The data was “personal data” within the definition in s.1(1) of the DPA and s.40(7) of FOIA because the Disputed Information related to individuals who could be identified, if not from the data itself, then from the data used in conjunction with other publicly available information. In determining whether information which related to a group constituted ‘personal data’ of any individuals within that group, although the size of the group was an important factor, it was not the determining factor; other features such as the homogeneity of the group might lead to individuals within that group being identifiable. Given that the identities of individuals living at a given post code can be readily identified from public sources such as electoral rolls, that each post code requested contained a relatively small number of licensable premises, and that the post codes shared the common feature of a degree of connection with the royal family, the individuals concerned could be identified by a person motivated to do so – applying the ICO’s “motivated intruder test” set out its Code of Practice on Anonymisation.
Disclosure would breach the first data protection principle, which requires that personal data be processed fairly and lawfully and shall not be processed unless at least one of the conditions in Schedule 2 is met. The relevant condition in this case – condition 6(1) – effectively required a balancing exercise between on the one hand the “legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed” which made the processing “necessary”, and on the other any “prejudice to the rights and freedoms or legitimate interests of the data subjects”.
In this case, the balance would be struck in favour of the data subjects. Television licence holders who obtain (or who choose not to obtain) licences in their private capacities would have a reasonable expectation of privacy in that regard, and would not expect that information to be disclosed to the world at large by the licence provider. As there was no evidence before the Tribunal that residents in palace accommodation were failing to pay for television licences, or that the BBC was failing actively to pursue them because of their links to the Monarch, there was no legitimate interest in disclosure beyond the generic interest in public accountability. Disclosure could not be said to be “necessary” for any such interest as there may be.
Even if there was a legitimate interest and disclosure was necessary for such purposes, disclosure would be an unwarranted intrusion into the data subjects’ privacy. The Disputed Information would reveal not only those who had a television set but no licence, but also those who did have licences, and those who were not required to have a licence because they did not have a television set. The media interest that may have followed disclosure, as well as the distress likely to be caused to the data subjects at having their personal data disclosed, were further reasons why disclosure would be unwarranted.