The First-tier Tribunal (General Regulatory Chamber) has dismissed an appeal seeking unredacted disclosure of a planning application form, finding that local planning authorities are not legally obliged to place the entirety of such forms - including personal contact details and owner names - on the statutory planning register.
The FTT ruled that the London Borough of Ealing's reliance on Regulation 13(1) of the Environmental Information Regulations 2004 (EIR) to withhold the personal data contained in a planning application form was vakud, although it also ordered disclosure of one item that it found did not constitute personal data at all.
In Victor Mishiku v The Information Commissioner & London Borough of Ealing [2026] UKFTT 698 (GRC), the appellant had requested an unredacted copy of a planning application form relating to a site in the borough, seeking disclosure of two categories of information: the telephone numbers and email address of the applicant's agent and architect (whose name and business address were already unredacted); and the names of two persons or entities identified on the application as owners of the site.
The Council refused, relying on Regulation 13(1) EIR on the basis that the information was third party personal data. The Information Commissioner upheld that refusal by reference to Article 6(1)(f) UK GDPR, concluding that disclosure of the personal data was not necessary to meet the appellant's legitimate interest, as the application was already publicly available in redacted form.
The appellant appealed, raising a ground which the Commissioner had not addressed: that Article 6(1)(c) UK GDPR (processing necessary for compliance with a legal obligation) provided a lawful basis for disclosure, because section 69 of the Town and Country Planning Act 1990 (TCPA) and Article 40 of the Town and Country Planning (Development Management Procedure) (England) Order 2015 require the planning register to be kept available for public inspection and to contain a copy of every planning application. On the appellant's case, planning law mandated publication of the entirety of the application form, including all personal data within it, and the Council's practice of redacting contact details and owner names was therefore unlawful.
The Tribunal - Tribunal Judge Foss, Tribunal Member de Waal and Tribunal Member Shaw - rejected that argument, drawing a distinction that the planning application form and the planning application itself are not the same thing. The form is the mechanism by which an application is submitted; the application is the request for permission to carry out particularised development or works.
Section 69(1) TCPA requires the register to contain "such information as is prescribed as to applications for planning permission" and makes no reference to a form. Similarly, Article 40(3) of the 2015 Order requires "a copy of the application" to be included in Part 1 of the register but, in the Tribunal's view, that means a copy of the particulars of the proposed development, not a copy of the application form or all its contents.
The Tribunal also noted that Article 40(7) of the 2015 Order expressly requires the planning register to include the *name and address of the applicant* in relation to applications for certificates of lawfulness under sections 191 and 192 TCPA (CLEUDs and CLOPUDs). No equivalent express requirement exists for standard planning permission applications of the kind in issue. The Tribunal found that distinction informative, albeit of limited assistance on the particular facts of this case.
Having concluded that the Council was not legally obliged to publish the full contents of the application form, the Tribunal found that Article 6(1)(c) UK GDPR was not engaged as a lawful basis for disclosure. The Council's reliance on Regulation 13(1) EIR to withhold the personal data was upheld, and the appeal dismissed to that extent.
The appeal succeeded on one narrow point. The Tribunal found that the name of the second stated owner of the site, as recorded on the application, was not personal data within the meaning of the Data Protection Act 2018, because it identified a corporate entity rather than a living individual. The Council was not entitled to rely on Regulation 13(1) EIR to withhold it. A substituted decision notice was issued requiring the Council to provide that name to the appellant within 35 days of promulgation.
The decision provides useful clarification for local planning authorities on the scope of their obligations under the planning register regime and the interaction of those obligations with UK GDPR.
It confirms that the statutory duty to keep a planning register available for public inspection does not require councils to publish the entirety of application forms, and that the common practice of redacting personal contact details - telephone numbers, email addresses and signatures - from publicly available copies is not unlawful. The Tribunal noted that Planning Advisory Service guidance, which advises that publishing such details is "likely to be excessive", is widely followed across the sector, while making clear that the guidance carries no binding legal force.
The decision also confirms that the name of a corporate body appearing on a planning application form does not constitute personal data and cannot be withheld on data protection grounds.
