The Court of Appeal provides guidance on the date when environmental information is “held” by public authorities under the Environmental Information Regulations

The Court of Appeal in Information Commissioner and another v O’Hanlon [2026] EWCA Civ 838 has found that the duty to disclose environmental information only applies to information held at the date of the request, and further that the exception to disclosure in reg 12(4)(a) of the Environmental Information Regulations 2004 (“EIR”) (where a public authority does not “hold” the environmental information requested) is to be applied as at the time of the initial request, not the time of the authority’s refusal or subsequent reg 11 review.

This clarifies that where an authority comes into possession of the relevant environmental information after the request for that information has been refused, the authority is not under a duty to disclose it.

Background

EIR imposes a duty on public authorities to make environmental information they hold available on request: reg 5(1). However, an authority may refuse to do so where: (a) a relevant exception applies and (b) in the circumstances, the public interest in maintaining the exception outweighs the public interest in disclosure: reg 12(1). One such exception is where the authority “does not hold that information when an applicant’s request is received”: reg 12(4)(a).

EIR has an inbuilt review process whereby if an applicant considers that an authority has failed to comply with EIR requirements it can make representations to the authority who then must decide whether it has complied with the requirement: reg 11.

But what happens when a public authority has, since refusing the initial request because it did not “hold” the relevant environmental information (i.e. the exception in reg 12(4)(a)), subsequently come to hold such information and is now conducting a review under reg 11? Is the authority’s assessment of whether the information is “held” to be assessed at the time of the initial request or its subsequent review? Is the public authority required to disclose that information?

The decision

The Court of Appeal (Holgate LJ, with whom Lewison LJ and Dove LJ agreed) held that whether information is “held” – for the purposes of reg 5(1) generally, but also when applying the reg 12(4)(a) exception – is to be assessed as at the time of the initial request, overturning the Upper Tribunal’s decision that these matters fell to be assessed as at the date of the internal review.

The Court considered this approach aligned with the natural reading of EIR and Directive 2003/4/EC. While the heading to reg 11 contained the word “reconsideration”, in substance it provided for a process of review which was tied to the previous request, not a fresh determination. In the Court’s view, reg 11 could not be read as imposing an obligation of continuing disclosure in respect of the EIR requirements it applied to.

Several aspects of the Court’s reasoning are notable.

First, the Court was careful to limits its analysis to reg 12(4)(a) and did not express a view on the timing of the other exceptions in regs 12(4) and (5). However, the Court’s generalised comments that reg 11 does not impose a continuing duty of disclosure or allow for fresh reconsideration is indicative that it would have likely taken a similar approach to the other exceptions as applies under FOIA – namely that the relevant time is the point of the public authority’s refusal (in which case reg 12(4)(a) would be unique in being applied at the date of the request).

Second, the Court left open how the public interest test in reg 12(b) applies to the exception in reg 12(4)(a) and whether this might impact questions of timing. Guidance on this would have been useful, as it is unclear how the public interest in disclosing the information can be assessed in circumstances where the authority does not hold the information in the first place. Presumably, the public interest test is effectively a dead letter in these circumstances.

Third, the Court did not comment on the curiosity that, on its reading of regs 5 and 12(4)(a), the exception in reg 12(4)(a) only appears to apply in circumstances where a duty under reg 5 would not arise in the first place (i.e. because information is not held at the time of the request). While this may be a necessary result of reg 12(4)(a)’s drafting, the Court did not appear to be concerned by this somewhat unusual outcome.

Peter Lockley appeared for Mrs O’Hanlon.

 

 

Representative Actions under the UK GDPR

Nestled among the well-known remedial provisions of the UK GDPR and DPA 2018 are Article 80 and section 187. These provisions enable data subjects to authorise a representative body to act on their behalf by exercising their rights under Articles 79 and 82 UK GDPR. Good Law Project’s claim against the Reform Party is the first claim brought under these provisions. The judgment in Reform’s strike out and/or summary judgment application, Good Law Project Ltd v Reform UK Part Ltd [2026] EWHC 1458 (KB), is therefore notable for being the first judicial consideration of the regime for representative data actions. Continue reading

AI and Policing: Thompson

It has been more than five years since the Courts last discussed the use of AI in public decision-making.  That was in R (Bridges) v Chief Constable of South Wales Police (Information Commissioner and others intervening) [2020] 1 WLR 5037).  In the universe of AI, five years is a mind-bendingly long time. Can we even remember a time before hallucinated authorities and lonely teenagers falling in love with chatbots?   Many of us have been waiting with bated breath for the next word on how the Administrative Court will constrain public authorities’ use of AI.

After that long wait, we have been given R (Thompson and Carlo) v Commissioner of Police for the Metropolis [2026] EWHC 915 (Admin).

Continue reading

Russian bots and the expansion of human rights law to keep pace with tech

When will the Courts extend human rights law principles in order to keep up with emerging technology?  The Strasbourg Court gave us some answers in Bradshaw & Others v United Kingdom (app no. 15653/22) .  However, they may not have been the last word, because this week, the Applicants have sought a referral to the Grand Chamber.

The claim

A group of MPs argued that the Government was not doing enough to combat Russian interference in UK elections, including in the 2019 general election.  They were concerned with credible allegations that Russia had engaged in deliberate cyber-attacks against election infrastructure, “hack and leak” operations, and the use of “cyber troops” and “troll farms” to manipulate public discourse and to sow discord between social groups.

Continue reading

Panopticon Podcast Returns! Data Protection and the Public Sector (feat. Christopher Knight)

Panopticon is pleased to announce the return of its auditory offering, the Panopticon Podcast.  Episode 5 sees (or, rather, hears) Christopher Knight sharing his estimable experience and insight on the intersection between public law and data protection.

How can you use data protection arguments in judicial review without irritating judges or sending them to sleep? How to regulate data protection issues in the public sector without encroaching on other public authorities’ functions? Fresh from his readeption to his rightful place as Public Law Junior of the Year 2025 (having first ascended in 2022), Christopher answers these questions and more, and vaticinates where and how public lawyers may seek to deploy data protection arguments in the coming years.

You can listen and subscribe on all the usual platforms, including AppleSpotifyPodcast Index and Podcast Addict.

Cumulative Public Interest Exemptions in the Supreme Court

Section 1(1)(b) of the Freedom of Information Act 2000 (“FOIA”) creates the right to have information held by a public authority communicated to a requestor. But as night follows day, this is not an absolute right. Part II of the Act sets out a series of exemptions to the right in section 1(1)(b). Some of these are absolute exemptions. Others are qualified. Section 2(2)(b) FOIA provides as follows:

(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that–

                        …

(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

This is the public interest balancing test. But what if a public authority relies on more than one qualified exemption? This was the issue in Department for Business and Trade v Information Commissioner [2025] UKSC 27. Where information falls within multiple qualified exemptions in the FOIA, does section 2(2)(b) require the public interest in maintaining each of those exemptions to be aggregated (“the cumulative approach”), or does it require the public interest in maintaining each exemption to be considered separately (“the independent approach”)? Continue reading