Lynn Wyeth takes a look at some recent FOI and Data Protection cases, and what they mean for practitioners.
FOI
How you can spot environmental information
The Environmental Information Regulations 2004 (often called the EIRs) give people the right to access environmental information held by public authorities. They are similar to the Freedom of Information Act 2000 (FOI), but they focus specifically on information about the environment.
The regulations work on a presumption of disclosure. This means information should normally be released unless there is a strong reason to withhold it. Even when an exception applies, the authority must consider whether it is still in the public interest to release the information… and it’s a much higher threshold than FOI in many cases, with the authority needing to evidence that an adverse effect will occur.
Remember that requests for environmental information do not have to be in writing. People can ask for information verbally too. Make sure that you regularly remind staff to look out for them. As with FOI requests, you have a duty to advise and assist requesters and would-be requesters.
What Counts as ‘Environmental Information’?
Environmental information is defined quite broadly under the regulations. It’s not just about nature or pollution. It includes many different types of information connected to the environment and how it is affected by human activity. There are six main categories used to define environmental information.
1. Information about the state of the environment.
This includes things like air quality, water, soil, land, wildlife, and natural sites. For example, data on river pollution or reports on biodiversity would fall into this category. Remember: air…land…water.
2. Information about factors that affect the environment.
These are things like energy use, noise, radiation, waste, or emissions. For instance, details about factory emissions or traffic noise levels would be covered. Remember: factors affecting air…land…water.
3. Information about measures or activities that affect the environment.
This includes policies, plans, laws, and projects. Planning applications, environmental impact assessments, and government strategies are good examples. Remember: plans or policies affecting air…land…water.
4. Reports on how environmental laws are being applied. This could include inspection reports, enforcement actions, or compliance data.
5. Information about the costs and benefits used in environmental decision-making. For example, economic studies or financial models used to decide whether a project should go ahead, or tolls collected from a bridge to re-invest in public transport. Remember: Budgeting and financial modelling affecting air…land…water
6. Information about how the environment affects human health and living conditions. This includes things like pollution impacts on health, access to green spaces or contamination in food chains.
The Henney Roadmap
In the case of Henney v Information Commissioner & DEFRA, the tribunal set out a clear step-by-step approach (often called the “roadmap”) for deciding whether information counts as “environmental information” under the EIRs.
- Identify exactly what information has been requested. You need to be clear about the content of the information, not just the topic.
- Ask whether the information relates to any of the categories listed in the EIR definition. (States, factors, measures)
- Consider how directly the information is connected to the environment. The connection does not have to be obvious or immediate, but it must be more than remote or trivial.
- Take a broad and purposeful approach. The EIRs are designed to promote access to information, so the definition of environmental information should be interpreted widely rather than narrowly.
- If the information relates to a “measure” (like a policy or decision), also consider the wider context. This includes background documents, advice, and communications that help explain or inform that measure.
Examples:
i) Development of a housing estate
Is the request asking about a measure?
– the future development of a housing estate is a measure
Would the measure be likely to affect the elements of the environment,
or factors impacting on them?
– changes to the external features of houses in the estate affect the
landscape
Is the subject matter of the request “information…on” the measure?
– a document summarising options for the development of the estate is
information on the measure.
ii) York City Council (ICO decision notice FER0827677)
Request for the legal charge and details of council financial support and lease
agreement for the development of the new York City FC football stadium.
- Development of football stadium is a measure
- The stadium is going to impact landscape
- Legal charge and details of council financial support are information on the measure
BUT…the lease agreement is not EIR as it doesn’t change the footprint of the building orsurrounding area and isn’t information on the measure.
The ICO has more guidance on the EIRs on its website here.
Data Protection
Employee subject access requests (SARs) are often more complex than they first appear. The legal right is simple. Employees can access their personal data. The reality is much more challenging in practice.
One of the main issues is understanding what counts as personal data. Employees often believe they are entitled to everything they have ever written or received at work. However, this is not correct. The right only covers information that is about them. In some cases, this can change depending on context. For example, an email to or from them may not usually be personal data, but if it is used as evidence in a disciplinary process, it may become personal data because it is clearly about the individual.
Another key challenge is deciding how far to search. Organisations are required to carry out reasonable and proportionate searches, but employee data is often spread across many systems. This includes emails, messaging platforms, and even informal channels like WhatsApp. If these systems are used for work purposes, they may need to be searched. This creates practical difficulties, especially where records management is not well controlled and there is no central definitive ‘HR file’; something a lot of employees expect.
Linked to this is the issue of scope. Many employee SARs arise during disputes, and requesters often ask for “everything.” While it is good practice to ask if they can narrow their request, this is not always successful. In strained relationships, employees may refuse to limit the scope, making the exercise more resource-intensive.
There are also difficulties in deciding what the employee is actually entitled to receive. Not all documents that mention an individual will qualify. For example, being listed as attending a meeting does not usually make the entire set of minutes an employee’s personal data. Each document must be reviewed carefully to decide whether the content is truly about the individual.
Another important issue is the application of exemptions. Organisations may need to withhold information in certain situations, such as where legal professional privilege applies or where disclosure would reveal third-party data. There may also be risks to ongoing processes, such as disciplinary investigations, where releasing information could prejudice the outcome.
Finally, there are practical and behavioural challenges. Some SARs are used as a tactic in disputes, for example alongside settlement negotiations. Others are influenced by advisers such as unions or solicitors, which can increase complexity or widen the scope unnecessarily. Even where a request may appear unreasonable, organisations often still need to engage with it carefully to remain compliant.
Exemptions can also apply to HR processes such as management forecasts (e.g. data being used to decide the outcome of an organisational review) or confidential references.
In summary, employee SARs are rarely straightforward. The main issues include defining personal data, managing wide-ranging searches, handling unhelpful scope, applying appropriate exemptions.
The ICO has published a subject access Q&A for employers here.
