Clients often come to me frustrated because a public authority has refused to disclose information. Their first instinct is usually to submit a Freedom of Information request or rely on other possible legislation such as environmental information laws. Sometimes that works. But sometimes the issue isn’t transparency at all, it’s data protection. A recent tribunal decision, Parker v The Information Commissioner [2026] UKFTT 339 (GRC), provides a useful reminder of the difference.
From a data protection solicitor’s perspective, the case highlights an important but often misunderstood point: if you are asking for information about yourself, the correct route is usually a Subject Access Request — not FOI or other legislation in respect of the provision of publicly available data such as the Environmental Information Regulations.
The background to the case
The case arose after a homeowner experienced flooding at her property following a severe weather event in November 2023. She believed the local authority was responsible because a drain had allegedly not been maintained/cleaned properly.
In January 2024, she asked the council for:
“All internal flooding investigations and reports following flooding event at [her address].”
The council initially refused the request, arguing the information could be accessed through litigation procedures, as there was live insurance litigation about the incident on foot. During the investigation by the Information Commissioner’s Office, the council changed its position and instead relied on provisions within the Environmental Information Regulations (EIR).
However, the ICO ultimately concluded something more fundamental: the requested report was the requester’s own personal data.
Why the request failed under environmental information law
Under the EIR, public authorities must normally disclose environmental information they hold upon request unless there are exemptions that exclude disclosure.
But there is a key limitation.
Where the information requested constitutes the requester’s own personal data, the duty to disclose under EIR does not apply. Instead, the individual must rely on their rights under data protection legislation. This is set out in Regulation 5(3) of the EIR.
The tribunal agreed with the ICO that the internal flooding report clearly related to the claimant and her property. Because she could be identified and the information had “biographical significance” for her, it qualified as personal data under the Data Protection Act 2018.
As a result, the council was not required to disclose the report through the environmental information regime.
The appeal was therefore dismissed.
The key lesson: not all information requests are the same
This case highlights a common mistake.
People often assume that the Freedom of Information Act or Environmental Information Regulations are the best way to obtain documents from a public body.
But those regimes are designed for public transparency, i.e. disclosure to the world at large.
By contrast, where the information is about you personally, the correct legal route is usually a Subject Access Request under the UK GDPR and the Data Protection Act 2018.
In practical terms, that difference matters.
A Subject Access Request:
- gives individuals a specific right to obtain their personal data;
- is governed by a different set of legal rules; and
- may still be subject to exemptions (for example legal professional privilege).
Indeed, in this case the council later considered the request as a Subject Access Request and sought to rely on legal professional privilege, as the report had been prepared in connection with an insurance claim.
Another important point: what the tribunal could not do
The claimant also asked the tribunal to:
- award compensation;
- force the council to admit wrongdoing; and
- order regular drain inspections.
However, the tribunal made it clear that its powers in information rights cases are limited.
Its role is simply to decide whether the decision of the Information Commissioner’s Office was lawful. It cannot determine civil liability or order compensation.
Those issues would need to be pursued through different legal routes.
Why getting the legal route right matters
From a practitioner’s perspective, this case is a good example of how procedural mistakes can delay access to information.
If the request had been framed correctly as a Subject Access Request from the outset, the process might have been far more straightforward.
Unfortunately, individuals often spend months navigating the wrong legal framework before the issue is properly identified.
For businesses, public bodies and individuals alike, understanding the distinction between:
- Freedom of Information requests;
- Environmental Information requests; and
- Subject Access Requests,
can save a significant amount of time, cost and frustration.
How can we help?
Kevin Modiri is a Partner in our expert Dispute Resolution team, specialising in civil disputes, insolvency, inheritance disputes, data breach claims and defamation claims.
If you want to discuss a subject access request further or need advice about something similar, please do not hesitate to contact Kevin or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.
Contact usIf this article relates to a specific case/cases, please note that the facts of this case/cases are correct at the time of writing.