ICO decision confirms Open Government Licence is insufficient for open re-use of Energy Performance of Buildings data

Download: 20220418-20230427 re-use request for EPC data [DLUHC ref EPC-E221].zip (0.9 MB)

Recap of earlier episodes

The Department for Levelling Up, Housing & Communities (DLUHC) publishes Energy Performance of Buildings Data for England and Wales at epc.opendatacommunities.org.

The majority of the data is from the 24 million or so domestic EPCs that have been lodged on the public register. The data contains EPC ratings for residential properties, along with a multitude of building attributes related to energy efficiency.

Ostensibly, the EPC data is available for re-use as open data under the Open Government Licence (with the exception of the address and postcode fields, which are subject to more restrictive Royal Mail terms).

However, DLUHC also maintains that address-level EPC data is personal data.

As I highlighted in an earlier blog post, this creates a problem for re-users. The Open Government Licence specifically excludes "personal data in the Information". Consequently, DLUHC's application of the OGL is not effective to permit re-use of the EPC data.

This problem arises irrespective of whether the EPC data is actually personal data. Either the information is not covered by the OGL because it is personal data, or application of the OGL cannot be construed as permission to re-use the information, because DLUHC (as the copyright holder) maintains that the information is personal data.

Re-use request to DLUHC

In May last year I submitted a request to DLUHC for permission to re-use the Energy Performance of Buildings Data then available (for certificates up to 31 December 2021), excluding the address and postcode fields, under the terms of a different open licence, the Creative Commons Attribution License 4.0 (CC BY). The CC BY licence is similar to the OGL, but does not contain an exemption for personal data.

Obtaining this permission would avoid the difficulty with re-using the data under OGL. However, my underlying objective was to challenge DLUHC's view that the EPC data is personal data. (The RPSI regulations are not ideal for that purpose, but data protection law itself does not provide any recourse.)

Unfortunately, DLUHC refused to engage with my re-use request:

Please note the department is unable to provide legal advice, nor can we provide a definitive interpretation of the law as only the Courts are able to do this. Therefore, it will be for individuals or organisations to take a view on how they are able to use data, be it under the Creative Commons Attribution License or via other routes, and in cases of doubt should seek their own legal advice.

Complaint to ICO

I submitted a complaint to the Information Commissioner's Office (ICO), in its capacity as UK regulator for re-use of public sector information. After some initial back and forth, I received a response letter in January this year.

The view of the ICO's senior case officer was that DLUHC had met the requirements of RPSI. The ICO was prepared to issue a decision notice on that basis.

The case officer maintained that the EPC data – with addresses – was personal data:

The information requested includes the addresses of properties and the energy usage rating of those properties. The owners of those properties will be identifiable in many cases. The information therefore falls within definition of personal data for the purposes of the Data Protection Act 2018 ('the DPA')[.]

and that by his interpretation I wished to re-use the data in an "anonymised" form.

He did not recognise that there was any conflict between DLUHC's data protection notice and licensing of the data under the Open Government Licence, and declined to provide a view on the suitability of CC BY as an alternative:

I note that you have requested to reuse the data under the CC-BY license. This is a form of copyright reuse protection. The Commissioner is not the legal Regulator of this system, and therefore, he is unable to make a decision as to whether the DLUHC should provide you with such a license.

ICO has another think

I wrote back to the case officer, setting out my arguments at greater length. I explained why I did not think the bulk EPC data was personal data, and pointed out that the ICO had written to the Scottish Government in 2013 and 2015 advising that the equivalent data for Scotland was not personal data. (I have blogged about that correspondence in an earlier post.)

I also explained why I thought OGL did not meet the RPSI requirements in this situation, regardless of whether the EPC data was actually personal data or DLUHC only thought it was.

I also clarified that CC BY was not the only acceptable approach available to DLUHC, in my view:

In my request to DLUHC, I proposed use of the Creative Commons Attribution License 4.0 (CC-BY) as an acceptable approach that would permit my re-use of the non-address data. CC-BY is a widely-used open data licence, compatible with the Open Government Licence, that does not exclude personal data. I do not understand your description of CC-BY as a "form of copyright reuse protection". However, for the purposes of handling my complaint, I do not think it is necessary for the ICO to take a view on the suitability of that licence. If it wished, DLUHC could comply with RPSI by simply confirming permission for me to re-use the non-address data without a specific licence or conditions (other than my statutory obligations under data protection law, if applicable).

The case officer said he would seek further advice from the ICO's policy team regarding my arguments, and issue a decision notice in due course.

ICO's decision notice

In March, the ICO served decision notice IC-173007-K0T5. This stated that DLUHC had not complied with the requirements of the RPSI, and required DLUHC to respond to my request "as required by the RPSI" within 35 calendar days.

35 days later, DLUHC wrote to me as follows:

Having considered your request to re-use the Energy Performance of Buildings Data, on the understanding that this permission will not apply to the address and postcode fields in the data, DLUHC gives permission for you to re-use the non-address data under the RPSI Regulations 2015.

Strictly speaking, this is a successful outcome. The ICO has agreed that DLUHC did not handle my re-use request in compliance with the RPSI regs, and DLUHC has confirmed permission for me to re-use the EPC data for my intended purposes without any licensing conditions.

But the ICO decision notice itself is oddly unsatisfactory. I am still not sure the ICO case officer has understood the interaction between RPSI and the OGL:

19. The DLUHC's response did not state that it permitted the complainant to re-use the data under the RPSI. It also did not set out any conditions under which the data may be re-used under the RPSI. Instead, its response referred to rights under the open government licence.

20. The Commissioner has therefore considered whether the DLUHC's response met the requirements for an appropriate refusal of the re-use of the request.

Normally, permission to re-use public sector information under the OGL is the ideal form for compliance with RPSI requirements. It only fails in this case because of DLUHC's claim that the relevant information is personal data.

However, as the decision notice does not set out the reasons for my re-use request, or even mention the data protection conflict, anyone reading the notice in isolation will find it impossible to understand why DLUHC's initial response was not compliant with RPSI.

Next steps

Tacitly, at least, the ICO decision notice is recognition that DLUHC's published licensing terms for the bulk EPC data do not make sense. However, those terms are still in place.

This week I submitted a new request to DLUHC, on the same basis as my earlier request, for permission to re-use the most recent version of the same data.