Cinneadh
ABC and Meath County Council (the Council)
Ó Oifig an Choimisinéara um Fhaisnéis Comhshaoil
Cásuimhir: CEI/17/0036
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Ó Oifig an Choimisinéara um Fhaisnéis Comhshaoil
Cásuimhir: CEI/17/0036
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the Council was justified in considering that it had granted the appellant access to the environmental information within the scope of its AIE request. The information provided to the appellant was extracted from a spreadsheet and database held by the Council in regard to sites inspected as part of the derelict sites process.
On 5 August 2017, the appellant made a request to Meath County Council (the Council) under the AIE Regulations for certain information, including the following:
“The list of properties inspected by the Council as reported at point 9.9 of the minutes of the Council meeting held on 2 November 2015”.
Point 9.9 of the minutes of that Council meeting referred to a report which referenced the Council having inspected over 400 properties since 2007 as part of the derelict sites process. The Derelict Sites Act 1990 (the 1990 Act), among other things, places a general duty on local authorities to take all reasonable steps to ensure that any land situated in their functional area does not become or continue to be a derelict site. In carrying out its obligations under the 1990 Act the Council investigates alleged derelict sites.
The Council notified the appellant on 28 August 2017 that it was granting its request. It released a list containing the ‘file reference’, ‘year’ and ‘area’ for 349 sites which it had inspected as part of the Council’s derelict sites process.
The appellant requested an internal review of the Council’s initial decision on 4 September 2017 on the basis that “[t]he addresses and the names of the registered owners of the derelict sites listed in Appendix 2 have been omitted”.
On 29 September 2017, the Council notified the appellant of its internal review decision, stating that the appellant requested a list of properties inspected and that a full list of the inspections with reference numbers had been released. The Council stated during this review that the request did not specify that a list of names and addresses was required and that, in its view, the internal review request was a new request.
The appellant's appeal was received by my Office on 2 October 2017.
In conducting my review, I have had regard to the submissions of both parties and to:
the 1998 United Nations Economic Commission for Europe Convention on Access to Information, Public Participation in Decision-Making and Access to Justice in Environmental Matters (the Aarhus Convention);
I have also had regard to the relevant provisions of the Freedom of Information Act 2014 (the FOI Act), the 1990 Act, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the GDPR), the Data Protection Acts 1988 to 2018 (the DP Acts) and the Data Protection Act 2018 (the 2018 Act).
What follows does not make comment or findings on each and every argument advanced but all relevant points have been considered.
The appellant’s request was for “[t]he list” of properties inspected as referenced in the minutes of the Council meeting on 2 November 2015. My investigator asked the Council if at the time it received the request, it held a single definitive list detailing the properties which had been inspected by the Council for the purposes of the 1990 Act. The Council said that it did not hold a single definitive list. The Council explained that the list it released to the appellant had been created by amalgamating information from a spreadsheet which contained information about sites inspected from 2007 to 2013 and a database which contained information about sites inspected from 2013 to 2015. In effect, the Council created the list that was released, which it is not required to do under the AIE Regulations.
The Council submitted that the original request was for “a list of properties inspected by the Council” up to 2 November 2015 which it had provided to the appellant. It stated that the request “did not specify that a list of names and addresses was required” and that it considered the internal review request a new request.
The appellant strongly disputed that its internal review request was a new request. The appellant stated that the request was for the “list of properties inspected by the Council” and that it is clear from the “plain meaning” of those words and the request that it was seeking information to identify the properties inspected and the owners of each property. It pointed out that the internal review decision did not address the point that the addresses and the owners had been omitted. It stated that, if there was any doubt about the meaning of the request, the Council should have engaged with it to clarify the scope.
The appellant in effect requested the information which was referred to in the minutes of the Council meeting. That information was held in a spreadsheet and database. It seems that the Council understood the appellant's request to be referencing the information contained in the spreadsheet and database. The Council could have consulted with the appellant to clarify the matter. In the circumstances, I do not regard the appellant's internal review request as a new request; rather, it clarified that its request sought the locations of sites inspected and the owners of those sites insofar as such information was in "the list".
Article 4(1) provides that the AIE Regulations do not apply to environmental information which is required to be made available to the public, whether for inspection or otherwise, under any statutory provision apart from the AIE Regulations. The exception in article 4(1) is qualified by the list of statutory provisions listed in article 4(2); however, they are not relevant in this case.
Section 8 of the 1990 Act provides that local authorities must maintain a register of derelict sites and that register includes, among other things, the name and address of each owner and occupier of the derelict site, where these can be ascertained by reasonable enquiry (section 8). Section 8(5) provides that the derelict sites register must be kept at the offices of the local authority and must be available for inspection at the offices of the local authority during office hours.
Of the 349 sites in the spreadsheet and database, seven are currently registered as derelict on the Council's derelict sites register (the Register). The Council confirmed to my investigator that it maintains the Register under section 8 of the 1990 Act. It also confirmed that, in accordance with section 8(5) of that Act, the Register is available for inspection in the Council's headquarters and its municipal district offices during working hours. I compared the information in the spreadsheet and database relating to those seven sites with the relevant entry in the Register. The information in the spreadsheet and the database is not identical to that in the Register. Accordingly, I am satisfied that the information relating to those seven sites is not publicly available in the Register and, therefore, it is within the scope of my review. My review in this case is concerned with the information in the spreadsheet and database which was not released to the appellant in response to its request.
The Council submitted that the names and addresses are personal data. It stated that, under the data protection principles in article 5 of the GDPR and section 2(1)(c)(ii) of the DP Acts, it is required to keep any personal data it collects in a secure manner and not to disclose it in areas incompatible with its intended use and the purpose(s) for which it was collected. The Council explained that the personal data was collected in relation to its investigations under the 1990 Act. The Council stated that it was inappropriate to release personal data identifying the homes of people that are in the spreadsheet and database as their properties might not even be deemed to be derelict.
The appellant stated that it would not object to the name of the owner (where the owner is a natural person) and the owner’s address (where the address is not the same as the location of the allegedly derelict site) being redacted if I were to find this was justified under the AIE Regulations in the interest of protecting the confidentiality of personal data. The appellant submitted that the Council failed to note section 44(2) of the 2018 Act which permits the release of personal data under the AIE Regulations. I note that at the time the Council made its decisions on the request, and its submission to my office in this case, the 2018 Act had not been commenced.
Article 86 of the GDPR provides that personal data in official documents held by a public authority may be disclosed in accordance with Member State law. Section 44(2) of the 2018 Act provides that for the purposes of article 86 of the GDPR “personal data contained in environmental information may be disclosed where the information is made available under and in accordance with the [AIE] Regulations pursuant to [an AIE request]”. Section 44(2) does not automatically provide for the release of personal data where it is requested under the AIE Regulations. Rather it permits the release of such information where it falls to be disclosed under the AIE Regulations, i.e. where disclosure of the personal data is found to be in the public interest.
Article 8(a)(i) of the AIE Regulations
Article 8(a)(i) provides for the refusal of environmental information where disclosure of the information would adversely affect the confidentiality of personal information relating to a natural person who has not consented to the disclosure of the information, and where that confidentiality is otherwise protected by law. Although article 8(a)(i) refers to “personal information”, both the AIE Directive and the Aarhus Convention in the corresponding exception to article 8(a)(i) refer to “personal data”. Article 4 of the AIE Directive provides that Member States shall ensure that the requirements of Directive/95/46/EC are complied with (Directive/95/46/EC has been repealed and replaced by the GDPR).
The Council’s spreadsheet and database contain the names, addresses and phone numbers of both natural and legal persons whom it considers are or might be the owners, reputed owners or occupiers of the sites, and information relating to the location of the sites, that it inspected for the purposes of the 1990 Act. Having examined the spreadsheet and database, I am satisfied that some of the information relates to natural persons or individuals. Under Article 4(1) of the GDPR and section 1 of the DP Acts, ‘personal data’ is information or data relating to a natural person or individual that can identify an individual either directly or indirectly. The Court of Justice of the European Union (CJEU) in Case C-28/08 European Commission v The Bavarian Lager Co. Ltd. available here, cited, in the context of the definition of personal data in Regulation No 45/2001, surnames and forenames, postal addresses, and telephone numbers as examples of personal data (see paragraph 104). I am satisfied that the names, addresses and phone numbers of individuals in the spreadsheet and database can directly lead to the identification of those individuals and are personal data for the purposes of the GDPR, the DP Acts and the 2018 Act.
In addition, I consider that the location information relating to the inspected sites is the personal data of owners, reputed owners or occupiers of the sites. I accept that location information can directly lead to the identification of the owner or occupier. This is evident from the fact that the spreadsheet and database were, in part, populated through the Council’s local knowledge. Moreover, the location information may indirectly identify an individual, for example, by pooling the information with other information available about the individual. Accordingly, I am satisfied that the names, addresses, phone numbers of individuals and the location information for the sites inspected are personal data, the confidentiality of which is provided for under EU and national data protection law and also by section 37 of the FOI Act..
Disclosure of personal data under the AIE Regulations would be akin to disclosing the information to the world. I am satisfied that such disclosure would adversely affect the confidentiality of personal data within the meaning of article 8(a)(i). Accordingly, I find that article 8(a)(i) applies to the names, addresses and phone numbers of individuals, and to the location information of the sites inspected which are owned or occupied by individuals.
The appellant submitted that there does not appear to be any justification for redacting ownership details where the owner is a legal person. The CJEU in Joined Cases C-92/09 and C-93/09, Volker und Markus Scheck GbR and Hartmut Eifert v Land Hessen, available here, clarified that legal persons can claim the right to data protection in Article 8 of the Charter of Fundamental Rights of the European Union 2000 (the Charter) to the extent that the official title of the legal person identifies one or more natural persons (see paragraph 53). For that reason, I consider that information relating to legal persons can be the personal data of a natural person where, for example, the official title of a company is named after an individual who founded or owns the company. Having examined the spreadsheet and database, some of the information in them appears to relate to companies named after individuals, possibly the founder or registered owner of the company. It is conceivable that such information could identify an individual, and therefore is personal data; the confidentiality of which is provided for under EU and national data protection law and also by section 37 of the FOI Act. In the circumstances of this case, I find that redacting ownership details may be justified in certain instances where the owner is a legal person.
Public Interest Test
Article 10(3) of the AIE Regulations provides that a public authority shall consider each request on an individual basis and weigh the public interest served by disclosure against the interest served by refusal. Article 10(4) of the AIE Regulations provides that the grounds for refusal of a request for environmental information shall be interpreted on a restrictive basis having regard to the public interest served by disclosure. I take article 10(4) to mean, in line with the Minister's Guidance, that there is generally a presumption in favour of the release of environmental information. However, as discussed below, this is subject to the strong protection afforded to the right to privacy and right to data protection under European and Irish law.
The Council explained that, in some cases, investigations are closed as the property is deemed in the first instance not to be derelict. The spreadsheet and database that I examined indicate that a relatively large number of cases are marked "closed". The Council also stated that the release of information could result in a devaluation of the person’s property.
The appellant submitted that, in its own experience, the Council has failed to keep its derelict sites register up-to-date. It noted that there are only eight sites on the register but that, in its opinion, there are more derelict sites in the county. The appellant stated that there is a very strong public interest in identifying sites which may or may not be derelict in order to ascertain whether the Council is meeting its obligation under the 1990 Act to keep the Register up-to-date. It continued that “the [R]egister itself has an important role to play in combatting dereliction” and that “there should be a high degree of transparency in respect of why [the Council] has registered so few sites relative to the number of sites that it has inspected.”
The right to privacy and the right to data protection are fundamental rights under Articles 7 and 8 of the Charter. The right to privacy has also been recognised by the Irish courts as an unenumerated right under Article 40.3 of the Constitution of Ireland. I consider that there is a very significant public interest in upholding individuals’ right to privacy and right to data protection.
While neither the right to privacy nor the right to data protection are absolute, I consider that privacy and data protection rights should be set aside only where the public interest served by granting the request is sufficiently strong to outweigh the public interest in protecting privacy and personal data. I accept that there is a very strong public interest in transparency concerning the way in which the Council carries out its obligations under the 1990 Act. However, this must be weighed against the very significant public interest in protecting the privacy and data protection rights of individuals. Both the spreadsheet and database have seven columns of information, three of which were released to the appellant: the ‘file reference’ for the file relating to the site inspected, the relevant ‘year’ and the location of the site by ‘area’. It seems to me that the public interest in openness and transparency concerning the way in which the Council carries out its obligations under the 1990 Act is served to a large extent by the information released to the appellant in response to its request and also by the Register. In the circumstances of this case, I find that the public interest in favour of maintaining the exception in article 8(a)(i) outweighs the public interest in disclosing the personal data of individuals.
Whether it would be appropriate for me to require the release of further information
Article 10(5) of the AIE Regulations provides that nothing in article 8 or 9 shall authorise a public authority not to make available environmental information which, although held with information to which article 8 or 9 relates, may be separated from such information. This means, in effect, that a request should be granted in part where environmental information may be separated from other information that is subject to refusal under article 8 or 9 of the Regulations. Article 12(5)(c) of the AIE Regulations provides that I shall, upon reviewing a decision, require a public authority to make environmental information available where it is appropriate to do so. In this case, requiring the release of further information under article 12(5)(c) would require the separation of other information from personal data falling under article 8(a)(i). I consider that article 10(5) necessarily applies only where it is reasonably practicable to sever the information concerned and that a reasonable and proportionate approach should be taken in determining whether to grant access to information in part.
Identifying information for separation and release is not a straightforward matter in this case. The content of the spreadsheet and database is not homogenous or complete. I acknowledge, as the Council does, that some of the information in the spreadsheet and database is vague or incomplete. The information reflects the state of knowledge of the Council on the sites, at a certain point in time, based on various sources. Third parties, both natural and legal persons, would need to be consulted in order to identify exactly which information directly and indirectly identifies natural persons. Moreover, procedural fairness requires that any third parties who would be adversely affected by the disclosure of environmental information are consulted. In this case, that requirement would necessitate contacting a large number of parties and considering their responses.
Furthermore, the Council stated that, where a site is inspected and is deemed not to have been derelict in the first instance, the investigation would be closed without the Council needing to contact the owner, reputed owner or occupier. Release of further information in this case could result in the release of information which is misleading; for example, it could wrongly lead to the conclusion that there has been some irregularity in how a person or persons are managing their property. In the circumstances of this case, I do not consider that it would be appropriate or proportionate for the Council or my Office to contact the third parties whose information is in the spreadsheet and database in order to carry out the necessary consultation.
In such circumstances, I consider that separating information in the spreadsheet and the database for release pursuant to article 10(5) is not practicable. Therefore, I am satisfied that the decision by the Council to refuse access in part was justified under article 8(a)(i) of the AIE Regulations.
Having carried out a review under article 12(5) of the AIE Regulations, I find that the decision by the Council to refuse access in part was justified under article 8(a)(i) of the AIE Regulations. Accordingly, I affirm the Council's decision.
A party to the appeal or any other person affected by this decision may appeal to the High Court on a point of law from the decision. Such an appeal must be initiated not later than two months after notice of the decision was given to the person bringing the appeal.
Peter Tyndall, Commissioner for Environmental Information