Lynn Wyeth takes a look at some recent Information Governance issues, and what they mean for practitioners.
EIR
What Are “Conditions of Human Life” Under the Environmental Information Regulations 2004?
One of the most misunderstood parts of the Environmental Information Regulations 2004 (EIRs) is regulation 12 (5)(f), which includes information about:
“the state of human health and safety… conditions of human life, cultural sites and built structures…”
The recent ICO decision notice IC-392484-G1Q9 about Houses in Multiple Occupation (HMOs) gives us a clear direction. Information may relate to human life, but it is only environmental information if there is a sufficient link to the environment.
To fall within regulation 2(1)(f), information must:
- Concern human health, safety or conditions of human life; and
- Be affected by environmental elements, factors, measures or activities described elsewhere in regulation 2(1).
In other words, there must be an environmental connection.
The ICO’s guidance, referred to in the decision notice, takes a broad view of the phrase. It can include matters such as:
- Housing
- Poverty
- Employment
- Social welfare
- Heating
- Access to clean water
- Sanitation
- Healthcare
These are all aspects of how people live and function in society.
However, merely because information relates to one of these topics does not automatically make it environmental information.
The Environmental Link Is Essential.
The First Tier Tribunal has previously said:
‘Our reasoning is that ‘conditions of human life’ in EIR 2(1)(f) includes conditions in which human beings live, in this case in a registered HMO property. Moreover, those conditions ‘are or may be affected by measures or policies’ in EIR 2(1)(c) such as, in this case, HMO licensing conditions which determine amongst other things, density of occupation of HMOs, rubbish recycling and means of escape. These in turn affect elements of the environment such as water and land in EIR 2(1)(a) and factors likely to affect elements of the environment such as energy and noise in EIR 2(1)(b)’ – Stephen Masterman v The Information Commissioner [2024] UKFTT 289 (GRC).
Another example to highlight the difference, is to consider people not being able to afford energy bills. The Information Commissioner accepted that a person’s ability to heat their home and pay for energy could relate to the “conditions of human life”. However, the information requested concerned customers’ financial circumstances, not environmental impacts. There was no evidence that the inability to pay was caused by environmental factors, pollution, emissions, environmental measures or other matters covered by the EIR. As a result, the information in this situation was not environmental information.
The phrase “conditions of human life” is deliberately broad. The courts and the ICO have repeatedly emphasised that the EIR should be interpreted generously. It covers a wide range of issues including housing, poverty, welfare, heating and healthcare. But regulation 2(1)(f) is not a catch-all provision for anything that affects people. The information must also be connected to environmental conditions, environmental factors, or environmental measures.
When deciding whether a request falls under the EIR, practitioners should always ask:
Is this information about human life being affected by the environment, or is it simply about human life?
DP
Data Protection Complaints – The New Legal Requirement
Since 19 June 2026, organisations that process personal data must have a formal data protection complaints procedure in place. This is a new requirement introduced by the Data (Use and Access) Act 2025.
Many organisations already deal with complaints, but this change makes it a legal requirement to have a specific process for complaints about how personal information is handled. This includes complaints about:
- A subject access request (SAR)
- A data breach or security incident
- Inaccurate personal information
- How personal data has been collected, used, shared, stored or retained
- Failure to comply with an individual’s other data protection rights.
People do not need to use legal language or mention the UK GDPR for a complaint to be valid. If someone is unhappy about how their personal data has been handled, it should be treated as a data protection complaint.
The Information Commissioner’s guidance says organisations must:
- Provide a clear way for people to make a data protection complaint.
- Acknowledge receipt of the complaint within 30 days.
- Investigate the complaint and make appropriate enquiries.
- Keep the complainant informed of progress.
- Inform the individual of the outcome without undue delay.
Importantly, there are no exemptions from the requirement to have a complaints process. Every organisation acting as a data controller must have one.
The ICO recommends that organisations have a documented process which explains:
- How complaints can be submitted.
- Who will investigate them.
- Timescales for acknowledging and responding.
- How investigations will be carried out.
- How outcomes will be communicated.
- How complaints will be recorded and monitored.
- The individual’s right to complain to the ICO if they remain dissatisfied.
Staff should also be trained to recognise a data protection complaint when one is received, even if it arrives as part of a wider complaint or correspondence.
If your organisation does not yet have a dedicated data protection complaints procedure, now is the time to revise your policy. A simple, clear and well-publicised process will help you comply with the law and hopefully resolve concerns before they escalate to the ICO.
