Kol v Information Commissioner and Reigate and Banstead Borough Council

For disclosure of third-party personal data under Freedom of Information Act 2000, the necessity requirement in Article 6(1)(f) GDPR is assessed by reference to the particular information requested and the requester’s stated legitimate interests. Disclosure is not necessary where those interests can reasonably be met by a less intrusive alternative.

The three Article 6(1)(f) questions are sequential. The data subject’s competing rights and freedoms require balancing only if the requester has a legitimate interest and disclosure is necessary. Personal data is protected because it is personal data; proof of distress or other harm is not a precondition to protection.

Ms Kol requested information from a local authority about the qualifications, training and continuing professional development records of named planning officers. The authority refused disclosure under section 40(2) of the Freedom of Information Act 2000. The Information Commissioner upheld that refusal in decision notice FS50889409.

The First-tier Tribunal (General Regulatory Chamber), reference EA/2020/0017P, dismissed Ms Kol’s appeal on 6 October 2020. It accepted that she pursued a legitimate interest in transparency and accountability, but found disclosure unnecessary because recruitment and training processes, together with publicly available qualifications of two senior officers, sufficiently met that interest.

On appeal, the Upper Tribunal considered whether the First-tier Tribunal had erred in law in applying Article 6(1)(f) GDPR and the statutory personal-data exemption.

1. Appeal dismissed. The First-tier Tribunal made no error on a point of law for the purposes of section 12 of the Tribunals, Courts and Enforcement Act 2007.

2. Article 6(1)(f) GDPR requires three sequential questions: whether the requester pursues a legitimate interest, whether disclosure is necessary for that interest, and, if so, whether the data subjects’ interests or rights override it. The Upper Tribunal applied South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421. It held that necessity is not absolute necessity, but disclosure is not necessary where the legitimate aim can be achieved by something less intrusive.

3. The enquiry concerns the particular information requested, rather than a general aspiration for openness in public service. The First-tier Tribunal was entitled to find that recruitment checks, individual training arrangements and public information about two senior officers’ qualifications provided a sound alternative means of meeting Ms Kol’s stated interest. Disclosure was therefore not necessary, and section 40(2) of the Freedom of Information Act 2000 was properly relied upon.

4. As necessity was absent, no balancing of the officers’ rights and freedoms was required. The Upper Tribunal added that personal data does not need to cause embarrassment, distress or other demonstrated harm before it attracts protection. Any effect of disclosure becomes relevant when a balance between competing interests must be resolved.

5. The Upper Tribunal’s role was not to substitute its own assessment of necessity, but to decide whether the First-tier Tribunal was entitled to reach its conclusion. It was so entitled.

• Upper Tribunal (Administrative Appeals Chamber): dismissed Ms Kol’s appeal and held that the First-tier Tribunal had made no error of law: [2022] UKUT 74 (AAC).

• First-tier Tribunal (General Regulatory Chamber): dismissed the appeal from the Information Commissioner’s decision notice FS50889409, reference EA/2020/0017P, on 6 October 2020.