FOI Request for Final Certificate - Regulation 12(2) Presumption of Disclosure
Dear Croydon Borough Council,
I am writing to formally request a copy of the 'Final Certificate' issued by Stroma Building Control, in relation to the works carried out under Initial Notice 19/00789/IN at 28 Grasmere Road, Purley CR8 1DU, with an Application Completion Date of 8th October 2020.
I understand that the Council has previously refused to supply similar final certificates under the Environmental Information Regulations 2004 (EIR), citing Regulation 13 (personal data). I believe this interpretation is incorrect for the following reasons:
1. Regulation 13 and Definition of Personal Data
The decision to withhold the requested information hinges on the assumption that it constitutes personal data under Regulation 13 of the EIR. However, Article 4(1) of the UK General Data Protection Regulation (UK GDPR) defines personal data as information relating to an identifiable natural person.
In this case, the property in question is owned by a limited company, as confirmed by the HM Land Registry. Accordingly, the requested Final Certificate does not pertain to any identifiable individuals, but rather a corporate entity.
This aligns with the reasoning in Borough of Poole v Information Commissioner (EA/2019/0073), where the Tribunal ruled that information relating to a company's business activities does not constitute personal data. As such, the Council’s application of Regulation 13 is inappropriate here.
2. Regulation 6(1)(b) Does Not Apply
I have already confirmed that this information is not available via the Council’s online search facilities. Therefore, Regulation 6(1)(b), which exempts the public authority from providing information that is reasonably accessible by other means, does not apply in this instance.
3. Public Interest and Regulation 12(2) Presumption of Disclosure
Under Regulation 12(2) of the EIR, there is a strong presumption in favor of disclosure, which applies both when engaging exceptions and in carrying out the public interest test. I believe there is a significant public interest in ensuring transparency regarding building control processes, particularly in relation to public safety and regulatory compliance.
This public interest is supported by the fact that final certificates are essential documents that attest to the completion and compliance of works under the Building (Approved Inspectors etc.) Regulations 2010, which should be subject to public scrutiny. The Corporate Officer of the House of Commons v Information Commissioner [2008] EWCA Civ 1001 case further supports the principle of transparency in regulatory compliance, especially where safety may be a concern.
4. Previous Disclosure of Similar Information
I note that similar (Partial) Final Certificates have been provided to me in the past without redaction, as shown in previous requests .
For example:
https://www.whatdotheyknow.com/request/m...
This demonstrates that there is precedent for disclosing such information, and any concerns about personal data can be addressed through minimal redaction, rather than outright refusal.
Thank you for your attention to this matter. I look forward to receiving your response within the statutory timeframe as required under the Freedom of Information Act 2000 and Environmental Information Regulations 2004.
Yours faithfully,
Andrew White
Dear Croydon Borough Council,
I am writing to follow up on the Freedom of Information (FOI) request I submitted on 12th September 2024, concerning FOI Request for Final Certificate - Regulation 12(2) Presumption of Disclosure. According to the Freedom of Information Act 2000, public authorities are required to respond to requests promptly and within 20 working days. As the statutory deadline has now passed, I would appreciate an update on the status of my request.
If there has been any delay or issue with processing the request, I would kindly ask for an explanation and an estimated timeline for when I can expect the information. If I do not receive a response within the next 5 working days, I will consider filing a complaint with the Information Commissioner's Office (ICO).
Thank you for your attention to this matter, and I look forward to your prompt response.
Yours faithfully,
Andrew White
Information Team Croydon
Digital Services
Assistant Chief Executive Directorate
Bernard Wetherill House
7th Floor, Zone B
Croydon
CR0 1EA
Contact: Information Team
[email address]
Dear Andrew White
Request FOI/10611
Further to your request received on 12/09/2024, I confirm that the Council
has now considered your request under the Environmental Information
Regulations (2004). Please accept my apologies for the delay in responding
to your request. Specifically, you have requested the following
information:
"Dear Croydon Borough Council,
I am writing to formally request a copy of the Final Certificate issued by
Stroma Building Control, in relation to the works carried out under
Initial Notice 19/00789/IN at 28 Grasmere Road, Purley CR8 1DU, with an
Application Completion Date of 8th October 2020.
I understand that the Council has previously refused to supply similar
final certificates under the Environmental Information Regulations 2004
(EIR), citing Regulation 13 (personal data). I believe this interpretation
is incorrect for the following reasons:
1. Regulation 13 and Definition of Personal Data
The decision to withhold the requested information hinges on the
assumption that it constitutes personal data under Regulation 13 of the
EIR. However, Article 4(1) of the UK General Data Protection Regulation
(UK GDPR) defines personal data as information relating to an identifiable
natural person.
In this case, the property in question is owned by a limited company, as
confirmed by the HM Land Registry. Accordingly, the requested Final
Certificate does not pertain to any identifiable individuals, but rather a
corporate entity.
This aligns with the reasoning in Borough of Poole v Information
Commissioner (EA/2019/0073), where the Tribunal ruled that information
relating to a companys business activities does not constitute personal
data. As such, the Council"s application of Regulation 13 is inappropriate
here.
2. Regulation 6(1)(b) Does Not Apply
I have already confirmed that this information is not available via the
Council"s online search facilities. Therefore, Regulation 6(1)(b), which
exempts the public authority from providing information that is reasonably
accessible by other means, does not apply in this instance.
3. Public Interest and Regulation 12(2) Presumption of Disclosure
Under Regulation 12(2) of the EIR, there is a strong presumption in favor
of disclosure, which applies both when engaging exceptions and in carrying
out the public interest test. I believe there is a significant public
interest in ensuring transparency regarding building control processes,
particularly in relation to public safety and regulatory compliance.
This public interest is supported by the fact that final certificates are
essential documents that attest to the completion and compliance of works
under the Building (Approved Inspectors etc.) Regulations 2010, which
should be subject to public scrutiny. The Corporate Officer of the House
of Commons v Information Commissioner [2008] EWCA Civ 1001 case further
supports the principle of transparency in regulatory compliance,
especially where safety may be a concern.
4. Previous Disclosure of Similar Information
I note that similar (Partial) Final Certificates have been provided to me
in the past without redaction, as shown in previous requests .
For example:
https://www.whatdotheyknow.com/request/m...
This demonstrates that there is precedent for disclosing such information,
and any concerns about personal data can be addressed through minimal
redaction, rather than outright refusal.
Thank you for your attention to this matter. I look forward to receiving
your response within the statutory timeframe as required under the Freedom
of Information Act 2000 and Environmental Information Regulations 2004.
Further to the recent Ombudsman’s ruling on a similar request which was
upheld in our favour to withhold, we are similarly applying the same
refusal notice to disclose, see details below.
We are unable to provide this information under Regulation 12 (3) and 13
of the Environmental Information Regulations. Information is the personal
data of a person other than the applicant (Regulation 12(3) and Regulation
13)); ICO decision notices suggest that while this information does
concern a building, as this building is one that living individuals reside
within, then the information could be considered to amount to personal
data and therefore be considered to be exempt under the Data Protection
Act.
Furthermore, the council considers this information exempt from disclosure
under Confidentiality of proceedings (Regulation 12(5)(d)); this is where
releasing the requested information would adversely affect the
confidentiality of a public authority’s proceedings where the
confidentiality arises from statute or common law. The term ‘proceedings’
is not restricted to meetings, rather formal activities of the Council
which I feel would cover building control inspections etc.
In this particular case we feel that the confidentiality is provided for
under a Common law duty of confidence, as in this case the Council and the
home owner are engaged in discussions regarding the property and the
interpretation of regulations.
The Council publishes Access to Information requests and responses on its
online Disclosure Log. (Any request included within this log will be
anonymised appropriately)
To view the Council’s Disclosure Log, please visit our website available
here:
[1]The Freedom of Information (FOI) Act | Croydon Council
(disclosure-log.co.uk)
If you are dissatisfied with the way the Council has handled your request
under the Environmental Information Regulations Act, you may ask for an
internal review. This should be submitted to us within 40 working days of
this response. You can do this by outlining the details of your complaint
by:
Email: [2][email address]
Writing: Information Team
London Borough of Croydon
Bernard Weatherill House
Floor 3 - Zone E
8 Mint Walk
Croydon, CR0 1EA
Any requests received after the 40 working day time limit will be
considered only at the discretion of the council.
If you are not content with the outcome of the internal review, you have
the right to apply directly to the Information Commissioner for a
decision. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Yours sincerely,
Information Team
Croydon Digital Services
Assistant Chief Executive Directorate
Bernard Wetherill House,
Mint Walk,
Croydon,
CR0 1EA
[3][email address]
References
Visible links
1. https://croydon.disclosure-log.co.uk/
2. mailto:[email%20address]
3. mailto:[email%20address]
Dear Croydon Borough Council
I am responding with reference to your response dated 6 January 2025 concerning my Freedom of Information (FOI) request (FOI/10611). After careful consideration of your decision to withhold the requested information under Regulations 13 and 12(5)(d) of the Environmental Information Regulations 2004 (EIR), I believe your response is flawed. I therefore request an internal review of your handling of my request.
While some of the points below may have been raised in my original FOI request of 12 September 2024, this response incorporates additional considerations regarding the definition of personal data, relevant legal precedents, and ICO decisions to further highlight the errors in your approach.
1. Regulation 13: Personal Data
Your reliance on Regulation 13 is flawed for the following reasons:
Definition of Personal Data Under Article 4(1) UK GDPR:
Personal data is defined as "any information relating to an identified or identifiable natural person (‘data subject’)." This definition includes data that directly or indirectly identifies a person. The Court of Justice of the European Union (CJEU) in Breyer v Bundesrepublik Deutschland (C-582/14) clarified that information can still constitute personal data if it identifies a person indirectly, such as through association with their property or location.
Application to This Case:
The Final Certificate pertains to a corporate entity, not an identifiable natural person. Corporate ownership negates the claim that this document constitutes personal data under Article 4(1) UK GDPR. The certificate does not reveal information about an individual and instead concerns the completion of works by a business entity.
2. Regulation 12(5)(d): Confidentiality of Proceedings
Your reliance on Regulation 12(5)(d) is inadequately justified:
No Demonstrated Adverse Effect:
Regulation 12(5)(d) requires evidence that disclosure would adversely affect the confidentiality of proceedings. You have failed to provide evidence of such adverse effects. The Final Certificate is a statutory document, the purpose of which is to certify compliance with building regulations. Such documents exist to promote transparency and public assurance, not to protect confidentiality.
Confidentiality Not Applicable to Regulatory Functions:
While you claim a common law duty of confidence, the Final Certificate is not inherently confidential. It reflects a past regulatory determination, distinct from any ongoing discussions between the council and a homeowner. Any such discussions do not render this document confidential under law.
Public Interest in Transparency:
The public interest in transparency and accountability in building control processes outweighs any weak confidentiality claims. Final Certificates play a vital role in ensuring compliance with safety standards, a matter of significant public concern.
3. Public Interest Test
Under Regulation 12(2), there is a strong presumption in favor of disclosure. The public interest in ensuring transparency and accountability in building control processes, particularly in matters of public safety, significantly outweighs the confidentiality and personal data arguments you have presented. You have failed to sufficiently consider this presumption or justify why the public interest does not favor disclosure in this case.
4. Breaches of EIR Regulations
Your handling of this request breaches the following provisions:
Regulation 5(1):
You failed to make available information that should be publicly accessible under the EIR.
Regulation 5(2):
The statutory timeframe for responding to the request was exceeded, as confirmed by the ICO in Decision Notice IC-337446-H9D5.
Regulation 12(1):
You failed to conduct an adequate public interest test or properly weigh the presumption in favor of disclosure under Regulation 12(2).
5. Legal Precedents and ICO Decisions
ICO Decision Notice IC-172338-N8C6:
This decision establishes that property-related data, where it can identify or affect an individual, qualifies as personal data under GDPR.
CJEU: Breyer v Bundesrepublik Deutschland (C-582/14):
The Court confirmed that information indirectly linked to a person, such as through property or location, constitutes personal data under GDPR if it identifies or impacts the individual.
Request for Internal Review
I formally request an internal review of your decision. Specifically, I ask that you reassess:
The incorrect application of Regulation 13, given that the property is owned by a corporate entity and the requested information does not constitute personal data.
The unjustified reliance on Regulation 12(5)(d), including the failure to demonstrate adverse effects on confidentiality.
The insufficient application of the public interest test under Regulation 12(1), especially regarding transparency in regulatory compliance.
The procedural breaches under Regulations 5(1) and 5(2).
I also draw your attention to relevant case law (Breyer v Bundesrepublik Deutschland) and ICO Decision Notice IC-172338-N8C6, which support my position that the requested information should be disclosed.
Please confirm receipt of this request and provide the outcome of the internal review within the statutory timeframe. If I do not receive a satisfactory response, I will bring this matter to the attention of the Information Commissioner’s Office.
Yours sincerely
Andrew White
Information Team Croydon
Digital Services
Assistant Chief Executive Directorate
Bernard Wetherill House
7th Floor, Zone B
Croydon
CR0 1EA
Contact: Information Team
[email address]
Dear Andrew White
Acknowledgement: Internal Review in relation to request FOI/10611
Subject: EIR -Building control final certificate Grasmere Road
Thank you for your request for an internal review of FOI/10611 - EIR
-Building control final certificate Grasmere Road which was received on
06/01/2025.
As a result of your request, we will be carrying out an internal review.
An officer from our legal team, who was not involved in the original
decision, will reconsider your request for information and notify you of
their decision by 03/02/2025.
Our colleagues from legal will be in touch with you as soon as they have
an update on your case.
If you have any queries regarding this matter please do not hesitate to
contact us.
Yours sincerely,
Information Management Team
Dear Information Management Team,
I am writing to follow up on the outcome of the internal review for FOI/10611 - EIR Building Control Final Certificate for Grasmere Road. As per your acknowledgment email dated 06/01/2025, the response was due by 03/02/2025. However, I have yet to receive any further communication regarding the decision.
I would appreciate an immediate update on the status of the review, including the reason for the delay and the expected timeframe for your response. Given that the statutory deadline has now expired, I trust that this matter will be prioritized accordingly.
If I do not receive a response promptly, I will have no choice but to escalate the matter to the Information Commissioner's Office (ICO) for non-compliance with the statutory timeframe.
I look forward to your urgent response.
Yours sincerely,
Andrew White
Information Team Croydon
Digital Services
Assistant Chief Executive Directorate
Bernard Wetherill House
7th Floor, Zone B
Croydon
CR0 1EA
Contact: Information Team
[email address]
Dear Mr White
Thank you for your e-mail received on 4/2/25.
We have been in contact with legal services, who are carrying out the
internal review of your information request, and they have informed us
that you will receive a response by the end of this week.
Please accept our apologies for this delay.
Kind regards
Information Team
Croydon Council
Dear Mr White,
Further to your email dated 6 January 2025, in which you requested an
Internal Review of the Council’s response to your request for information
made under the Environmental Information Regulations, I have now concluded
this review, and I am able to reply as follows. Please accept my apologies
for the delay in responding.
In your request for Internal Review, you asked the Council to reconsider
your request as you believed that you had not been provided with the
information requested.
In your request for information dated 12 September 2024 you requested the
following information:
“I am writing to formally request a copy of the Final Certificate issued
by Stroma Building Control, in relation to the works carried out under
Initial Notice 19/00789/IN at 28 Grasmere Road, Purley CR8 1DU, with an
Application Completion Date of 8th October 2020.
I understand that the Council has previously refused to supply similar
final certificates under the Environmental Information Regulations 2004
(EIR), citing Regulation 13 (personal data). I believe this interpretation
is incorrect for the following reasons:
1. Regulation 13 and Definition of Personal Data
The decision to withhold the requested information hinges on the
assumption that it constitutes personal data under Regulation 13 of the
EIR. However, Article 4(1) of the UK General Data Protection Regulation
(UK GDPR) defines personal data as information relating to an identifiable
natural person.
In this case, the property in question is owned by a limited company, as
confirmed by the HM Land Registry. Accordingly, the requested Final
Certificate does not pertain to any identifiable individuals, but rather a
corporate entity.
This aligns with the reasoning in Borough of Poole v Information
Commissioner (EA/2019/0073), where the Tribunal ruled that information
relating to a company’s business activities does not constitute personal
data. As such, the Council’s application of Regulation 13 is inappropriate
here.
2. Regulation 6(1)(b) Does Not Apply
I have already confirmed that this information is not available via the
Council’s online search facilities. Therefore, Regulation 6(1)(b), which
exempts the public authority from providing information that is reasonably
accessible by other means, does not apply in this instance.
3. Public Interest and Regulation 12(2) Presumption of Disclosure
Under Regulation 12(2) of the EIR, there is a strong presumption in favour
of disclosure, which applies both when engaging exceptions and in carrying
out the public interest test. I believe there is a significant public
interest in ensuring transparency regarding building control processes,
particularly in relation to public safety and regulatory compliance.
This public interest is supported by the fact that final certificates are
essential documents that attest to the completion and compliance of works
under the Building (Approved Inspectors etc.) Regulations 2010, which
should be subject to public scrutiny. The Corporate Officer of the House
of Commons v Information Commissioner [2008] EWCA Civ 1001 case further
supports the principle of transparency in regulatory compliance,
especially where safety may be a concern.
4. Previous Disclosure of Similar Information
I note that similar (Partial) Final Certificates have been provided to me
in the past without redaction, as shown in previous requests .
For example:
https://www.whatdotheyknow.com/request/m...
This demonstrates that there is precedent for disclosing such information,
and any concerns about personal data can be addressed through minimal
redaction, rather than outright refusal.”
The Council responded to you on the 6 January 2025 and provided the
following response:
“We are unable to provide this information under Regulation 12 (3) and 13
of the Environmental Information Regulations. Information is the personal
data of a person other than the applicant (Regulation 12(3) and Regulation
13)); ICO decision notices suggest that while this information does
concern a building, as this building is one that living individuals reside
within, then the information could be considered to amount to personal
data and therefore be considered to be exempt under the Data Protection
Act.
Furthermore, the council considers this information exempt from disclosure
under Confidentiality of proceedings (Regulation 12(5)(d)); this is where
releasing the requested information would adversely affect the
confidentiality of a public authority’s proceedings where the
confidentiality arises from statute or common law. The term ‘proceedings’
is not restricted to meetings, rather formal activities of the Council
which I feel would cover building control inspections etc.
In this particular case we feel that the confidentiality is provided for
under a Common law duty of confidence, as in this case the Council and the
homeowner are engaged in discussions regarding the property and the
interpretation of regulations.”
In your request for an Internal Review dated 6 January 2025, you stated
the following:
“While some of the points below may have been raised in my original FOI
request of 12 September 2024, this response incorporates additional
considerations regarding the definition of personal data, relevant legal
precedents, and ICO decisions to further highlight the errors in your
approach.
1. Regulation 13: Personal Data
Your reliance on Regulation 13 is flawed for the following reasons:
Definition of Personal Data Under Article 4(1) UK GDPR:
Personal data is defined as "any information relating to an identified or
identifiable natural person (‘data subject")." This definition includes
data that directly or indirectly identifies a person. The Court of Justice
of the European Union (CJEU) in Breyer v Bundesrepublik Deutschland
(C-582/14) clarified that information can still constitute personal data
if it identifies a person indirectly, such as through association with
their property or location.
Application to This Case:
The Final Certificate pertains to a corporate entity, not an identifiable
natural person. Corporate ownership negates the claim that this document
constitutes personal data under Article 4(1) UK GDPR. The certificate does
not reveal information about an individual and instead concerns the
completion of works by a business entity.
2. Regulation 12(5)(d): Confidentiality of Proceedings
Your reliance on Regulation 12(5)(d) is inadequately justified:
No Demonstrated Adverse Effect:
Regulation 12(5)(d) requires evidence that disclosure would adversely
affect the confidentiality of proceedings. You have failed to provide
evidence of such adverse effects. The Final Certificate is a statutory
document, the purpose of which is to certify compliance with building
regulations.. Such documents exist to promote transparency and public
assurance, not to protect confidentiality.
Confidentiality Not Applicable to Regulatory Functions:
While you claim a common law duty of confidence, the Final Certificate is
not inherently confidential. It reflects a past regulatory determination,
distinct from any ongoing discussions between the council and a homeowner.
Any such discussions do not render this document confidential under law.
Public Interest in Transparency:
The public interest in transparency and accountability in building control
processes outweighs any weak confidentiality claims. Final Certificates
play a vital role in ensuring compliance with safety standards, a matter
of significant public concern.
3. Public Interest Test
Under Regulation 12(2), there is a strong presumption in favour of
disclosure. The public interest in ensuring transparency and
accountability in building control processes, particularly in matters of
public safety, significantly outweighs the confidentiality and personal
data arguments you have presented. You have failed to sufficiently
consider this presumption or justify why the public interest does not
favour disclosure in this case..
4. Breaches of EIR Regulations
Your handling of this request breaches the following provisions:
Regulation 5(1):
You failed to make available information that should be publicly
accessible under the EIR.
Regulation 5(2):
The statutory timeframe for responding to the request was exceeded, as
confirmed by the ICO in Decision Notice IC-337446-H9D5.
Regulation 12(1):
You failed to conduct an adequate public interest test or properly weigh
the presumption in favour of disclosure under Regulation 12(2).
5. Legal Precedents and ICO Decisions
ICO Decision Notice IC-172338-N8C6:
This decision establishes that property-related data, where it can
identify or affect an individual, qualifies as personal data under GDPR.
CJEU: Breyer v Bundesrepublik Deutschland (C-582/14):
The Court confirmed that information indirectly linked to a person, such
as through property or location, constitutes personal data under GDPR if
it identifies or impacts the individual.
Request for Internal Review
I formally request an internal review of your decision. Specifically, I
ask that you reassess:
The incorrect application of Regulation 13, given that the property is
owned by a corporate entity and the requested information does not
constitute personal data.
The unjustified reliance on Regulation 12(5)(d), including the failure to
demonstrate adverse effects on confidentiality.
The insufficient application of the public interest test under Regulation
12(1), especially regarding transparency in regulatory compliance.
The procedural breaches under Regulations 5(1) and 5(2).
I also draw your attention to relevant case law (Breyer v Bundesrepublik
Deutschland) and ICO Decision Notice IC-172338-N8C6, which support my
position that the requested information should be disclosed.
Please confirm receipt of this request and provide the outcome of the
internal review within the statutory timeframe. If I do not receive a
satisfactory response, I will bring this matter to the attention of the
Information Commissioner’s Office.”
On receiving your request for an Internal Review, I contacted the
Principal Building Control Surveyor, following which the Council considers
that the requested information is excepted from disclosure for the reasons
previously stated in the Council’s reply to you dated 6 January 2025, and
that this position is currently supported by the ICO Decision Notice
issued on 24 September 2024 ([1]IC-302534-T2H1).
If you are not content with the outcome of the Internal Review, you have
the right to apply directly to the Information Commissioner for a
decision. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Yours sincerely,
Howard Passman
020 8726 6000 ext. 27103
Resources Directorate
Legal Services Division
12th Floor
Bernard Weatherill House
8 Mint Walk
Croydon CR0 1EA
Council services, online, 24/7 www.croydon.gov.uk/myaccount.
Please use this web site address to view the council's e-mail disclaimer -
http://www.croydon.gov.uk/email-disclaimer
References
Visible links
1. https://ico.org.uk/media/action-weve-tak...
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now