Victor Mishiku v The Information Commissioner & Anor

NCN: [2026] UKFTT 00698 (GRC) Case Reference: FT/EA/2024/0097 First-tier Tribunal General Regulatory Chamber Information Rights Heard in person on 28 November 2024 Heard: on the papers on 30 July 2025, 23 January 2026 and 17 April 2026 Decision given on: 12 May 2026 Before TRIBUNAL JUDGE FOSS TRIBUNAL MEMBER DE WAAL TRIBUNAL MEMBER SHAW Between VICTOR MISHIKU Appellant and (1) THE INFORMATION COMMISSIONER (2) LONDON BOROUGH OF EALING Respondents Representation: For the Appellant: the Appellant appeared in person. For the First Respondent: the First Respondent did not appear. For the Second Respondent: Ealing Legal Services. Decision: The appeal is DISMISSED in part and ALLOWED in part. Substituted Decision Notice: Within 35 days of promulgation of this decision, the London Borough of Ealing must provide to the Appellant the name of the second owner recorded on the application for planning permission. REASONS Introduction to the Appeal

1. This appeal concerns the Appellant’s request (“the Request”) of 26 June 2023 to the Second Respondent (“the Council”) for a copy of a planning application form (“the Application”) to show personal data within it, namely: a. the currently redacted telephone numbers and email address of the applicant’s agent and/or architect whose name itself is unredacted; and b. the currently redacted names of two persons or entities identified on the Application as owners of the site subject of the application, whose addresses are unredacted.

2. The Council refused the Request, relying on Regulation 13(1) of the Environmental Information Regulations 2004 (“EIR”) (personal data).

3. This is an appeal against the Commissioner’s Decision Notice ReferenceIC-260057-L9S (“the Decision Notice”), wherein he concluded that the Council was entitled to rely on Regulation 13(1) EIR to refuse the Request and withhold the unredacted Application.

4. We have seen the information withheld by redaction (“the withheld information”) in the unredacted Application in a CLOSED bundle. The very great majority of our decision appears in OPEN. One sentence of our decision, which states some of the withheld information, appears in a CLOSED version of this decision.

5. Two pieces of planning legislation relevant to the issues in the appeal are referred to in various terms and acronyms by the parties throughout their submissions. They are the Town and Country Planning Act 1990 and The Town and Country Planning (Development Management Procedure) (England) Order 2015. We shall refer to them throughout as “TCPA” and “the 2015 Order” respectively. The Request

6. The Request was this: “REQUEST FOR PART 1 OR PART 2 STATUTORY REGISTER (ARTICLE 40 OF 2015 STATUTORY INSTRUMENT NO. SI 595) [the 2015 Order] DOCUMENTS AND OTHER CONTACT INFORMATION/CORRESPONDENCE/FILE NOTE Please supply an un-redacted copy of the planning application form dated 26th April 2023 NB. ARTICLE 40 (NO MENTION OF REDACTION) and in the DATA PROTECTION [EXCLUSIONS FOR DOCUMENTS REQUIRED BY STATUTE] Please supply a copy of the file notes or e-mails or letters and the replies thereto from Ealing Council Planning Department (Case Officer Mr Christopher Neelands) contacting the applicant or agent(s) in May or June 2023 informing C56 them that Ealing Council officers would not be supporting the planning application and to include the e-mail or letter officially withdrawing the said application.”

7. We understand that the second part of the Request, the request for file notes or emails or letters, is not in issue in this appeal. We do not address it further.

8. On 26 July 2023, the Council responded. It explained that information relating to planning applications relating to the property in question were available on the Council’s online planning portal in redacted format. It said that it could not provide an unredacted copy of the Application given the personal data within it. It said: “In considering the balance between the identified legitimate interests and the rights and interests of the individual, we have considered whether the proposed disclosure would be within the reasonable expectations of the named individual/s. The council has a legal responsibility to balance confidentiality with public interest, and on this occasion the Trust We do not understand reference to “the Trust” and consider it may be an error. It is clear that it is the Council which has concluded that there is no public interest in the redacted names being released. has concluded there is no public interest in the redacted names being released. In this case after such consideration, I believe that the public interest in withholding the information outweighs the public interest in its release.”

9. On 7 August 2023, the Appellant queried the correctness of, and legal basis for, the Council’s response. He said this: “In pursuance of section 69(5)(a) of the [TCPA] 1990, article 40(3)(a) and later (4)(a) the law requires a copy (photographic or electronic) of the planning application – which in recent years would be in a form nationally prescribed to be kept on a Statutory Register available for public inspection. There is no provision in article 40 for redacting what is in the completed form nor justification for redaction in view of the Data Protection Act 2018 Schedule 11 paragraph 3(1), relating to section 69(8) of the TCPA 1990 and article 40(12), (14) and, if still applicable, (16). Please see three source extracts attached of the above legal statutory provisions. The Data Protection Act 2018 Schedule 11 paragraph 3(1) mentioned above reads: “The listed provisions do not apply to personal data consisting of information that the controller is obliged by enactment to make available to the public, to the extent that the application of the listed provision would prevent the controller from complying with that obligation.” The Statutory requirement originating in section 69 and article 40 of Statutory Instrument 2015/595 [the 2015 Order] is nothing to do with Reg. 13 of the EIR 2004 that you quote. Therefore, I again request to see the unredacted copy of the Application Form and that it be made available as required by law. If you are not able to produce the document to me at the Town Hall or Perceval House in person, as the centre has still not re-opened, would you kindly email it to me instead”.

10. The Council treated the Appellant’s letter of 7 August 2023 as a request for an internal review. On 7 November 2023, the Council maintained its position. It said this: “With regard to the application form, whilst it is published online, it is the contact details ie/ email address, telephone number and signature that are redacted. This is common practice. Although the application form can be viewed online, I have attached a copy of the redacted planning application for your reference.”

11. The Council explained that in reaching its decision, it had considered a Decision Notice by the Commissioner in another matter, reference IC-161213-Q5W0 which advised “The Commissioner is also satisfied that the applicant’s name and email address and those of the agent architect constitute third party personal data within the meaning of Section 3(2) of the DPA as they clearly identify and relate to them.”

12. On 22 September 2023, the Appellant complained to the Commissioner.

13. The Commissioner investigated. The Decision Notice

14. By the Decision Notice, the Commissioner decided that: a. The information withheld by the Council was personal data within the meaning of s3(2) of the Data Protection Act 2018 (“DPA”). Article 5(1)(a) UK GDPR provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. b. Disclosure of the withheld information constitutes processing of the data. c. In order to be lawful processing, one of the lawful bases in Article 6(1) UK GDPR must apply, and the processing must be generally lawful. d. The Commissioner considered that the lawful basis most applicable was that in Article 6(1)(f) which provides: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”. e. In considering the three-stage test applicable for assessing that issue (legitimate interest, necessity and the balancing test of whether the legitimate interest overrides the legitimate interest or fundamental rights and freedoms of the data subject), the Commissioner was satisfied that: i. The Appellant had a legitimate interest in knowing the full details of the Application. ii. Disclosure was not, however, necessary for the purposes of satisfying that interest: there is a less intrusive way of meeting that interest – the Application is already in the public domain and the Commissioner was satisfied that the personal data did not fall within the legitimate interest of the Appellant. Disclosure of the personal data would not provide the Appellant with any additional information concerning the reason for the Application. f. The Council had correctly relied on Regulation 13(1) EIR to withhold the requested information, that is to say an unredacted copy of the Application. The Appeal

15. By Notice of Appeal attaching grounds of appeal dated 17 March 2024, the Appellant submits, in summary: a. Pursuant to s69 TCPA, the Council’s planning register must be kept available for inspection by the public at all reasonable hours. b. That provision is supplemented by Article 40 of the 2015 Order, including paragraphs (2) to (4) (copies in register), paragraph (12) (place for keeping register) and paragraph (14) (option to “make the register available for inspection by the public on a website maintained by the authority for that purpose”). c. The Decision Notice failed to consider Article 6(1)(c) UK GDPR, namely whether disclosure is necessary for compliance with a legal obligation to which the controller is subject.

16. By Response dated 30 April 2024, the Commissioner submits, in summary: a. A repetition of his reasoning in the Decision Notice as to the application of Article 6(1)(f) UK GDPR. b. The Appellant has not identified an error of law by the Commissioner in his conclusion that the Council is entitled to rely on Regulation 13(1) EIR to withhold the requested information. c. The Commissioner “disagrees with the Appellant’s contention that Article 6(1)(c) of the UK GDPR applies disclosure of the withheld personal data is not necessary for compliance with a legal obligation under the above planning legislation.”[sic]. The Council had told the Commissioner in his investigation that: “When a planning application is made, there is a requirement for a register to be published. The [2015 Order] governs this and Section 40(7) gives the details that must be published. The applicant’s architect name and address does not have to be published and the expectation of the individual would be that this information is not published.” d. Disclosure of the withheld information into the public domain is not necessary.

17. By Reply dated 6 May 2024, the Appellant submits, in summary: a. Article 40(7) of the 2015 Order is irrelevant as it relates to certificates which show that no planning application is required. Instead, Article 40(2) – (4) are relevant. b. It remains the case that the Commissioner has failed to consider whether the processing would be lawful under article 6(1)(c) of UK GDPR: “Section 69(8) by definition satisfies GDPR article 6(1)(c) and otherwise see the Data Protection Act 2018 Schedule 2 paragraph 5(1), erroneously referred to previously in the last sentence of my Grounds of Appeal as 3(1). It is not a matter of considering the redacted details a part of a balancing test between legitimate interest and any expectation that the details inserted in the application form would somehow not be disclosed on the register. What counts is what is required by planning law to be open to public inspection, which is a copy of the application not just some of what is inserted in the prescribed form of application.”

18. By a Response to the appeal dated 17 January 2025, the Council submits, in summary: a. Disclosure to the Appellant of the withheld information is not necessary for the Council’s compliance with a legal obligation. b. Section 69(3) TCPA provides that a development order may require the register to be kept in two or more parts. Article 40(2) of the 2015 Order prescribes that the LPA authority must keep a register (“the Statutory Register”). c. Article 40(4) of the 2015 Order prescribes what the Statutory Register must contain in relation to every application for planning permission. This includes: (a) a copy (which may be photographic or in electronic form) of— (i) the application. d. In accordance with the 2015 Order, the Council’s Statutory Register contains an electronic copy of the Application. e. Article 7 of the 2015 Order prescribes what an application for planning permission must comprise: it must be made in writing to the local planning authority on a form published by the Secretary of State (or a form to substantially the same effect); and it must include the particulars specified or referred to in the form; f. the legislative framework is clear, concise and prescriptive. The particulars required in the Statutory Register do not extend to all details of the planning application. There is no mandatory requirement to publish anything more than is prescribed in the 2015 Order. g. Sector guidance published by the Planning Advisory Service (June 2021)(“the PAS Guidance”) sets out the industry practice at page 10: “For example, the publication on an LPA’s website of individuals’ names and addresses in connection with planning applications is required by article 40 of [the 2015 Order] (for more details see Appendix 2); in contrast, the publication of their email addresses, signatures and telephone numbers is likely to be excessive to the task.” h. Importantly, the PAS Guidance (correctly in the Council’s view) qualifies this statement at footnote 2, page 10: “More accurately Article 40 requires names and addresses only for certificates of lawfulness. The decision to publish names and addresses on the statutory register of planning applications is for the Council to take.” i. Consequently, the Applicant’s position is misconceived. There is no lawful requirement to disclose personal data in the manner submitted by the Applicant. j. This is contrasted by Article 40(7) of the 2015 Order and ss191 and 192 of TCPA: Article 40(7) of the 2015 Order requires the names and addresses of applicants for certificates of lawfulness under ss191 and 192 of TCPA. Those are something distinct from the Application in this case. k. The Council’s Statutory Register contains a copy of the Application and, therefore, the Council has complied with Article 6(1)(c) UK GDPR in discharging its obligations as an LPA pursuant to section 69 of TCPA and the 2015 Order. In fulfilling its statutory duty, the Council has published information which forms part of the Statutory Register, which it makes available via its website for unrestricted access. l. All the withheld information is personal data.

19. By Reply to the Council’s Response dated 31 January 2025, the Appellant submits, in summary: a. The Appellant does not rely on Article 40(7) of the 2015 Order. Reference to that appears to have arisen by an error in the Council’s correspondence with the Commissioner in his investigation. b. Neither Article 6(1)(c) UK GDPR nor Section 69(8) TCPA is subject to a qualification that what may be inspected is anything less than the planning register containing the entirety of the items specified in Article 40(4) of the 2015 Order. That does not depend upon someone’s consent or what someone may or may not have expected. There is no provision for redaction of the planning register open to public inspection. It is clear from the Data Protection Act 2018 Schedule 2 paragraphs 5(1) and 2(1)(b) that a statutory right to inspect within Article 6(1)(c) UK GDPR means that all of the planning register may be inspected, without omission of such personal data as the Council might decide not to publish voluntarily on its website. c. Nor is Article 6(1)(c) UK GDPR or Section 69(8) TCPA subject to a qualification that, before seeing some part of the planning register, a member of the public must explain why it would be of significant interest. The purpose of the entitlement to inspect the whole planning register regarding a planning application (including the entire completed application form, with plans, drawings, statements and so on) is so that each member of the public making such inspection may then consider which, if any, of the various pieces of information turn out to be of interest. Even if none do, that does not mean that they should not have been seen. The member of public will have the satisfaction of having scrutinised the material so as to know what was there.

20. Where the Council refers to the Statutory Register and where the Appellant refers to the planning register, we understand those terms to describe one and the same register. We shall refer to it as the planning register. The Legal Framework

21. Regulation 2(1) EIR defines environmental information as any information on: (a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements; (b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in (a); (c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in (a) and (b) as well as measures or activities designed to protect those elements; (d) reports on the implementation of environmental legislation; (e) cost-benefit and other economic analyses and assumptions used with the framework of the measures and activities referred to in (c); and (f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in (a) or, through those elements, by any of the matters referred to in (b) and (c).

22. We are satisfied that a planning application is environmental information within the meaning of Regulation 2(1)(c) EIR, and that the withheld personal data, identifying the individual or individuals making the application, both principal and agent, is environmental information in that context.

23. Regulation 12(1) EIR provides that: “Subject to paragraphs (2), (3) and (9), a public authority may refuse to disclose environmental information requested if- (a) an exception to disclosure applies under paragraphs (4) or (5); and (b) in all the circumstances of the case, the public interest in maintaining the exception outweighs the public interest in disclosing the information.

24. Regulation 12 (2) EIR provides: “A public authority shall apply a presumption in favour of disclosure.”

25. Regulation 13 EIR renders information excepted from disclosure to the extent it includes personal data of a third party, and its disclosure otherwise than under EIR would contravene any of the data protection principles relating to the processing of personal data as set out in Article 5 UK GDPR.

26. Regulation 13 EIR provides: “(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if— (a) the first condition is satisfied, or (b) the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it. (2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (2B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene— (a) Article 21 of the UK GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).] (3A) The third condition is that— (a) on a request under Article 15(1) of the UK GDPR] (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act. … (6) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

27. “Processing” is defined by s3(4) of the Data Protection Act 2018 (“DPA”) in a number of ways, relevantly for current purposes as “disclosure by transmission, dissemination or otherwise making available” (s3(4)(d) DPA).

28. Personal data is defined by s.3(2) DPA as: “…any information relating to an identified or identifiable living individual.”

29. “Identifiable living individual” is defined by s3(3) DPA as: “a living individual who can be identified, directly or indirectly, in particular by reference to- (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity to the individual.”

30. If the information is personal data, the second question is whether its disclosure would breach any of the data protection principles.

31. Article 5 UK GDPR lists the data protection principles which require that personal data shall be: “(a) processed lawfully, fairly and in a transparent manner in relation to individuals (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”

32. Article 6(1) UK GDPR provides for the specific circumstances in which processing of personal data is lawful as follows: “1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.”

33. Of the provisions for lawful processing, Article 6(1)(c) is in issue in this appeal. The Appellant says that the Commissioner overlooked to consider Article 6(1)(c) at all.

34. Schedule 2, Part 1 DPA provides exemptions from certain UK GDPR provisions.

35. Paragraph 5 of Schedule 2 creates exemptions for disclosure required by law or for legal proceedings.

36. Paragraph 5(1) provides: “The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.”

37. Paragraph 5(2) provides: “The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.”

38. The listed GDPR provisions referred to in paragraph 5 are defined in Schedule 2, paragraph 1 as: “(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided); (ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided); (iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); (iv) Article 16 (right to rectification); (v) Article 17(1) and (2) (right to erasure); (vi) Article 18(1) (restriction of processing); (vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing); (viii) Article 20(1) and (2) (right to data portability); (ix) Article 21(1) (objections to processing); (x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and (b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)— (i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6; …” The hearing

39. On 28 November 2024, we heard the appeal in person. At that stage, only the Appellant and the Commissioner were parties to the appeal. The Commissioner did not appear at the hearing. The Appellant was unrepresented, although he was, with the Tribunal’s agreement, assisted by a friend, Mr Gerald Moran. We read a skeleton argument filed by the Appellant and heard oral submissions from each of the Appellant and Mr Moran.

40. In summary, those submissions were as follows: a. There could be no expectation by the applicant’s agent in this case that their personal data on the Application would not be published, given the warnings about publication which appear on the form. b. A potentially valuable development of the site in question is in prospect. The application is a “front”; the freehold owner of the site, whose name (but not address) has been redacted on the form, has supplied their tenant’s name as applicant for the purposes of the Application but is using their own agent and architect of many years’ employ, whose name and address are disclosed but whose personal data in the form of contact details has been redacted. c. It is irritating that after thirty years of inspecting entire planning applications at Council premises, that is to say, applications which have not been redacted of personal data, the Appellant is now told that he cannot have sight of such information in this case on grounds of data protection. d. The legislation about the planning register makes no provision for redaction of instances of personal data. It must be an entire application form not just the details of the proposed development which must be placed on the planning register. In failing to do that, the Council is not complying with the law. It is a point of principle in this case that the entire Application, including the agent’s contact details and the owners’ identities, should be placed on the planning register.

41. After the hearing, we concluded that we required further information from the Council, and that the Council should be joined as a party to the appeal. We directed accordingly.

42. On 17 January 2025, the Council filed a Response to the appeal.

43. On 31 January 2025, the Appellant filed a Reply.

44. On 4 August 2025, we directed further submissions from the parties, in summary, requiring the Commissioner to address the Appellant’s submission that disclosure of the withheld information was necessary for compliance with a legal obligation to which the Council was subject within the meaning of Article 6(1)(c) UK GDPR, and the Council to address the basis on which it contends that it is not obliged to include in the planning register all the particulars specified in the form of planning application prescribed by Article 7 of the 2015 Order.

45. The Council filed its further submissions on 22 August 2025. In relevant summary, the Council submits that: a. It complies with s69 TCPA and related orders by maintaining and publishing a planning register containing electronic copies of applications but does not provide unredacted access. b. The basis on which an application for planning permission is not required to include all particulars specified in the form of the application, according to Article 7(1)(b) of the 2015 Order, is that the application must be made in writing on a prescribed form or an equivalent form which meets the requirements. This means that while the planning portal provides a recommended form, alternative forms that fulfil the necessary particulars are also acceptable. This flexibility ensures that the essential information is provided without mandating a specific format. c. The Council’s online register contains the prescribed information which refers to matters relating to the applied-for development taking place on the land. d. Article 40(7) of the 2015 Order, which requires provision of the name and address of an applicant to be included, are not planning permission applications. In this context, also, the Council is required to protect personal data. Personal information need not be published for the Council to make a decision on land use under planning law. e. The Council does not publish all the details on the planning application form, namely signature, telephone numbers and email addresses because it is personal information and exempt under UK GDPR. The Council holds all the information in unredacted form for its own use when determining applications to enable it to carry out its decision-making. The Council complies with planning portal guidance.

46. The Commissioner filed his further submissions on 18 September 2025. In relevant summary, the Commissioner submits that: a. Disclosure of the withheld information to a member of the public otherwise than under EIR would contravene the first data protection principle (personal data must be processed lawfully, fairly and in a transparent manner). b. Article 6(1)(c) UK GDPR is irrelevant in this case because the processing sought by the Appellant is disclosure to the world at large under EIR, and a public authority cannot rely on EIR as the legal obligation to which they are subject, given that Regulation 13(2A) provides for disclosure “otherwise than under these Regulations…”.

47. The Appellant filed responsive submissions on 30 September 2025. In relevant summary, the Appellant submits that: a. Article 6(1)(c) UK GDPR relates to the Council’s obligation under s69(1) TCPA to keep the planning register available for inspection by the public at all reasonable hours. b. Nothing submitted by the Council justified redaction of particulars in the planning application form to be viewed on the planning register. c. Nothing in the planning legislation provides for redaction of the limited personal details referred to in the prescribed application form. d. Any notion that UK GDPR overrides s69 TCPA is scotched by paragraphs 5(1) and 1(b) of Schedule 2, DPA. e. The Council may decide what to redact from a planning application form on its website, but what must be placed on the planning register is a legal requirement. f. The Council’s legal obligation under s69(1) TCPA is what engages consideration of an Article 6(1)(c) UK GDPR obligation, rather than any obligation to disclose information pursuant to EIR. g. The owner of a relevant part of the land is a corporate body, and its name is not personal data. That data should not be redacted.

48. Having joined the Council as a respondent to the appeal, and having obtained the further submissions described above, we are satisfied that we can properly determine the appeal without a further hearing. Analysis

49. Save in relation to one item of the withheld information, which we address below, we find that all the withheld information is personal data within the meaning of DPA. Statutory provisions governing the submissions of planning applications

50. To determine the legal basis for processing the withheld information for which the Appellant contends, it is necessary to consider the relevant statutory provisions governing the submission and processing of planning applications.

51. S69 TCPA (Part III: Control over development: publicity for applications) provides as follows: “69Register of applications etc (1) The local planning authority must keep a register containing such information as is prescribed as to— (a) applications for planning permission; … (3) A development order may require the register to be kept in two or more parts. (4) Each part must contain such information as is prescribed relating to the matters mentioned in subsection (1)(a), …. (5) A development order may also make provision— (a) for a specified part of the register to contain copies of applications or requests and of any other documents or material submitted with them; (b) for the entry relating to an application or request (and everything relating to it) to be removed from that part of the register when the application (including any appeal arising out of it) or the request (as the case may be) has been finally disposed of. (6) Provision made under subsection (5)(b) does not prevent the inclusion of a different entry relating to the application or request in another part of the register. (7) The register must be kept in such manner as is prescribed. (8) The register must be kept available for inspection by the public at all reasonable hours. (9) Anything prescribed under this section must be prescribed by development order.

52. Article 7 of the 2015 Order sets out general requirements for applications for planning permission: “General requirements: applications for planning permission including outline planning permission

7. —(1) Subject to paragraphs (3) to (5), an application for planning permission must— (a) be made in writing to the local planning authority on a form published by the Secretary of State (or a form to substantially the same effect); (b) include the particulars specified or referred to in the form; (c) except where the application is made pursuant to section 73 (determination of applications to develop land without conditions previously attached) or section 73A(2)(c) (planning permission for development already carried out) of the 1990 Act or is an application of a kind referred to in article 20(1)(b) or (c), be accompanied, whether electronically or otherwise, by— (i) a plan which identifies the land to which the application relates; (ii) any other plans, drawings and information necessary to describe the development which is the subject of the application; (iia) the information relating to the condition under paragraph 13 of Schedule 7A to the 1990 Act (“the biodiversity gain condition”) specified in paragraph (1A); (iii) except where the application is made by electronic communications or the local planning authority indicate that a lesser number is required, 3 copies of the form; and (iv) except where they are submitted by electronic communications or the local planning authority indicate that a lesser number is required, 3 copies of any plans, drawings and information accompanying the application. … (2) Any plans or drawings required to be provided by paragraph (1) or (1A) must be drawn to an identified scale and, in the case of plans, must show the direction of North. (3) Except where article 5(3) applies, an application for outline planning permission does not need to give details of any reserved matters. … (6) Where an application is made using electronic communications to transmit a form to the local planning authority, the applicant is taken to have agreed— (a) to the use of such communications by the local planning authority for the purposes of the application; (b) that the applicant's address for those purposes is the address incorporated into, or otherwise logically associated with, the application; and (c) that the applicant's deemed agreement under this paragraph subsists until the applicant gives notice in writing of the withdrawal of consent to the use of electronic communications under article 46.”

53. Article 40 of the 2015 Order provides: “40Register of applications and biodiversity gain plans … (2) Each local planning register authority must keep, in two parts, a register (“the register”) of every application for planning permission relating to their area. (3) Part 1 of the register must contain in respect of each such application and any application for approval of reserved matters made in respect of an outline planning permission granted on such an application, made or sent to the local planning register authority and not finally disposed of— (a) a copy (which may be photographic or in electronic form) of the application together with any accompanying plans and drawings; (b) a copy (which may be photographic or in electronic form) of any planning obligation or section 278 agreement proposed or entered into in connection with the application; (c) a copy (which may be photographic or in electronic form) of any other planning obligation or section 278 agreement entered into in respect of the land the subject of the application which the applicant considers relevant; and (d) particulars of any modification to any planning obligation or section 278 agreement included in Part 1 of the register in accordance with sub-paragraphs (b) and (c). (4) Part 2 of the register must contain, in respect of every application for planning permission relating to the local planning register authority's area— (a) a copy (which may be photographic or in electronic form) of— (i) the application; (ii) the plans and drawings submitted in relation to the application; (iii) any accompanying design and access statement provided in accordance with article 9; and (iv) any accompanying fire statement provided in accordance with article 9A; (b) particulars of any direction given under the 1990 Act or this Order in respect of the application; (c) the decision, if any, of the local planning authority in respect of the application, including details of any conditions subject to which permission was granted, the date of such decision and the name of the local planning authority; (d) the reference number, the date and effect of any decision of the Secretary of State in respect of the application, whether on appeal or on a reference under section 77 of the 1990 Act (reference of applications to Secretary of State); (e) the date of any subsequent approval (whether approval of reserved matters or any other approval required) given in relation to the application; (f) a copy (which may be photographic or in electronic form) of any planning obligation or section 278 agreement entered into in connection with any decision of the local planning authority or the Secretary of State in respect of the application; (g) a copy (which may be photographic or in electronic form) of any other planning obligation or section 278 agreement taken into account by the local planning authority or the Secretary of State when making the decision; and (h) particulars of any modification to or discharge of any planning obligation or section 278 agreement included in Part 2 of the register in accordance with sub-paragraphs (f) or (g) or paragraph (6). … (7) The register must also contain the following information in respect of every application for a certificate under section 191 or 192 of the 1990 Act (certificates of lawfulness of existing or proposed use or development) relating to the authority's area— (a) the name and address of the applicant; (b) the date of the application; (c) the address or location of the land to which the application relates; (d) the description of the use, operations or other matter included in the application; (e) the decision, if any, of the local planning authority in respect of the application and the date of such decision; and (f) the reference number, date and effect of any decision of the Secretary of State on an appeal in respect of the application.” The Application

54. In this case, the Application bears the Council’s heading. At the start of the Application these words appear: “Publication of applications on planning authority websites Please note that the information provided on this application form and in supporting documents may be published on the Authority's website. If you require any further clarification, please contact the Authority's planning department.”

55. The Application reads relevantly for current purposes, as follows: a. Under a heading “Site Location”, the address of the site which is subject of the proposed development is provided (although we understand that the Appellant says that there is an error in the address). b. Under a section headed “Applicant Details”, the following appear: i. In a sub-section headed “Name/Company”, the name of an individual followed by the name of a limited company. An address, by implication that of the company, is also provided. ii. Next a question “Are you an agent acting on behalf of the applicant”, to which the answer “Yes” has been provided. iii. Then, under a sub-section headed “Contact details”, which reads back to the agent who has confirmed they are acting on behalf of the applicant, redacted primary and/or secondary numbers and a redacted email address. c. Under a section headed “Agent Details” appears the name of an individual (the agent), above the business name and address of a firm or company of architects (“[name of individual] Architects”). It is evident that the primary and/or secondary numbers and email address of that individual or their business are those included in the “Contact details” section we have already described. d. Under a section headed “Ownership Certificates and Agricultural Land Declaration” appears the following wording: “Certificates under Article 14 – Town and Country Planning (Development Management Procedure) (England) Order 2015 (as amended) Please answer the following questions to determine which Certificate of Ownership you need to complete: A, B, C or D.” e. The agent has confirmed that the applicant is not the sole owner of all the land to which the application relates. f. In response to a question “Can you give appropriate notice to all the other owners/agricultural tenants? (Select ‘Yes’ if there are no other owners/agricultural tenants), the agent has selected the answer Yes. g. Under a section headed “Certificate of Ownership – Certificate B” appears this wording, of which the agent has selected to certify the first option: “I certify/ The applicant certifies that: I have/The applicant has given the requisite notice to everyone else (as listed below) who, on the day 21 days before the date of this application, was the owner and/or agricultural tenant of any part of the land or building to which this application relates; or The applicant is the sole owner of all the land or buildings to which this application relates and there are no other owners and/or agricultural tenants.” h. There then appears provision for the names of two “Owner/Agricultural Tenant[s]”. Their names, but not their addresses, are redacted.

56. At the end of the Application, these words appear: “Declaration I / We hereby apply for Full planning permission as described in this form and accompanying plans/drawings and additional information. I / We confirm that, to the best of my/our knowledge, any facts stated are true and accurate and any opinions given are the genuine options of the persons giving them. I / We also accept that: Once submitted, this information will be transmitted to the Local Planning Authority and, once validated by them, be made available as part of a public register and on the authority's website; our system will automatically generate and send you emails in regard to the submission of this application.”

57. The Council explains that the process for submitting an application is as follows: a. the Ministry of Housing, Communities and Local Government provides a template application form which is commonly used by a Local Planning Authority (“the LPA”). b. The Government provides online guidance on making an application. The Government recommends a form by which to make the application. c. The form is submitted to the planning portal, which we understand to be an online platform owned by Portal Plan Quest Limited, a joint venture between the government and Terra Quest Solutions Limited. The planning portal enables submission of electronic planning applications, providing downloadable forms. d. The planning portal contains a privacy statement, including these words: “Please note that with the exception of the applicant contact details (telephone numbers and email addresses), all the information you provide on the application form and in any accompanying documents may be published on the website of the local authority dealing with your application. To avoid the publication of personal details, do not include them, or any other information which falls within the definition of personal data under the Data Protection Act 1998, in documents supporting your application.”

58. The Council refers in support of its position to guidance produced by the Planning Advisory Service in June 2021 which sets out industry practice (“the Guidance”): “For example, the publication on an LPA’s website of individuals’ names and addresses in connection with planning applications is required by article 40 of the [2015 Order] (for more details see Appendix 2); in contrast, the publication of their email addresses, signatures and telephone numbers is likely to be excessive to the task.”

59. The Council goes on to say that the Guidance qualifies the statement to publication of individuals’ names and addresses as follows: “More accurately Article 40 requires names and addresses only for certificates of lawfulness. The decision to publish names and addresses on the statutory register of planning applications is for the Council to take.”

60. We note that the Guidance is not statutory guidance. It is a publication by the Planning Advisory Service. It is not binding on the Council. The Planning Advisory Service has no law-making function. Nevertheless, we understand that, as a matter of practice, planning authorities across the United Kingdom adhere to the Guidance to attempt compliance with UK GDPR.

61. We note that the Application warns not once but twice, at its start and its end, of the prospect of publication of the information in the form. At its start, it says that the information may be published on the Council’s website. At its end, it says, and requires the applicant to accept, that once submitted, the information will be transmitted to the LPA and, once validated by the LPA, will be made available as part of a public register and on the authority's website.

62. We have seen nothing to suggest that “validation” means that personal data will be extracted from the application before publication or being placed on the planning register. In our view, the natural and ordinary meaning of that word, as would be understood by an applicant and/or their agent, is that the LPA will check that all the essential information and supporting documents have been supplied. If they have, the LPA will accept it as a valid application. If they have not, presumably the LPA will contact the person submitting the application to obtain what is required.

63. The Council submits that the planning register contains the planning application and that the Council has complied with Article 6(1)(c) UK GDPR in discharging its obligations as an LPA pursuant to s69 TCPA and the 2015 Order. We do not find this submission easy to understand but we believe the Council to be saying that in placing the redacted Application on the planning register, the Council has discharged both its obligations under s69 TCPA and the 2015 Order (to place details of the requested planning permission on the planning register) and its obligations under UK GDPR not to process personal data unless required to by an enactment.

64. The Council seeks to bolster its submission by comparing the instant case with Article 40(7) of the 2015 Order and ss191 and 192 TCPA: Article 40(7) of the 2015 Order expressly requires that in respect of an application for a certificate pursuant to s191 (lawfulness of existing use or development: “ a CLEUD”) or s192 (lawfulness of proposed use or development: (“a CLOPUD”) TCPA, the planning register must also contain the name and address of the applicant.

65. The Council explains that there is no statutory requirement to consult third parties in relation to applications for a CLEUD or CLOPUD, given that the decision to be taken by the LPA must be based on evidence and the law. Applications for a CLEUD or CLOPUD are not made through the planning portal.

66. The Council suggests that that distinction is telling, because in contradistinction to the position under Article 40(3) and (4) of the 2015 Order, (1) there exists an express lawful requirement to disclose personal data and, (2) use of the word “also” is additive to that which is required to be included in the planning register in relation to an application which is not for a CLEUD or a CLOPUD. s69(1) TCPA and Articles 7(1) and 40 of the 2015 Order

67. We start by observing that the fact that the form for the Application in this case indicated variously that “the information” in the form might be published on the Council’s website, and would be made available as part of a public register and on the Council's website, is not determinative of the proper interpretation of s69(1) TCPA and Articles 7(1) and 40 of the 2015 Order. That exercise is to be undertaken by reference to the legislative provisions alone.

68. S69(1) TCPA requires the Council to keep a register containing such information as is prescribed as to applications for planning permission by the 2015 Order.

69. Article 7(1)(a) of the 2015 Order requires an application for planning permission to be made on a form published by the Secretary of State or a form to substantially the same effect.

70. Article 7(1)(b) of the 2015 Order requires the application to include the particulars specified or referred to in the form.

71. The Appellant’s case effectively proceeds on the basis that a planning application and the form by which a planning application is made are, or should be regarded as, one and the same thing, with the result that everything that is included in the form constitutes the application and, if not the form, then at least the entirety of the contents of the form, must be included on the planning register. We disagree.

72. In our view, a natural reading, and the correct interpretation, of Articles 7(1)(a) and (b) taken together, is that the form is simply the mechanism by which the application itself is made. Inclusion of an applicant’s contact details will be necessary for administrative purposes. The application is itself the request for permission to undertake particularised development or works, and the particulars may be variously presented, for example, in writing, diagrammatic, pictorial or photographic form.

73. S69(1)(a) TCPA requires the keeping of a register containing “such information as is prescribed as to “applications for planning permission”. The focus of s69(1) TCPA is the application itself, being the request for permission we have described. S69(1) TCPA makes no reference to a form.

74. We accept that Article 40(3) provides that Part 1 of the planning register must contain in respect of each application “(a) a copy (which may be photographic or in electronic form) of the application together with any accompanying plans and drawings; …” but we do not accept that that means a copy of the application form, or all its contents. Article 40(3) makes no reference to a form, only what is required on the planning register: a copy of the application, which, as we have found, is the requested permission for particularised development or works. The copy that is referenced in Article 40(3) is the copy of the particulars.

75. We note that Article 40(7) of the 2015 Order expressly requires that in respect of an application for a certificate pursuant to s191 TCPA (CLEUD) or s192 TCPA (CLOPUD), the planning register must also contain the name and address of the applicant, and that there is no such requirement in relation to an application of the type in issue in this case.

76. However, we derive limited assistance from that distinction, where in the application in issue in this case, the Council has in any event disclosed the name and address of the applicant and their agent, albeit we assume that those names and addresses are provided in corporate capacities, and where the Council has not explained why the legislation provides as it does in relation to a CLEUD or CLOPUD. Even in the case of Article 40(7), however, there is no requirement to place a copy of the form or all its contents on the planning register.

77. For the reasons we have given, we conclude that s69(1) TCPA does not oblige the Council to place the Application, that is to say, the entire form including all personal data contained in the form, on the planning register.

78. In those circumstances, processing personal data within the withheld information by that means, that is to say, “otherwise than under [EIR]”, is not necessary for compliance with a legal obligation to which the Council is subject thus satisfying Article 6(1)(c) UK GDPR. Disclosure of the information on the planning register would not constitute lawful processing within the meaning of Article 5(1)(a) UK GDPR read with Article 6(1)(c) UK GDPR.

79. Accordingly, we find that the Council is entitled to refuse to disclose that part of the withheld information which constitutes personal data to the Appellant pursuant to Regulation 13(1)(a) EIR.

80. In our view, a small part of the withheld information, namely the name of the second stated owner of the site subject of the Application, is not personal data. It is not an individual. The Council is not entitled to refuse disclosure of that information in reliance on Regulation 13(1) EIR. Conclusion

81. The Commissioner decided that the Council has correctly relied on Regulation 13(1) EIR to withhold the requested information. He did so by reference to the requirements for lawful processing under Article 6(1)(f) UK GDPR.

82. By his Notice of Appeal, the Appellant raises only a complaint that the Commissioner should have considered, but failed to consider, Article 6(1)(c) UK GDPR as providing a lawful basis for disclosure. The Appellant does not take issue with the Commissioner’s analysis of the position by reference to Article 6(1)(f) UK GDPR. We do not, therefore, address that analysis.

83. For the reasons we have given, we find that Article 6(1)(c) UK GDPR does not provide a lawful basis for disclosure. To that extent, the appeal must fail.

84. However, a small part of the withheld information is not personal data. To that extent only, the appeal must succeed. Accordingly, we issue the substituted decision notice on the face of this decision.

85. Although the Commissioner analysed matters by reference to Article 6(1)(f) UK GDPR, and this appeal has proceeded by reference to Article 6(1)(c) UK GDPR, we consider that the Commissioner’s ultimate decision (paragraph 2 of the Decision Notice) that the Council has correctly relied on Regulation 13(1) EIR to withhold the requested information is correct, save in relation to a small portion of the withheld information which we have found not to be personal data.

86. We should observe for completeness: the Tribunal has no general jurisdiction to determine the lawfulness of the Council’s conduct as to what information it has placed on the planning register. Signed: Judge FossDated: 1 May 2026