The First-tier Tribunal (General Regulatory Chamber) has dismissed an Environmental Information Regulations appeal brought by a resident seeking to establish whether Lambeth Council had written to the owner of a neighbouring property in the weeks before an arson attack on his home, finding that the privacy rights of the property owner outweighed the appellant's legitimate interests in disclosure.
In Roger Wood v The Information Commissioner [2026] UKFTT 00784 (GRC), determined on the papers on 2 June 2026, the Tribunal upheld Lambeth Council's neither confirm nor deny (NCND) response under regulation 13(5A)(a) of the Environmental Information Regulations 2004, concluding that even confirming whether correspondence had been sent would disclose personal data of the property owner in a manner that could not be justified under Article 6(1)(f) UK GDPR.
The Council had issued a planning enforcement notice against the owner of a neighbouring property in 2021 for installing a driveway without planning permission, and had subsequently refused a retrospective planning application. Mr Wood had been in extensive contact with the Council over the enforcement matter, but the situation escalated significantly: he informed the Council that in August 2024 his vehicle was damaged, and on 11 April 2025 his property was subjected to arson, which the Metropolitan Police were investigating.
Mr Wood sought confirmation under the EIR of whether the Council had sent any written communications to the owner of the neighbouring property between 19 March and 11 April 2025 (the period immediately preceding the arson attack) in connection with the planning enforcement case. He was not requesting the content of any personal data, but simply asked whether such correspondence existed and, if so, for a copy with appropriate redactions, consistent with disclosures the Council had previously made in the same matter.
The Council treated the requests under the EIR and relied on regulation 13(5A)(a) to issue an NCND response. The Information Commissioner upheld that position, finding that even confirming whether correspondence had been sent amounted to disclosure of the property owner's personal data, and that the particular circumstances of the request, including the live arson investigation, heightened rather than diminished the reasonable expectation of non-disclosure.
The Tribunal agreed that a confirmation would reveal personal data. It found that, given the enforcement history, a reasonable inference from any confirmation would be that the Council was at least considering further action against the owner, potentially including prosecution for non-compliance with the enforcement notice or the exercise of default powers — information with the owner clearly as its focus.
Applying the three-stage legitimate interests test under Article 6(1)(f) UK GDPR, the Tribunal accepted that Mr Wood had genuine legitimate interests: both in understanding whether the Council was taking steps to enforce planning law against his neighbour, and in understanding the circumstances in the weeks leading up to the arson attack on his property. It found that disclosure was reasonably necessary for those purposes.
However, the Tribunal drew a clear distinction when it came to the wider arguments advanced in support of disclosure. It declined to find that there was a sufficiently general public interest in disclosure. It noted that there are other means of holding a council to account, including formal complaints and recourse to the Local Government Ombudsman. On the police investigation, it observed that the police have their own powers to obtain relevant evidence from the Council and that it was not reasonably necessary to disclose correspondence to the world at large for the purposes of the criminal inquiry.
Turning to the balancing exercise, the Tribunal found that the property owner's rights and freedoms prevailed. While the information was not criminal offence data, confirmation that correspondence had taken place in the relevant period would give rise to a reasonable inference that prosecution or enforcement default powers were being considered — engaging a particularly strong expectation of privacy. Taking into account the sensitivity of that inference, the absence of a sufficiently general public interest in disclosure, and the availability of police investigative powers, the Tribunal concluded that the legitimate interests in confirmation were outweighed by the fundamental rights and freedoms of the data subject. The appeal was accordingly dismissed.
