Ó Oifig an Choimisinéara um Fhaisnéis Comhshaoil
Cásuimhir: OCE-137000-X7Y9N3
Foilsithe
Teanga: Níl leagan Gaeilge den mhír seo ar fáil.
Whether the Department is justified in withholding information contained within records under article 8(a)(i) of the AIE Regulations
1. On 2 March 2023, the appellant made a request to the Department for the following information:
“copies of all derogation licences granted under article 54 of S.I. No. 477/2011 - European Communities (Birds and Natural Habitats) Regulations 2011 for Counties Meath and Louth in 2022.”
2. The Department issued its original decision to the appellant on 24 February 2023 where it identified 11 records held within the Wildlife Licencing Unit in relation to the appellant’s request. Its decision was to part grant release of the eleven records, and withhold certain information contained within, under article 8(a)(i) of the AIE Regulations – personal information in relation to a third party.
3. The appellant requested an internal review from the Department on 1 March 2023. It said“The location of the licensed activities is not personal data nor is it confidential, nor are these licences confidential in the same way that planning applications are also not confidential and are open to public inspection.”
4. The Department issued its internal review to the appellant on 28 March 2023. It stated it was affirming its original decision – continuing to withhold person information in the eleven records under article 8(a)(i) of the AIE Regulations.
5. It attached a schedule of records. It stated that it considered whether in accordance with article 10(1), the request related to information on emissions into the environment, and determined that it does not. It also stated that“in accordance with Article 10(3) and 10(4) it weighed the public interest served by the disclosure against the interest served by refusal of the request stating the following:
In considering the public interest factors, I have taken account of the following:
• the public interest in protecting the right to privacy of members of the public
• the public interest in members of the public being able to communicate in confidence with the Department without fear of disclosure in relation to personal or sensitive matters
• the public interest in the Department being able to perform our functions effectively
• the public interest in safeguarding the flow of information to the Department.
I consider that the public interest in preserving the privacy of the third parties involved outweighs the public interest that would be served were the data to be released to you”
6. The appellant appealed to my Office on 29 March 2023.
7. I have now completed my review under article 12(5) of the Regulations. In carrying out my review, I have had regard to the submissions made by the appellant and the Department of Housing, Local Government and Heritage and the relevant third parties. I have also examined the contents of the records at issue. In addition, I have had regard to:
• the Guidance document provided by the Minister for the Environment, Community and Local Government on the implementation of the AIE Regulations (the Minister’s Guidance);
• Directive 2003/4/EC (the AIE Directive), upon which the AIE Regulations are based;
• the 1998 United Nations Economic Commission for Europe Convention on Access to Information, Public Participation in Decision-Making and Access to Justice in Environmental Matters (the Aarhus Convention); and
• The Aarhus Convention—An Implementation Guide (Second edition, June 2014) (‘the Aarhus Guide’).
• Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the GDPR); and
• The Charter of Fundamental Rights of the European Union (the Charter)
8. In accordance with article 12(5) of the AIE Regulations, the role of this Office is to review the public authority’s internal review decision and to affirm, annul or vary it. Where appropriate in the circumstances of an appeal, I will require the public authority to make available environmental information to the appellant.
9. Since issuing its internal review, the Department has updated its position and confirmed it is releasing the following records in full – 1, 2, 3, 4, 6, 7, 8, 11. It is continuing to withhold personal information contained in the derogation licence records which relate to the following records – 5, 9 and 10.
10. The scope of this review is therefore concerned with whether the Department was justified in its decision to withhold certain redacted information contained within records 5, 9 and 10 (three derogation licences granted under article 54 of S.I No. 477/2011 – European Communities (Bird and Natural Habitats) Regulations 2011), under article 8(a)(i) of the AIE Regulations.
11. On 18 April 2023 the appellant made the following submission to this Office:
“The public authority redacted the names of applicants, professional advisors and the location to which the requested derogation licences relate. In Protect East Meath’s view the redactions were wrongly applied because the public authority did not identify any basis for why the redacted information was confidential. The decision reads “The data withheld under this article contains personal information of third parties i.e. other individuals and not you. We do not have the consent of these third parties to release their personal information and therefore this data is exempt from release. “ However this overlooks the fact that Regulation 8(a)(i) only applies to *confidential* personal data. Given that no legal basis for confidentiality was identified the exception was wrongly invoked. The derogation licensing system is statutory in nature, therefore any alleged confidentiality can only be found in the relevant legislation, namely the European Communities (Birds and Natural Habitats) Regulations 2011 (SI 477/2011). There is no such statutory basis for confidentiality of derogation licences. In addition the public authority routinely publishes this category of information on its website, so it cannot be confidential whatever way it is looked at.”
12. On 8 May 2023 the Department provided the following submission to this Office:
“Derogation licences are issued to private individuals, ecologists or companies in relation to strictly protected species, with detailed guidance available on the NPWS website (www.npws.ie). Ten of these records identified related to bat species, and the licences in question allow for roost disturbance and/or damage or destruction of breeding sites or resting places.
Some of these records identified related to licences issued to individual homeowners to exclude bats from their property where they were causing distress or upset. In advance of applying for the licences, homeowners would have worked with NPWS Rangers to discuss the best possible way to prevent the bats from returning to their attics and while ensuring that none became trapped inside or were injured in any way. The name of the homeowner and the exact location of their house were redacted in accordance with Article 8(a)(i).
The remaining records related to development works that either involved private individuals or companies for either bats or cetaceans. Where licences were issued to a company, the company name was released but an individual staff member’s name was redacted. Where a licence issued to an individual, the name and identifying details of their address was redacted but the townland/county remained.
The AIE was subjected to an internal review, which affirmed the original decision to partially refuse access to the information requested under the above-mentioned articles of the AIE Regulations.
The requester stated the following: ‘The location of the licensed activities is not personal data nor is it confidential, nor are these licences confidential in the same way that planning applications are also not confidential and are open to public inspection’.
Article 10(3) states: ‘The public authority shall consider each request on an individual basis and weigh the public interest served by disclosure against the interest served by refusal’. In making my decision I considered the public interest issues which arose in this case and took into account the following factors in favour of release:
* the public interest in members of the public exercising their rights under the AIE Regulations
* the public interest in having access to environmental information.
In considering the public interest factors which favour withholding the records I have taken account of the following:
* the public interest in protecting the right to privacy of members of the public
* the public interest in members of the public being able to communicate in confidence with the Department without fear of disclosure in relation to personal or sensitive matters
* the public interest in the Department being able to perform our functions effectively
* the public interest in safeguarding the flow of information to the Department.
Taking into account the presumption in favour of release of environmental information I considered that the public interest in preserving the privacy of the third parties involved outweighs the public interest that would be served were the data to be released.
I considered it likely that those affected would not have considered that their personal information provided to the Department would be made publically available and, given the circumstances, they may be subject to unwanted attention from those that would not agree with their actions.
I believe that the confidentiality of the personal information redacted is provided by law under the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).
All other information, other than the name and the exact location, was made available.
The requester’s assertion that these licences should be treated in the same way as when someone applies for planning permission is not an exact comparison given the different legislation under which these permissions/licences are issued.”
13. In February 2024, an investigator from this Office wrote to each of the third parties concerned in this appeal (the individuals whose personal information within the records the Department is seeking to withhold under article 8(a)(i)). The investigator informed the third parties that disclosure of certain information relevant to the appellant’s request may impact them. The investigator explained the purpose of the letter was to make the third parties aware of the appeal and ensure that they are aware that the Commissioner may decide that the Department must release the requested information to the appellant. The investigator also invited the third parties to make a submission setting out their view on the matter should they wish to do so. The investigator wrote that it would be useful, in particular, if the third parties could outline: i) their position in relation to the disclosure of the information; ii) if their position is that disclosure would give rise to negative effects or impacts, further detail in relation to such effects (i.e. how would they be affected, how serious would those effects be, what is the basis for their conclusion as to potential negative effects). All responses received have been taken into account in this review.
14. In May 2024, my investigator wrote to the appellant giving it the opportunity to set out why it believes that it has a legitimate interest in receiving the information sought. The investigator explained that the Commissioner considers that the exemption in article 8(a)(i) Regulations requires an assessment of whether the processing of the personal data will be allowed under Article 6(1)(f) of the General Data Protection Regulation (the GDPR). This involves assessing whether the appellant, as the requestor, has a legitimate interest in receiving, and therefore processing the information sought.
15. The appellant responded on 8 May 2024 with the following:
“At the outset I would like to explain that a requestor does not have to point to a legitimate interest to receive environmental information. Article 3(1) of the AIE Directive expressly says that a request Is made by a requestor “without his having to state and interest” and Regulation 6(2) of the AIE Regulations is to the same effect. A requestor has a statutory right to receive environmental information. Insofar as the reference to “legitimate interest” is a reference to the legal basis for processing personal data, this is not the appropriate basis. Personal data processed for the purpose of answering an AIE request is processed under Article 6(1)(c) necessary for compliance with a legal obligation.
Second a requestor does not have to explain how it would specifically use the requested information, this is tantamount to stating an interest and is also prohibited by the AIE Directive. I am assuming you are asking for a public interest justification and I will proceed on that basis but just to be clear my client doesn’t have to explain its own interest in the information.
At the outset I would like to stress that the exception in Regulation 8(a)(i) only protects the confidentiality of personal information relating to a natural person. In other words it does not protect non-confidential personal information. In my view there is no basis for a derogation licence to be considered confidential. In fact the Department publishes monthly details of derogation licences including the names of applicants, it is not clear to me why in this case they are refusing to publish the same details. A derogation licence is no different than a grant of planning permission which are routinely published without redacting personal details.
Second derogation licences are within Article 7(2)(f) and are of a category of information which are required to be published. My client doesn’t understand why the Department is in default of this obligation. Therefore rather than asking my client for its “legitimate interest” in the request perhaps the OCEI should ask the Department to explain why it is in default of a clear legal requirement to publish the derogation licences without being so-requested.
Third derogations licences may be judicially reviewed. My client is an environmental protection organisation (eNGO) operating in the East Meath area and therefore actively scans the granted licences with a view to challenging them if they are unlawful. It cannot do this without the information sought. In particular the name of the licensee is important since they would be required to be put on notice of any judicial review.
The location of the property to which the licence is issued is not personal information and is not confidential. In any event the location of where environmental harm is permitted is very important. For example it may be in an area where there are environmental sensitivities etc. It may be discovered that there are cumulative effects with other assessments etc. There is simply no reason to redact this information.
Finally the name of the consultant specialist is not confidential. By definition an environmental consultant advertises their services. The names and other details of environmental consultants is available widely on the internet. In many cases the name can be inferred anyway from the branding on the report. The identity of the consultant is also environmentally important since it allows a member of the public to identify whether they are competent and whether there are any conflicts of interest.”
16. In light of the novel and complex issues raised in this case, I decided that it would be appropriate to issue a draft decision to the parties and to invite their submissions on the draft. On 19 September 2024, a draft decision was provided to the parties. On 22 September, the Department responded to indicate that it did not wish to make any further submissions.
17. On 26 September 2024, the appellant made a submission, which it requested be summarised in my decision as“it is concerned that this decision will create a dangerous precedent based on a manifestly incorrect interpretation of the AIE Directive and the GDPR” . The appellant’s submission may be summarised as follows:
• Article 7(2)(f) of the AIE Directive creates an obligation to make available and disseminate the category of information sought. Article 7(2) uses the words “to be made available and disseminated”. Derogation decisions are authorisations with a significant impact on the environment since they permit environmental harm that is otherwise prohibited, including criminal sanction. The language and context of the Directive, as well as the opinion of Advocate General Fennelly in C-217/97 Commission v Germany support this view.
• The GDPR does not protect the confidentiality of information. The GDPR is essentially a permissive piece of legislation which permits the processing of personal data where there is consent or if it is necessary for a particular purpose subject to other conditions. An alternative statutory basis must be identified in order for article 8(a)(i) of the AIE Regulations to apply, and no such statutory basis exists.
• When dealing with an AIE request, personal data may be processed in accordance with Article 6(1)(c) or 6(1)(e) of the GDPR, as the AIE Directive and the AIE Regulations impose legal obligations on public authorities. As a result, the exception in article 8(a)(i) of the AIE Regulations cannot apply and no public interest balancing test is required under article 10(3) of the AIE Regulations.
• Personal data may not be processed by public authorities in reliance on Article 6(1)(f) of the GDPR, as the processing is carried out in performance of the public authority’s tasks. In case C-180/21, the Advocate General’s Opinion stated that Article 6(1)(f) applies “to conflicts between (private) parties whose interests are not public in nature”. The handling of an AIE request and making information available is clearly a statutory duty and is a task carried out in the public interest. Reliance on Article 6(1)(f) would be an incorrect attempt to shoehorn a request into the provision so that a balancing test could be done under the GDPR.”
18. I have carefully considered all of the submissions made by the parties, including those made on my draft decision. What follows does not comment or make findings on each and every argument advanced but all relevant points have been considered.
19. The appellant stated in its submission to this Office that“derogation licences are within Article 7(2)(f) and are of a category of information which are required to be published” . The appellant argues that the Opinion of Advocate General Fennelly in Case C-217/97Commission v Germany is relevant in this regard.
20. Article 7(1) of the AIE Directive imposes an obligation on Member Stares to“ensure that public authorities organise the environmental information which is relevant to their functions and which is held by or for them, with a view to its active and systemic dissemination to the public …”. The third sub-paragraph continues,“Member States shall ensure that environmental information progressively becomes available in electronic databases which are easily accessible …” Article 7(2)(f) provides: “The information to be made available and disseminated … shall include at least: … authorisations with a significant impact on the environment and environmental agreements or a reference to the place where such information can be requested or found in the framework of Article 3”.
21. It is not one of my functions to decide on the compliance of public authorities with their obligations under Article 7 of the AIE Directive, or under article 5 of the AIE Regulations which seeks to implement that provision. However, it is clear that Article 7 of the AIE Directive does not create a freestanding obligation to publish that which could be refused pursuant to an AIE request in reliance on one of the exceptions in Article 4. Article 7(5) of the AIE Directive expressly states that the exceptions in Article 4(1) and (2) may apply in relation to the duties imposed by Article 7. In Case C-234/22 Roheline Kogukond, Advocate General Kokott noted as much, opining that“the obligation to actively disseminate environmental information pursuant to Article 7 … does not extend further than the obligation to disclose environmental information upon request pursuant to Article 3” (paragraph 100). I note that, notwithstanding this Opinion, the judgment of the Court did not refer to an ‘obligation to disseminate environmental information’ as such, instead referring to the ‘obligations laid down in Articles 3 and 7’ (paragraph 70).
22. This case concerns a question as to whether the exception in Article 4(2)(f) of the AIE Directive applies to permit refusal of an AIE request. If it does, then the same exception would apply to permit a public authority to avoid the duties imposed by Article 7 of the AIE Directive. The inclusion of a reference in Article 7(2)(f) of a reference to“authorisations with a significant impact on the environment” does, however, give an indication of the importance of environmental information of this nature, which would weigh in the balance in considering the public interest in disclosure should an exception apply.
23. The appellant also stated in its submission that the Department publishes monthly details of derogation licences including the names of applicants so it is not clear to it why in this case they are refusing to publish the same details. My investigator queried this point with the Department. It responded in May 2024 explaining the following:
“When we publish data on the open data website we redact/delete the following personal information from applications that don’t relate to bats being removed from private dwellings e.g. developments by companies/organisations:
•Address of applicant
•Email address
•Phone number(s)
Where applications relate to bats being removed from private dwellings we redact/delete the following personal information. The licence number on these types of licences begin with 3D:
•Address of applicant
•Email address
•Phone number(s)
•Applicant name
•Name of licence holder
•Identifying part of location where activity will be carried out under licence
As you can see we withhold more personal data in relation to applications from individuals than we do from those working as part of a company/organisation.”
24. The Department also said it would review the information within the records that it was seeking to withhold as per its internal review. Following this review, and after some clarifications sought from the Department by the investigator, in the Department confirmed the information that it seeks to withhold under article 8(a)(i) of the AIE Regulations is as follows:
| Record number | Information withheld |
| 5 | Name of derogation licensee, house name and postcode of licensee |
| 9 | Name of derogation licensee, first line of address of licensee |
10 First line of address and postcode for licence in relation to demolition and building works
25. The Department has made the decision to partially grant access to three records, and withhold some personal information contained within these records under Article 8(a)(i) of the AIE Regulations. The information withheld by the Department in the three records at issue fall into two categories, which I have labelled A and B below for ease of reference:
A. The names of the individual to whom a derogation licence was granted in relation to a domestic dwelling. This information has been withheld by way of redaction in the following records – Record 5
B. The first line of the address/house name and/or postcode the derogation licence was granted in relation to. This information has been withheld by way of redaction in the following records – Record 5, 9 and 10.
26. The Department has sought to rely on article 8(a)(i) of the AIE Regulations to withhold this information.
27. Article 8(a)(i) provides that a public authority shall not make available environmental information where disclosure of the information would adversely affect the confidentiality of personal information relating to a natural person who has not consented to the disclosure of the information, and where that confidentiality is otherwise protected by law.
28. This provision seeks to transpose Article 4(2)(f) of the AIE Directive, which enables Member States to provide for refusal of a request where disclosure would“adversely affect … the confidentiality of personal data and/or files relating to a natural person where that person has not consented to the disclosure of the information to the public, where such confidentiality is provided for by national or Community law” (my emphasis). The final paragraph of Article 4(2) states, referring to the predecessor to the GDPR:
“Within this framework, and for the purposes of the application of subparagraph (f), Member States shall ensure that the requirements of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are complied with.”
29. In light of this, I consider that the reference to “personal information” in article 8(a)(i) of the AIE Regulations to be consistent with the meaning of “personal data” under the GDPR, a concept with which every public authority is now very familiar.
30. It is clear from this final paragraph of Article 4(2) of the AIE Directive that the AIE regime is intended to interact harmoniously with the European data protection regime. In the same vein, Article 86 of the GDPR (read with recital 152) permits the disclosure of personal data in accordance with information access regimes under EU or national law, where those regimes reconcile the right of access to information with the right to protection of personal data. This again indicates that the GDPR is intended to interact harmoniously with national and European regimes offering public access to information.
31. In Ireland, Article 86 of the GDPR is implemented by section 44(2) of the Data Protection Act 2018, which provides:“For the purposes of Article 86, personal data contained in environmental information may be disclosed where the information is made available under and in accordance with the [AIE] Regulations pursuant to a request within the meaning of those Regulations.” On one view, this could be considered to be a standalone ‘gateway’ for the disclosure of personal data under the GDPR, permitting disclosure of all personal data contained in environmental information pursuant to an AIE request. However, the CJEU has repeatedly confirmed that the legal bases for processing in Article 6 of the GDPR are exhaustive list of the cases in which processing of personal data can be regarded as lawful ( Case C-252/21 Meta Platforms at paragraph 90; Case C-26/22 Case C-26/22 SHUFA Holding at paragraph 73).
32. Since its enactment, the principal law relied on to protect the confidentiality of personal data is the GDPR. The GDPR is underpinned by the fundamental rights to privacy and the protection of personal data in the Charter. One of the stated objectives of the GDPR is to secure the “protection of natural persons with regard to the processing of personal data” (Article 1(1)), with one of the principles of processing being integrity and confidentiality (Article 5(1)(f)). As noted above, the CJEU has repeatedly confirmed that the legal bases for processing in Article 6 of the GDPR are an exhaustive list of the cases in which processing of personal data can be regarded as lawful (Case C-252/21Meta Platforms at paragraph 90; Case C-26/22SHUFA Holding at paragraph 73). Disclosure of personal data in a manner which is not lawful, within the meaning of Article 6, is subject to sanction, including through the corrective powers of the supervisory authorities, in Ireland the Data Protection Commission. It is difficult to see how such provisions can be described as merely permissive and not protective. The protection of confidentiality under the GDPR is not absolute, but absolute protection is not required for the purpose of article 8(a)(i) of the AIE Regulations. I note the analysis of Hyland J in this regard (albeit relating to a different exception) inCommissioner for Environmental Information v Coillte Teoranta and others [2023] IEHC 227 at paragraphs 78-84.
33. It follows that, in order to determine whether the confidentiality of personal data is protected by the GDPR, one must consider whether there is a lawful basis under Article 6(1) of the GDPR for disclosure. If there is a lawful basis for disclosure, the personal data may lawfully be disclosed and the confidentiality of the personal data is not protected by the GDPR. Conversely, if there is no lawful basis for disclosure, the personal data may not be disclosed and the confidentiality of the personal data is protected by the GDPR.
34. There are six lawful bases for processing personal data set out in Article 6 of the GDPR. I do not consider that the legal basis in Article 6(1)(a), (b) or (d) could apply in the context of this particular request. Neither of the parties has suggested otherwise.
35. The appellant submits that the appropriate legal basis for processing is Article 6(1)(c) or (e) of the GDPR. The former permits the processing of personal data where‘necessary for compliance with a legal obligation’ and the latter where‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority’. I do not agree that either legal basis assists in this context. Under Article 6(1)(c), there could only be a legal obligation to disclose information pursuant to an AIE request if no exception to the right of access applies. Under Article 6(1)(e), it could only be ‘necessary’ to disclose the personal data pursuant to an AIE request if no exception to the right of access applies. In either case, protection of the confidentiality of personal data could be one such exception. If I were to accept that either provision applied to require or permit the disclosure of personal data pursuant to an AIE request, I would need to accept the proposition as a general principle, meaning that all personal data is required or permitted to be disclosed simply by virtue of an AIE request having been made (assuming no other exception is applicable). In my view, this would not be consistent with the AIE regime or the broader requirements of EU law. First, the AIE Directive clearly indicates that personal data should be appropriately protected. A blanket approach to the disclosure of personal data would be inconsistent with this indication. Second, individuals have a fundamental right under the Charter to respect for private and family life and to the protection of personal data. While such rights are not absolute, any limitations must respect the essence of the fundamental rights and observe the principle of proportionality. A blanket approach to release of personal data would be inconsistent with the Charter. In the same vein, the CJEU has found in successive cases that“derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary” (see, for example, Case C-597/19 M.I.C.M. at paragraph 110). Third, it is clear from Case C-740/22Endemol Shine Finland that public access to official documents may be a public interest capable of justifying the disclosure of personal data contained in such documents, but such access must be reconciled with the fundamental rights to private life and to the protection of personal data. Again, a blanket approach to release of personal data would be inconsistent with this finding.
36. Accordingly, it appears that the most relevant basis to consider is Article 6(1)(f),‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party.”
37. I note that Article 6(1) provides that this ground for processing shall not apply to processing carried out by public authorities in the performance of their tasks. In Case C-180/21Inspektor v Inspektorata kam Visshia sadeben savet , the CJEU found that processing by public authorities which is necessary for the performance of a task in the public interest comes within the scope of Article 6(1)(e) and cannot come within the scope of Article 6(1)(f), as those bases are mutually exclusive (paragraph 85). The Court found that the functions of bringing prosecutions and representing the State in an action for damages were public in nature and were ‘tasks’ of the Public Prosecutor’s Office. Accordingly, the application of Article 6(1)(f) was excluded in respect of processing for that purpose (paragraphs 91-93). This case indicates that one must consider whether the purpose of the processing is the performance of a task in the public interest or whether the purpose is a different interest of a private nature (see paragraph 86). The appellant pointed to the Opinion of Advocate General Campos Sánches-Bordona, where he states that Article 6(1)(f) only applies“to conflicts between (private) parties whose interests are not public in nature” (paragraph 96 of the Opinion). This passage would suggest that a public authority can never rely on Article 6(1)(f). However, this aspect of the Opinion does not appear to have been adopted by the Court, with the Court instead making a distinction between theinterests of State authorities that are public in nature and those that are private in nature. For example, the Court made a contrast between the case at issue and a case in which the State is acting in defence of private interests (paragraph 92 of the Judgment).
38. In light of this case, I consider that the question for me is whether a public authority releasing information pursuant to an AIE request is doing so for the purposes of the performance of its tasks or for some other purpose. The term ‘task’ is not defined in the GDPR, but the use of that term in the CJEU’s recent case law gives some illustration as to its meaning. For example, the ‘task’ in Case C-180/21 involved bringing prosecutions and representing the State in an action against it for damages. In Case C-667/21Krankenversicherung Nordrhein , the Court referred to the ‘statutory task’ of the medical service for health insurance funds. In Case C-439/19, the Court referred to the ‘task’ of the Latvian Road Safety Directorate of improving road safety. In each of these examples, the ‘task’ of the body appears to refer to the functions that the particular body carries out, as opposed to the more general functions and duties applicable to all public bodies. When acting on AIE requests, public authorities are, of course, acting in accordance with their statutory duties under the AIE regime. Such duties apply generally to all public authorities. However, with the possible exception of my Office, I cannot identify any public authority whose ‘task’ involves the release of information pursuant to AIE requests. Indeed, the release of information pursuant to an AIE request may conflict with the performance of the ‘tasks’ of the public authority. For example, in a case where the effective performance of a public authority’s tasks requires that its proceedings remain confidential, a public authority may consider that release of information pursuant to an AIE request is positively inconsistent with the performance of its ‘tasks’. By contrast, the release of environmental information pursuant to an AIE request is very much in the interest of the person requesting the information. The duty of public authorities to release information facilitates the right of access of such a requester, which is conferred by the AIE regime. Taking this into account, it is my view that the release of information pursuant to an AIE request is not for the purposes of the performance of the tasks of the public body, but is for the purposes of the legitimate interests pursued by a third party, the requester. Accordingly, I do not consider that disclosure pursuant to an AIE request involves the ‘performance of the tasks’ of the public authority and the exclusion in the final subparagraph of Article 6(1) does not apply.
39. That being so, there are ‘three cumulative conditions’ in order for processing to be lawful in accordance with Article 6(1)(f):
“… first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the interests or freedoms and fundamental rights of the person concerned by the data protection do not take precedence” (Case C-597/19 M.I.C.M., at paragraph 106).
40. For convenience, this is known as the ‘legitimate interest test”.
41. In relation to the first condition, the CJEU has confirmed that a wide range of interests is, in principle, capable of being regarded as legitimate (see Case C-26/22SHUFA Holding at paragraph 76). For example, internet users may have a legitimate interest in having access to internet search engine results containing personal data (Case C-131/12Google Spain and Google , at paragraph 81); a person has a legitimate interest in obtaining the personal information of a person who damaged their property in order to sue (Case C-13/16Rigas Satiksme at paragraph 29); and a video surveillance system installed to protect the property, health and life of co-owners of a building is likely to be a legitimate interest (Case C-708/18Asociatia de Proprietari bloc M5A-ScaraA at paragraph 42). The purpose of the AIE regime is to promote increased public access to environmental information and more effective participation by the public in environmental decision-making, with the aim of making better decisions and applying them more effectively and, ultimately, promoting a better environment (see recitals 1 and 2 of the AIE Directive and Case C-470/19Friends of the Irish Environment at paragraph 36). The AIE Directive expresses the provision of environmental information in response to an AIE request as a “right of access”, which is conferred on any natural or legal person who makes an application for the information. Taking this into account, and considering the wide range of interests confirmed as legitimate by the CJEU, I consider that a person who requests environmental information from a public authority has a legitimate interest in receiving the environmental information in question (subject to any other exceptions to the right of access that may apply). Accordingly, once a person has made a valid request for environmental information, the first condition of the legitimate interest test is met.
42. Where the environmental information in question is or includes personal data, the only way in which the legitimate interest in receiving the environmental information can be met is by providing access to the personal data in question. Accordingly, the second condition of the legitimate interest test is met.
43. As a result, in practice, it is the third condition of the legitimate interest test on which public authorities must focus most of their attention. The third condition requires ‘the balancing of the opposing rights and interests at issue’, depending on the specific circumstances of the particular case (see Case C-597/19M.I.C.M. , at paragraph 111). In this context, the opposing interests will be, on the one hand, the right of the data subject to respect for privacy and protection of personal data and, on the other hand, the public interest in the disclosure of the environmental information at issue. It can immediately be seen that this balancing exercise is almost identical to the balancing exercise that is required under Article 4(2) of the AIE Directive and article 10(3) of the AIE Regulations, where personal data is concerned. This means that, although as a matter of principle a public authority must carry out the balancing exercise in Article 6(1)(f) first and again (if needed) under article 10(3) of the AIE Regulations, in practice it is unnecessary for a public authority to go through the exercise twice because the analysis is the same. In my view this means that, in practice, public authorities may deal with AIE requests involving personal data in a relatively straightforward manner, consistent with both the AIE regime and the GDPR.
44. Once a public authority is satisfied of the following matters, the public authority may be satisfied that the requester has a ‘legitimate interest’ in receiving the personal data pursuant to that request and that its disclosure is ‘necessary’ to meet that interest:
- that an AIE request has been made,
- that the requested information is environmental information,
- that the environmental information is or includes personal data, and
- that the data subject has not consented to the disclosure of the personal data.
45. The public authority must then weigh the rights of the data subject against the public interest in the disclosure of the environmental information. In weighing that balance, the public authority should consider the specific interests at issue, namely:
a. The individual’s interest in the protection of their personal data, taking into account the nature of the specific personal data at issue and the data subject’s rights under Articles 7 and 8 of the Charter, as well as any views expressed by the specific data subject regarding disclosure (if, in the circumstances, it is appropriate to seek the data subject’s views); and
b. The public interest in disclosure of the environmental information, taking into account the public interest in the information at issue, as recognised by recital 1 of the AIE Directive and the rights in Articles 11 and 37 of the Charter, as well as any specific information that may have been volunteered by the requester (see Case C-619/19Land Baden-Württemberg , paragraphs 59-61).
46. As with any other exception to release under the AIE regime, if the public authority concludes that the balance falls against release of the personal data, it should go on to consider whether the personal data may be separated from the other environmental information at issue, for example by means of redaction (see Article 4(4) of the AIE Directive and article 10(5) of the AIE Regulations.
47. It is common ground in this case that the appellant made a valid request under the AIE Regulations. It is also common ground that the information at issue is environmental information.
48. As to whether the information at issue is personal data, as set out in paragraph 23, the information within the records at issue consists of A) the full name of the derogation licence holder, and B) the first line of the address of the property that the licence is issued in relation to. The appellant disputes that the address stated on the derogation licence (category B) is personal information. The appellant states:“the location of the proposed activities which are licensed is not “Personal Information” and therefore outside of article 8(a)(i) entirely.” However, the derogation licences in record 5 and 9 are in relation to adomestic dwelling (this is stated on each of the derogation licence records) - the address listed is the home or property of the person to whom the derogation licence is issued. As such I think it is clear that this is information that relates to an identifiable natural person. The derogation licence contained in Record 10 relates to“demolition and building works” . But the names of the licensees have been released on this one therefore I consider this also relates to a natural identifiable person. Accordingly, I find that all of the information in categories A and B is ‘personal data’, within the meaning of the GDPR.
49. As to whether consent to disclosure has been given, the Department says it has not sought the consent of the individuals concerned, therefore it can be concluded that these individuals have not consented to its disclosure. The application form for the derogation licences available on the NPWS website states:"Please note – applications/reports received and licences issued under this derogation may be published on the NPWS website and/or the Department’s Open Data website" . While it is arguable that this could constitute consent when applying for a derogation licence, the Department confirmed that this line was only added to the derogation application forms in June 2023. The derogation licences at issue in this appeal all pre-date this, so I do not consider it necessary to consider the issue of consent any further in this regard. I find that the data subjects have not consented to the disclosure of personal data.
50. Having determined the above matters, I am satisfied that the requester has a ‘legitimate interest’ in receiving the personal data at issue pursuant to an AIE request and that its disclosure is ‘necessary’ to meet that interest. I must go on to weigh the rights of the data subjects against the public interest in the disclosure of the environmental information.
51. In respect of the individuals’ interests in the protection of their personal data in this case, I note the name and addresses of the licence holders do not fall under any of the special categories of personal data meriting higher protection (see Article 9, GDPR). The Department submitted that there is a need for such individuals to be able to communicate in confidence with the Department without fear of the disclosure of their personal details. The Department said if the information is disclosed, individuals may be at risk of unwanted attention from those who do not agree with their actions, though it did not give any further detail as to what this is based on. The use of the word “may” here indicates the Department considers it is a possibility rather than a likelihood. In any event, it did not provide any further details. It is noteworthy that the individuals concerned did not identify any adverse effects of the information being disclosed when they were contacted by my investigator.
52. To my knowledge there is no evidence to suggest that release of the names and addresses of these individuals would result in them being the target of unwanted attention by environmental groups or otherwise. From my research I have identified no evidence that such individuals would now be, or have been in the past, at risk of unwanted attention. Any individual who applies for a derogation licence for the disturbance of a protected species is complying with his or her legal obligations which are firmly set out in EU and national law. This is very different to individuals who unlawfully set about, for example, disturbing protected species without following the correct legal process and correctly applying for a derogation licence. One can more readily envisage a situation where this second category of individuals could be the target of unwanted attention from environmental activists or similar. The granting or otherwise of a derogation licence is a decision by the Minister for Housing, so if there were individuals that disagreed with the awarding of the licence it ismore likely that any“unwanted attention” by people who disagree with such a licence being granted would be directed towards the decision maker, i.e. the Minister. If anything, the disclosure of the withheld information could serve to clear up misconceptions over the suspicion of wrong doing by any individual (there is no suggestion that any such misconception exists in this case), for example suspicions that protected species may have been disturbed without the derogation licence being sought and granted by the Minister. In light of the above, while the release of the personal data in question would have some impact on the data subjects’ right to privacy and protection of personal data, such impact would not be significant. In coming to this conclusion, I put weight on the fact that these derogation licences were issued over two years ago and the timeframe for the actions authorised by the licences have expired.
53. In respect of the public interest in disclosure of the environmental information, I note that there are strict protection measures around bats in Ireland under the EU Habitats Directive. Derogation licences, such as those that are the subject of the appellant’s request, can only be issued by the Minister for Housing, Local Government and Heritage in very limited circumstances. I accept that the location where a derogation licence is granted is important in terms of environmental protection, as the impact of a derogation licence may be more acute in an area where there are environmental sensitivities or where there could be a cumulative impact on a protected species. I accept there is a public interest in identifying patterns of derogation licences being issued so that the public may consider whether there is a need to bring a legal challenge against the Minister’s decision to grant these licences in particular cases. I accept the name of the licensee and the exact address is needed in order for the public to identify if any such patterns exist, for example in terms of to whom or to what properties the derogation licences are being granted.
54. I have considered whether disclosing the information could in fact have an adverse impact on the protection of the environment. For example, is it likely on balance that releasing the names of the individual would lead to a situation where legitimate applicants are deterred from applying for these derogation licences? I think such an effect is unlikely. And, in any event, even if I did think this was a likely adverse effect of disclosure (I do not think it is) there is now a notice on the derogation application form on the NPWS website that says“information in your application may be made public on the NPWS website or the open data website”. With this in mind, I think anyone minded not to engage with the NPWS regarding a derogation licence is not going to be influenced one way or another by their name/address being made publically available (if the application form itself did not deter them). Accordingly, in this case I consider that the public interest on disclosure of the personal data in question is significant.
55. Weighing those interests in the balance, I conclude that the public interest in releasing the information outweighs the interests served by the refusal.
56. Having carried out a review under article 12(5) of the AIE Regulations, I annul the Department’s decision. The Department was not justified in redacting the withheld information from the records provided to the appellant under the AIE Regulations. I direct release of the environmental information.
57. A party to the appeal or any other person affected by this decision may appeal to the High Court on a point of law from the decision. Such an appeal must be initiated not later than two months after notice of the decision was given to the person bringing the appeal.
Ger Deering
Commissioner for Environmental Information