Ó Oifig an Choimisinéara um Fhaisnéis Comhshaoil
Cásuimhir: OCE-136207-Y3Q4N3
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the Department was justified in withholding information pertaining to herd numbers and associated location data under article 8(a)(i) of the AIE Regulations
02 September
1. On 2 February 2023, the appellant requested the following information from the Department: “a register of cattle herds with over 500 cattle per herd, to include the herd number and location of each cattle farm .”
2. The Department issued its original decision to the appellant on 17 February 2023. It said it was part-granting release of the requested information. It said the information the Department holds in relation to the request is held on the Department’s Animal Identification and Movement (AIM) system. It said “Herd keepers are legally required to tag and register their calves within 27 days of birth and notify AIM within 7 days of any movement taking place. I have included in Appendix 1 the number of herds with 500 plus cattle divided by county location. This information was extracted from the AIM system for 31st December 2022. Access to herd numbers and the exact location of cattle farms is refused in accordance with Article 8(a)(i) .”
3. The Department stated that the confidentiality of the records in question is otherwise protected by law under Section 37(1) of the Freedom of Information Act 2014. It also stated that it had conducted a public interest balancing test in in line with article 10(3) of the AIE Regulations. It concluded “that the over-riding public interest is in seeing that a person’s personal information will not be made public. ”
4. The appellant requested an internal review of the Department’s decision on 17 February 2023. The appellant disagreed with the Department’s finding that “herd numbers and locations of large cattle farms (over 500 cattle) constitute personal information - even if a % of the records are personal information, RTK are not requesting this data - we are only requesting herd numbers and locations of these herds - RTK would not request names of individual farmers. Other non personal entities such as companies operating large cattle farms cannot be redacted as personal data - farm data held outside DAFM is public, for example EPA pig/poultry licensees, licence numbers and locations. It makes no sense to prevent the release of data on large cattle operations, while publishing data on large pig/poultry operations - there is a public interest in release of the locations of large cattle farms due to the pressure placed on environment from these operations. ”
5. The Department issued its internal review on 6 March 2023, affirming its original decision and adding no additional reasoning. The appellant appealed to this Office on 6 March 2023.
6. I am directed by the Commissioner for Environmental Information to carry out a review of this matter under article 12(5) of the Regulation. In carrying out my review, I have had regard to the submissions made by the appellant and the Department of Agriculture, Food and the Marine. In addition, I have had regard to:
• the Guidance document provided by the Minister for the Environment, Community and Local Government on the implementation of the AIE Regulations (the Minister’s Guidance);
• Directive 2003/4/EC (the AIE Directive), upon which the AIE Regulations are based;
• the 1998 United Nations Economic Commission for Europe Convention on Access to Information, Public Participation in Decision-Making and Access to Justice in Environmental Matters (the Aarhus Convention);
• The Aarhus Convention—An Implementation Guide (Second edition, June 2014) (‘the Aarhus Guide’);
• Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the GDPR); and
• The Charter of Fundamental Rights of the European Union (the Charter)
What follows does not comment or make findings on each and every argument advanced but all relevant points have been considered.
7. In accordance with article 12(5) of the AIE Regulations, the role of this Office in this appeal is to review the Department’s internal review decision and to affirm, annul or vary it. Where appropriate in the circumstances of an appeal, I will require the public authority to make available environmental information to the appellant.
8. The appellant’s request was for a register of cattle herds with over 500 cattle per herd, to include the herd number and location of each cattle farm. The Department has identified 603 cattle herds with over 500 cattle per herd. It has refused access to the herd numbers and the location of the associated cattle farms on the basis that article 8(a)(i) applies, this review deals with whether the Department is justified in withholding this information.
Article 8(a)(i)
9. The information sought by the appellant is a register of cattle herds with over 500 cattle per herd, to include the herd number and location of each cattle farm. The Department contends that the information at issue – the herd numbers and location of the cattle farms - is personal information, and is withholding this information based on article 8(a)(i) of the AIE Regulations.
10. Article 8(a)(i) provides that: “A public authority shall not make available environmental information in accordance with article 7 where disclosure of the information— (a) would adversely affect (i) the confidentiality of personal information relating to a natural person who has not consented to the disclosure of the information, and where that confidentiality is otherwise protected by law.”
11. I consider it appropriate to set out the approach to personal data under the AIE Regime with reference to the GDPR. Article 8(a)(i) seeks to transpose Article 4(2)(f) of the AIE Directive, which enables Member States to provide for refusal of a request where disclosure would “adversely affect … the confidentiality of personal data and/or files relating to a natural person where that person has not consented to the disclosure of the information to the public, where such confidentiality is provided for by national or Community law ” (my emphasis).
12. The final paragraph of Article 4(2) states, referring to the predecessor to the GDPR: “Within this framework, and for the purposes of the application of subparagraph (f), Member States shall ensure that the requirements of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are complied with.”
13. In light of this, I consider that the reference to “personal information ” in article 8(a)(i) of the AIE Regulations to be consistent with the meaning of “personal data ” under the GDPR, a concept with which every public authority is now very familiar. It is clear from this final paragraph of Article 4(2) of the AIE Directive that the AIE regime is intended to interact harmoniously with the European data protection regime. In the same vein, Article 86 of the GDPR (read with recital 154) permits the disclosure of personal data in accordance with information access regimes under EU or national law, where those regimes reconcile the right of access to information with the right to protection of personal data. This again indicates that the GDPR is intended to interact harmoniously with national and European regimes offering public access to information.
14. In Ireland, Article 86 of the GDPR is implemented by section 44(2) of the Data Protection Act 2018, which provides: “For the purposes of Article 86, personal data contained in environmental information may be disclosed where the information is made available under and in accordance with the [AIE] Regulations pursuant to a request within the meaning of those Regulations.” On one view, this could be considered to be a standalone ‘gateway’ for the disclosure of personal data under the GDPR, permitting disclosure of all personal data contained in environmental information pursuant to an AIE request. However, the CJEU has repeatedly confirmed that the legal bases for processing in Article 6 of the GDPR are exhaustive list of the cases in which processing of personal data can be regarded as lawful (Case C-252/21 Meta Platforms at paragraph 90; Case C-26/22 Case C-26/22 SHUFA Holding at paragraph 73).
15. Since its enactment, the principal law relied on to protect the confidentiality of personal data is the GDPR. The GDPR is underpinned by the fundamental rights to privacy and the protection of personal data in the Charter. One of the stated objectives of the GDPR is to secure the “protection of natural persons with regard to the processing of personal data ” (Article 1(1)), with one of the principles of processing being integrity and confidentiality (article 5(1)(f). As noted above, the CJEU has repeatedly confirmed that the legal bases of processing in Article 6 of the GDPR are an exhaustive list of the cases in which processing of personal data can be regarded as lawful (Case C-252/21 Meta Platforms at paragraph 90; Case C-26/22 SHUFA Holding at paragraph 73). Disclosure of personal data in a manner which is not lawful, within the meaning of Article 6, is subject to sanction, including through the corrective powers of the supervisory authorities, in Ireland the Data Protection Commission. It is difficult to see how such provisions can be described as merely permissive and not protective. The protection of confidentiality under the GDPR is not absolute, but absolute protection is not required for the purpose of article 8(a)(i) of the AIE Regulations. I note the analysis of Hyland J in this regard (albeit relating to a different exception) in Commissioner for Environmental Information v Coillte Teoranta and others [2023] IEHC 227 at paragraphs 78-84.
16. It follows that, in order to determine whether the confidentiality of personal data is protected by the GDPR, one must consider whether there is a lawful basis under Article 6(1) of the GDPR for disclosure. If there is a lawful basis for disclosure, the personal data may lawfully be disclosed and the confidentiality of the personal data is not protected by the GDPR. Conversely, if there is no lawful basis for disclosure, the personal data may not be disclosed and the confidentiality of the personal data is protected by the GDPR.
17. There are six lawful bases for processing personal data set out in Article 6 of the GDPR. The Department in its submission to this Office on 15 July 2024 said it does not see any lawful basis to allow the sharing of information with the appellant in this case. I disagree and consider the most relevant basis to consider is Article 6(1)(f), ‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party.” I will explain my reasoning in more detail below.
18. In Case C180/21 Inspektor v Inspektorata kam Visshia sadeben savet, the CJEU found that processing by public authorities which is necessary for the performance of a task in the public interest comes within the scope of Article 6(1)(e) and cannot come within the scope of Article 6(1)(f), as those bases are mutually exclusive (paragraph 85). The Court found that the functions of bringing prosecutions and representing the State in an action for damages were public in nature and were ‘tasks’ of the Public Prosecutor’s Office. Accordingly, the application of Article 6(1)(f) was excluded in respect of processing for that purpose (paragraphs 91-93). This case indicates that one must consider whether the purpose of the processing is the performance of a task in the public interest or whether the purpose is a different interest of a private nature (see paragraph 86). I note the Opinion of Advocate General Campos Sánches-Bordona, where he states that Article 6(1)(f) only applies “to conflicts between (private) parties whose interests are not public in nature ” (paragraph 96 of the Opinion). This passage would suggest that a public authority can never rely on Article 6(1)(f). However, this aspect of the Opinion does not appear to have been adopted by the Court, with the Court instead making a distinction between the interests of State authorities that are public in nature and those that are private in nature. For example, the Court made a contrast between the case at issue and a case in which the State is acting in defence of private interests (paragraph 92 of the Judgment).
19. In light of this case, I consider that the question for me is whether a public authority releasing information pursuant to an AIE request is doing so for the purposes of the performance of its tasks or for some other purpose. The term ‘task’ is not defined in the GDPR, but the use of that term in the CJEU’s recent case law gives some illustration as to its meaning. For example, the ‘task’ in Case C-180/21 involved bringing prosecutions and representing the State in an action against it for damages. In Case C-667/21 Krankenversicherung Nordrhein, the Court referred to the ‘statutory task’ of the medical service for health insurance funds. In Case C-439/19, the Court referred to the ‘task’ of the Latvian Road Safety Directorate of improving road safety. In each of these examples, the ‘task’ of the body appears to refer to the functions that the particular body carries out, as opposed to the more general functions and duties applicable to all public bodies. When acting on AIE requests, public authorities are, of course, acting in accordance with their statutory duties under the AIE regime. Such duties apply generally to all public authorities. However, with the possible exception of my Office, I cannot identify any public authority whose ‘task’ involves the release of information pursuant to AIE requests. Indeed, the release of information pursuant to an AIE request may conflict with the performance of the ‘tasks’ of the public authority. For example, in a case where the effective performance of a public authority’s tasks requires that its proceedings remain confidential, a public authority may consider that release of information pursuant to an AIE request is positively inconsistent with the performance of its ‘tasks’. By contrast, the release of environmental information pursuant to an AIE request is very much in the interest of the person requesting the information. The duty of public authorities to release information facilitates the right of access of such a requester, which is conferred by the AIE regime. Taking this into account, it is my view that the release of information pursuant to an AIE request is not for the purposes of the performance of the tasks of the public body, but is for the purposes of the legitimate interests pursued by a third party, the requester. Accordingly, I do not consider that disclosure pursuant to an AIE request involves the ‘performance of the tasks’ of the public authority and the exclusion in the final subparagraph of Article 6(1) does not apply.
20. That being so, there are "three cumulative conditions’ in order for processing to be lawful in accordance with Article 6(1)(f): “… first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the interests or freedoms and fundamental rights of the person concerned by the data protection do not take precedence ” (Case C-597/19 M.I.C.M., at paragraph 106). For convenience, this is known as the ‘legitimate interest test.”
21. In relation to the first condition, the CJEU has confirmed that a wide range of interests is, in principle, capable of being regarded as legitimate (see Case C-26/22 SHUFA Holding at paragraph 76). For example, internet users may have a legitimate interest in having access to internet search engine results containing personal data ( Case C-131/12 Google Spain and Google , at paragraph 81); a person has a legitimate interest in obtaining the personal information of a person who damaged their property in order to sue ( Case C-13/16 Rigas Satiksme at paragraph 29); and a video surveillance system installed to protect the property, health and life of co-owners of a building is likely to be a legitimate interest ( Case C-708/18 Asociatia de Proprietari bloc M5A-ScaraA at paragraph 42). The purpose of the AIE regime is to promote increased public access to environmental information and more effective participation by the public in environmental decision-making, with the aim of making better decisions and applying them more effectively and, ultimately, promoting a better environment (see recitals 1 and 2 of the AIE Directive and Case C-470/19 Friends of the Irish Environment at paragraph 36). The AIE Directive expresses the provision of environmental information in response to an AIE request as a “right of access ”, which is conferred on any natural or legal person who makes an application for the information. Taking this into account, and considering the wide range of interests confirmed as legitimate by the CJEU, I consider that a person who requests environmental information from a public authority has a legitimate interest in receiving the environmental information in question (subject to any other exceptions to the right of access that may apply). Accordingly, once a person has made a valid request for environmental information, the first condition of the legitimate interest test is met.
22. Where the environmental information in question is or includes personal data, the only way in which the legitimate interest in receiving the environmental information can be met is by providing access to the personal data in question. Accordingly, the second condition of the legitimate interest test is met.
23. As a result, in practice, it is the third condition of the legitimate interest test on which public authorities must focus most of their attention. The third condition requires ‘the balancing of the opposing rights and interests at issue’, depending on the specific circumstances of the particular case (see Case C-597/19 M.I.C.M., at paragraph 111).
24. In this context, the opposing interests will be, on the one hand, the right of the data subject to respect for privacy and protection of personal data and, on the other hand, the public interest in the disclosure of the environmental information at issue. This balancing exercise is almost identical to the balancing exercise that is required under Article 4(2) of the AIE Directive and article 10(3) of the AIE Regulations, where personal data is concerned. This means that, although as a matter of principle a public authority must carry out the balancing exercise in Article 6(1)(f) first and again (if needed) under article 10(3) of the AIE Regulations, in practice it is unnecessary for a public authority to go through the exercise twice because the analysis is the same. In my view this means that, in practice, public authorities may deal with AIE requests involving personal data in a relatively straightforward manner, consistent with both the AIE regime and the GDPR.
25. To summarise - once a public authority is satisfied of the following matters, the public authority may be satisfied that the requester has a ‘legitimate interest’ in receiving the personal data pursuant to that request and that its disclosure is ‘necessary’ to meet that interest:
- that an AIE request has been made,
- that the requested information is environmental information,
- that the environmental information is or includes personal data, and
- that the data subject has not consented to the disclosure of the personal data.
26. The public authority must then weigh the rights of the data subject against the public interest in the disclosure of the environmental information. In weighing that balance, the public authority should consider the specific interests at issue, namely:
- The individual’s interest in the protection of their personal data, taking into account the nature of the specific personal data at issue and the data subject’s rights under Articles 7 and 8 of the Charter, as well as any views expressed by the specific data subject regarding disclosure (if, in the circumstances, it is appropriate to seek the data subject’s views); and
- The public interest in disclosure of the environmental information, taking into account the public interest in the information at issue, as recognised by recital 1 of the AIE Directive and the rights in Articles 11 and 37 of the Charter, as well as any specific information that may have been volunteered by the requester (see Case C- 619/19 Land Baden-Württemberg , paragraphs 59-61).
27. As with any other exception to release under the AIE regime, if the public authority concludes that the balance falls against release of the personal data, it should go on to consider whether the personal data may be separated from the other environmental information at issue, for example by means of redaction (see Article 4(4) of the AIE Directive and article 10(5) of the AIE Regulations.
Application in this case
28. It is common ground in this case that the appellant made a valid request under the AIE Regulations, and I consider the information at issue to be environmental information in line with article 3(1) of the AIE Regulations. The next question to consider is whether the information at issue, herd numbers and their associated locations, is personal data. The Department has consistently stated that herd numbers and their associated locations are considered personal data.
29. The Department stated in submission to this Office that a herd number is a unique identifier assigned by the Department. It added that in order to keep cattle it is a legal requirement that the farm holding is registered with the Department, and once registered a herd number is assigned. A herd number is an administrative device, linked to an individual named applicant (herd owner or herd keeper). Regarding the location data associated with each herd number, the Department says it is the postal address of the owner(s) of the farm and the person responsible for the day-to-day management of the herd (including the health/welfare of the cattle). The Department also added that farms may “have land across a broad geographic area the address associated to the herd may not necessarily be the same address where the cattle are located .” Having considered the information at issue, I agree with the Department that the herd numbers and location data of such herds is information related to an identifiable natural person or persons – and can therefore be considered personal data.
30. I note there are 603 herd numbers at issue in this appeal, and while I have not seen the breakdown, it is likely a number of these are connected to limited companies, rather than individuals. My investigator queried this with the Department who indicated that as of March 2024, “circa 54% (of the registered herds with over 500 cattle) are Limited companies on DAFM system .” The appellant in their request for an internal review from the Department stated that “non personal entities such as companies operating large cattle farms cannot be redacted as personal data ” I agree with the point made by the appellant here - essentially article 8(a)(i) applies only to personal information relating to a natural person. As limited companies are legal persons, but not natural persons, the information related to such companies is not personal information within the meaning of article 8(a)(i). Therefore, the Department should note that article 8(a)(i) cannot be relied on for the purposes of withholding this information in relation to herd numbers and their associated location data that are linked to limited companies.
31. Regarding the issue of consent, the Department has confirmed that it has not consulted with the individuals connected to the herd numbers, who are identifiable by their address and herd number, regarding this information request. Therefore, I do not think the data subjects can be said to have consented to their information being released.
32. Having determined the above matters, I am satisfied that the requester has a ‘legitimate interest ’ in receiving the personal data at issue pursuant to an AIE request and that its disclosure is ‘necessary ’ to meet that interest. I must go on to weigh the rights of the data subjects against the public interest in the disclosure of the environmental information. In respect of the individuals’ interests in the protection of their personal data in this case, I note the personal information in question does not fall under any of the special categories of personal data meriting higher protection (see Article 9, GDPR).
33. As I have set out above, although as a matter of principle a public authority must carry out the balancing exercise in Article 6(1)(f) first and again (if needed) under article 10(3) of the AIE Regulations, in practice it is unnecessary for me to go through the exercise twice because in this decision as the analysis is the same.
Balancing of interests in this case
34. In the interests of refusing disclosure of the environmental information (the herd numbers and associated location data), I have more broadly considered the data subjects interest in the protection of their personal data, taking into account the nature of the specific personal data at issue and the data subject’s rights under Articles 7 and 8 of The Charter of Fundamental Rights of the European Union. When considering the individual’s interest in the protection of their personal data, I have taken into account whether there is likely to be any adverse effect for the individuals, if their data – the herd numbers and associated location data - is released. I am not persuaded of the likelihood of an adverse effect if the requested information is disclosed.
35. The Department considered the public interest balancing test in its original and internal review decisions, concluding in both cases that the right to privacy of the persons involved and the right to due process outweighed any public interest in release of the information sought. The Department stated “the release of data including both Herd Number and location details would clearly provide very specific personal data on these farmers and their workplace, and probably in many cases their homeplace.” The Department has provided no further detail of how the release of the information may have an adverse impact on the data subjects. It has not for example suggested that the data subjects would be at risk of being targeted by environmental protesters – nor do I think this is a likely to be a consequence of the information at issue being released.
36. I have considered the use and function of a herd number generally – and as I have set out above, a herd number is an administrative device, issued by the Department primarily for the purposes of disease control, but used generally by the Department as an identifier for matters relating to the herd. A herd number is shared with other parties for a range of matters including the sale of animals. For these reasons I do not think there is any inherent risk in the disclosure of herd numbers and their associated locations in the context of this request. The appellant also made the point that similar data is commonly released elsewhere - “farm data held outside DAFM is public, for example EPA pig/poultry licensees, licence numbers and locations. It makes no sense to prevent the release of data on large cattle operations, while publishing data on large pig/poultry operations.” This would serve to underline the conclusion that there would be no adverse impact if the event of the disclosure of the information at issue.
37. In light of the above, while the release of the personal data in question would have some impact on the data subjects’ right to privacy and protection of personal data, to my mind such impact would not be significant.
38. In respect of the public interest in disclosure of the environmental information, I consider that there is an important general interest in the disclosure of environmental information to meet the purpose of the AIE Directive, in particular by contributing to a greater awareness of environmental matters, a free exchange of views, more effective participation by the public in environmental decision-making and, eventually, to a better environment, as set out in recital 1 to the AIE Directive, and the rights in Articles 11 and 37 of the Charter of Fundamental Right of the European Union.
39. The appellant states that “there is a public interest in release of the locations of large cattle farms due to the pressure placed on environment from these operations .” I agree that there is a general public interest in transparency around large cattle herds, which in this case includes herds consisting of over 500 cattle. I say this bearing in mind that cattle are the primary source of emissions from agriculture, and that Ireland has committed to an annual reduction of 7 per cent in GHG emissions by 2030. I consider there to be a public interest in the location data of these large cattle herds. For example, it would allow the public to identify country-wide patterns regarding the location of these large cattle farms, which are responsible for a significant proportion of emissions from agriculture.
40. For the reasons set out above, and weighing those interests in the balance, I conclude that the public interest in releasing the herd numbers and associated location data outweighs the interests served by refusal.
41. While I have set out above that I do not consider that the herd numbers linked to limited companies are personal information, I am satisfied that if it was the case that this was considered to be personal information, the same conclusion would apply to those herd numbers and their associated location data.
42. I note the Department has sought to rely on section 37 of the FOI Act as the law which protects the confidentiality of the information here (as required by article 8(a)(i)). As I have already found that the information should be released when applying the GDPR as the law relied on to protect the confidentiality of the information, I do not consider it necessary to consider section 37 of the FOI Act in this regard. I say this because the public authority is required to apply the same public interest balancing test under AIE regardless of whether it is the GDPR or section 37 of the FOI Act, relied on to protect the confidentiality of the information. In either case the public authority is obliged to consider whether to release or withhold the information by weighing the rights of the data subject against the public interest in the disclosure of the requested environmental information. I have set out this balancing of interests above and have found that the information should be released. I consider that this approach is consistent with a public authority’s range of legal obligations in relation to both personal information and access to environmental information.
43. Having carried out a review under article 12(5) of the AIE Regulations, on behalf of the Commissioner for Environmental Information, I hereby annul the decision of the Department of Agriculture Food and Marine’s decision and direct that the requested information be released to the appellant.
44. A party to the appeal or any other person affected by this decision may appeal to the High Court on a point of law from the decision. Such an appeal must be initiated not later than two months after notice of the decision was given to the person bringing the appeal.
______________________
Julie O’Leary on behalf of the
Commissioner for Environmental Information