightforward case. We agree with the Commissioner’s conclusions and his reasoning. The main planks of our analysis are as follows. In the first place, to repeat, the Request asks for ‘environmental information’ as defined (‘EIR, reg 2(1)). This is not in contention.

24. Second, a response to the Request which confirmed or denied that information within its scope was held would, given the information contained in the Request concerning the name and whereabouts of the business to which it refers and readily-available company information, disclose information namely (a) information about a person closely associated with the business, viz (at the very least) his/her name and status and business address, and (b) the fact that the Council held, or did not hold, information within the scope of the Request relating to the activities of the business and thus also to the individual referred to in (a).

25. Third, such information would amount to information relating to an identifiable living individual and so constitute his/her ‘personal data’ (DPA, s3(2)).

26. Fourth, communication of such personal data in a response to the Request would constitute ‘processing’ (DPA, s3(4)).

27. Fifth, such processing would contravene the First Data Processing Principle (GDPR, Article 5.1 read with Article 6.1(f) in that, even if it is assumed that Mr Doran has a ‘legitimate interest’, processing is manifestly not ‘necessary’ in furtherance of it. In particular, it cannot be said that the processing would amount to the only or least intrusive means of furthering the ‘interest’ (see the Halpin and Cabinet Office cases cited above). It might be furthered by any number of steps. These might include reporting concerns or allegations to any or all of the statutory bodies with responsibilities bearing upon the trade in which the business referred to in the Request is engaged (although it seems that Mr Doran has already taken this step). Since criminality is alleged, it may be that a report could be directed to the police or any other relevant law enforcement body, if that has not already happened. Mr Doran could look to arouse the interest of the local or national press. He could enlist the support of environmental agencies or other interest groups. He could write to his MP. It is not for us to write an exhaustive list of options open to him.

28. Sixth, since the exception is absolute, Mr Doran is (as already stated) simply wrong to attempt to set up a case based on a public interest balancing exercise. That does not enter into the analysis.

29. Seventh, it follows that the appeal falls on the simple ground that the data subject’s privacy rights under reg 12(3) and reg 13 prevail over Mr Doran’s information rights.

30. Eighth, in the circumstances it is not strictly necessary to consider the criminal offence data provisions, but for completeness we hold that they are engaged (the Request makes a clear allegation of illegal conduct and a ‘confirm or deny’ response would, of itself, disclose information relating to the allegation) and that Mr Doran has not shown that their effect is relaxed by application of any of the conditions which we have discussed. As we have stated, he relied only on the ‘substantial public interest’ category but cited no particular condition as applicable, pressing instead a misconceived argument based on his perception of where the general public interest lies. And he put forward no case based on either of the other two categories of condition. It is not for us to make a case for him which he has never put forward and it would be unfair to the Commissioner for us to do so. Accordingly, we leave the matter there, upholding the Commissioner’s reasoning that the stringent extra protection under the criminal offence data provisions (specifically, the proscription of processing under DPA, s10(5)) is applicable and stands as a further ground for dismissing the appeal. We should not be taken to imply that Mr Doran has missed a winning argument. He could have respectably cited DPA, sch 1, paras 2 and 3 (health and public health respectively in the ‘employment, health, research etc’ category of conditions) but (apart from anything else) would have failed to show that processing was ‘necessary’, for the reasons we have given in relation to GDPR, Articles 5(1) and 6(1)(f).

31. Ninth, Mr Doran’s suggestion of anonymization or redaction misses the point. Such measures may be appropriate at the stage when a public authority communicates information to the requester, but not when responding to the question whether the information is held. The response would have to be read with the Request. A ‘confirm or deny’ response, read with the Request, would convey personal data of a third party and such a response could not usefully be redacted or anonymized. Disposal

32. For the reasons stated, the appeal must be dismissed.

33. Finally, we pay tribute to the clear and concise cases presented on both sides. (Signed) Anthony Snelson Judge of the First-tier Tribunal Dated: 8 December 2025