First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2019/0051V
Before
Judge Stephen Cragg Q.C.
Tribunal Members
Ms Rosalind Tatam
and
Mr Roger Creedon
Heard via the CVP platform on 12 November 2021
BETWEEN:
Wayne Leighton
Appellant
And
The Information Commissioner
Respondent
The Appellant represented himself
The Commissioner was represented by Katherine Taunton
DECISION AND REASONS
1
DECISION
1. The appeal is DISMISSED.
MODE OF HEARING
2. The proceedings were held via the Cloud Video Platform. The parties joined
remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing
in this way
3. The Tribunal considered an agreed open bundle of evidence comprising 105 pages,
some additional papers from the Appellant, skeleton arguments and a bundle of
authorities.
BACKGROUND AND INITIAL DECISION MAKING
4. As long ago as 30 December 2017, the Appellant wrote to North Yorkshire Police
(NYP) and requested information in the following terms:
A covert operation was mounted with me being a target of it in 2015. Please
provide me with the following information.
1. Name of the operation
2. Name(s)/rank(s) of Gold Commander of this operation.
3. Name(s)/rank(s) of Senior Investigating Officer(s).
4. Name / rank of the Handler of the CHIS
5. Cost of the operation
To clarify, my address at the time operation was mounted was [address details
redacted].
5. On 26 January 2018, NYP wrote to the Appellant and refused to confirm or deny
whether that information was held, and cited s40(5)(a)( FOIA. NYP also advised the
Appellant with respect to the subject access provision under the Data Protection Act
1998 (DPA).
2
6. NYP confirmed this decision upon review on 6 April 2018. The Appellant
complained to the Commissioner on 19 April 2018 about the decision neither to
confirm nor deny that the information was held, saying that the information
requested was not personal information as “I have not requested any information
that would allow them to use this clause. It is about public officials and there is no
reason to hold they are exempt”.
THE LAW
7. Under s1(1)(a) FOIA a public authority is obliged to advise an applicant whether or
not it holds the information requested, but this duty to confirm or deny does not
always apply if the public authority can properly rely on one of the exemptions from
the duty in FOIA.
8. Thus section 40 FOIA, materially, reads as follows: -
40.— Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
….
9. This is an absolute exemption, and so where it applies, there is no need to go on to
consider the public interest test: see section 2(3)(f) FOIA. Prior to the
commencement of the DPA 2018 on 25 May 2018, section 40(5) FOIA provided,
materially: -
(5) The duty to confirm or deny—
(a) does not arise in relation to information which is (or if it were held
by the public authority would be) exempt information by virtue of
subsection (1), and
(b) does not arise in relation to other information if or to the extent
that either—
(i) the giving to a member of the public of the confirmation or
denial that would have to be given to comply with section 1(1)(a)
would (apart from this Act) contravene any of the data protection
principles or section 10 of the Data Protection Act 1998 or would
do so if the exemptions in section 33A(1) of that Act were
disregarded, or
3
(ii) …
10. Thus, if the requested information is identified as personal information of the
requester, then not only is the information exempt from disclosure under FOIA, but
the public authority is also exempt from confirming or denying whether it holds the
information. The reason for this is that the disclosure of a person’s own personal
information is covered by a different statutory regime under the Data Protection Act
(at the time of the request 1998 and now 2018). Although the Commissioner raised
(for the first time at the hearing), the possibility that s40(5)(b) FOIA might also be
applicable in this case, we have not found it necessary to consider that possibility for
the purposes of deciding this appeal.
11. The relevant definition of personal data in this case is set out in section 1 of the Data
Protection Act 1998 (DPA 1998). Section 1 defines personal data as:-
“…data which relate to a living individual who can be identified
(a) from those data, or
(b) from those data and other information which is in the possession
of, or is likely to come into the possession of, the data controller, and
includes any expression of opinion about the individual and any
indication of the intention of the data controller or any other person
in respect of the individual.”
THE DECISION NOTICE
12. The Commissioner’s decision notice is dated 23 July 2018. The Commissioner notes
that: -
20. The two main elements of personal data are that the information must
‘relate’ to a living person and that the person must be identifiable.
Information will relate to a person if it is about them, linked to them, has
some biographical significance for them, is used to inform decisions affecting
them or has them as its main focus.
13. The Commissioner notes NYP’s reasons for its decision to the Appellant as follows:
-
Section 40(5)(a) applies as the requested information, if held, would
constitute personal data under section 40(1) as the requestor has intimated
that the information relates to themselves”.
4
To either confirm or deny that the information is held would disclose that
individuals had, or had not, been subject to a covert operation targeting a
particular individual, which in itself is personal information to the individual
concerned and therefore exempt under Section 40(5)(a) of the Act.
14. The Commissioner ‘acknowledges that the complainant disputes that the request
relates to his own personal information’. He also told her: -
Just because I was the target of the operation does not mean the public
cannot see what money was spent on the operation and who was involved
in it at which rank level”.
15. The Commissioner reached the following conclusions in the decision notice: -
24. The Commissioner accepts that the complaint in this case appears to be
in relation to information about a Police operation, including with respect to
the names and ranks of the officers involved and the cost of the operation.
However, she considers that the preamble to the multi-part request in this
case sets the context for the whole of the request.
25. Having considered the wording of the request, the Commissioner is
satisfied that if North Yorkshire Police confirmed or denied that a covert
operation was mounted, this would place information about the complainant
into the public domain ie it would confirm or deny whether he was the target
of a covert operation.
26. Clearly this information would relate to the complainant and so would be
his ‘personal data’.
…
28. Accordingly, she is satisfied that the complainant is, or would be, a data
subject of the requested information for the purposes of section 40 of the
FOIA. This is because the requested information, if held, is about or
connected to the complainant himself.
29. In relation to such information, the provisions of section 40(5) of the
FOIA mean that North Yorkshire Police was not required to comply with
the duty imposed by section 1(1)(a) of the FOIA - to confirm or deny that
the information is held - as the duty to confirm or deny does not arise in
relation to information which is (or, if it were held by the public authority,
would be) exempt information by virtue of subsection (1).
30. The Commissioner is satisfied that complying with section 1(1)(a) in this
case would effectively confirm or deny whether the requested information is
held in connection with the complainant.
5
16. On that basis the Commissioner therefore considered that the section 40(5)(a) FOIA
exemption was correctly relied upon by NYP in this case. The Commissioner went
on to comment that: -
32. In the Commissioner’s view, it is appropriate that any decision as to
whether or not a data subject is entitled to be told if personal data about them
is being processed should be made in accordance with the subject access
provisions of the DPA.
33. If a data subject is dissatisfied with the outcome of a subject access
request, they can raise their concern about how the organisation handled that
request with the ICO.
34. The Commissioner is satisfied that North Yorkshire Police advised the
complainant in this case with respect to making a subject access request.
17. As a result of these observations, the Appellant made a subject access request (SAR)
under the DPA to NYP for the information. We note that NYP had already told the
Appellant on 26 January 2018, when responding to the FOIA request, that covert
information would not generally be released under subject access provisions. NYP
refused the SAR, and the Appellant complained to the Commissioner. He then made
an application to the First Tier Tribunal (FTT), challenging the Commissioner’s
response to his complaint. This was treated as an application for an order under
section 166 of the DPA 2018. By a decision dated 11 April 2019, the FTT struck out
the Appellant’s application. This was upheld by Judge McKenna on 30 April 2019.
That matter was ultimately brought to a conclusion in the Upper Tribunal (UT) in
Leighton v Information Commissioner (No2) UKUP 23 (AAC).
APPEAL AND RESPONSE
18. The Appellant’s appeal of the FOIA decision notice is dated 24 February 2019, some
seven months after the date of the decision notice. The Appellant has had something
of a battle, to say the least, to obtain an extension of time to file his appeal. This has
been considered on a number of occasions and has necessitated the Appellant
appealing a refusal decision by the FTT to the UT. Permission to extend time was
eventually granted by UTJ O’Connor following a hearing on 26 May 2021, accepting
that there was a public interest in the substantive case being heard
6
19. The Appellant’s grounds of appeal can be summarised as follows: -
(a) The principle of Norwich Pharmacal v Customs and Excise Commissioners [1974] AC
133 is engaged, which entitles the Appellant to the information he has
requested from the NYP. Norwich Pharmacal is a case which underlined the
importance of third-party disclosure in a tort action. The Appellant’s case is
that it is wrong for NYP not to disclose the information to him.
(b) NYP’s response to the Appellant’s subject access request (SAR) deprives the
Applicant of his right to rectify any inaccurate data pursuant to s.46(1) DPA
and Article 16 GDPR, because until NYP confirm that information is held
about the Appellant, he cannot apply to ensure that it is accurate.
(c) NYP’s refusal to respond to the request infringes the Appellant’s Article 8 and
Article 10 rights under the European Convention of Human Rights. The denial
of the right to ‘refute’ the information held is a breach of the right to respect
for private life. Article 10, which relates to freedom of expression, also
prevents a public authority depriving a person from receiving information.
(d) The FTT found that s40(5)(a) FOIA was not an applicable exemption in Neil
Wilby v Information Commissioner and Police and Crime Commissioner for North
Yorkshire (EA/2017/0076) (paragraph 20). This was a FTT case which decided
that information about legal costs of a public body in connection with a county
court case involving Mr Wilby was not correctly categorised as Mr Wilby’s
personal information.
(e) The Commissioner should have checked that NYP has carried out a Privacy
Impact Assessment.
20. The Commissioner’s response is dated 8 July 2021. The Commissioner emphasises
that the Tribunal’s jurisdiction is limited to whether the decision notice is correct in
law: in other words, was the Commissioner correct in stating the NYP were entitled
to rely on s40(5)(a) FOIA to neither confirm nor deny it held the requested
information? This means that the application of the Norwich Pharmacal doctrine is
7
not relevant in this case, and that this Tribunal also has no role investigating what
happened to a SAR request.
21. The Commissioner submits that the UT in Moss v Information Commissioner [2020]
EWCA Civ 580 confirmed that Art 10 was not relevant in respect of requests made
under the FOIA. The UT stated the ECHR does not change in any way how the
Commissioner currently interprets the FOIA or investigate complaints.
22. The Commissioner argues that the decision in Wilby is not binding on the Tribunal
and that it is outside the scope of the Tribunal’s jurisdiction to consider matters such
as the existence of a Privacy Impact Assessment.
THE HEARING
23. At the hearing, the Appellant made succinct and helpful oral submissions based on
his skeleton argument. We concentrate here on his points which are relevant to the
issue the Tribunal has to decide which is whether his request is for his own personal
information.
24. The Appellant’s main point was that the information sought was not his personal
information as, if held, the information could be provided in a way which meant his
name was not disclosed, or that simply because his name might appear in the
information as a ‘target’ did not, in itself, mean that the information sought was his
personal information.
25. He relied on what was said in the Court of Appeal in the case of Durant v Financial
Services Authority [2003] EWCA Civ 1746 where simply because an investigation was
generated by a requester’s complaint did not make all the information obtained in the
investigation the requester’s personal information; and that ‘mere mention of the data
subject in a document held by a data controller does not necessarily amount to his
personal data’. He also argued that the information requested by him, such as
financial information about any surveillance operation, would be found in files where
there would be no mention of his name.
26. The Appellant also referred to a similar request for information made by another
person in 2016 about surveillance operations to the NYP, where the NYP had
8
confirmed that it held the information, disclosed some of it, and explained why it
withheld the rest. The request and response were included in our bundle and we
noted that the requester did not appear to have asked for information which related
to himself or his home address.
27. The Appellant remains aggrieved that his unsuccessful SAR did not lead to a
substantive remedy and that, having advised him to make a SAR, the Commissioner
had then applied to strike out the appeal he tried to make against the result.
28. For the Commissioner, Ms Taunton asked us to concentrate on the main issue as to
whether the information sought was the Appellant’s
DISCUSSION AND DECISION
29. We have read all the documentation and considered all the submissions put forward
by the Appellant in relation to his appeal. We have not referred to every point in this
decision but have concentrated on the main issues for us to decide.
30. In our view the Commissioner in this case was correct to find that, if held, the
information requested would be the Appellant’s personal information. This is
immediately indicated from the request itself which begins ‘A covert operation was
mounted with me being a target of it in 2015’, then seeks details of that operation,
and ends by providing details of the Appellant’s address where it is said that at least
some of the surveillance took place.
31. We have to consider any information which might be disclosed in the context of the
actual terms of the request made. Therefore it seems to us that the Appellant is the
direct subject of all the information he seeks, which would be about a covert
operation targeted, as he says, at him personally, and (may have been at least partly)
at his address as identified by him. It seems clear to us that the information sought
(if held) must relate to a living individual (the Appellant) who can be identified from
those data. The information is so intimately related to the Appellant that it is
impossible to say that the Appellant is simply seeking information about the
operation and that can be provided without disclosing his personal data.
9
32. As the Commissioner argued, were NYP to provide any information in response to
the Appellant’s request, it would necessarily identify him in the public domain as the
target of the surveillance operation. Such information would be the Appellant’s
personal data because it would be information about him, from which he can be
identified. For example, as the Commissioner says, the name of operation (if it
existed) would constitute the Appellant’s personal data because, when considered
with the request, it would necessarily identify the Appellant as a target of that
operation. The way that the request has been formulated (bookended by
confirmation that the surveillance is about the Appellant and details of his home
address) means that this must be the case whatever part of the information is
considered, and in our view different results cannot be obtained by considering
different elements of the request.
33. In our view the comments in the Durant case do not assist the Appellant. This is not
a case where any information disclosed would contain a ‘mere mention’ of his name:
the way the request has been formed means that any information would directly be
about the Appellant and identify him.
34. It also seems to us that the Wilby case does not help the Appellant’s argument. In
that case, Mr Wilby sought a narrow category of information about how much a
public authority had spent on a case (heard in public) in which Mr Wilby was a party.
We can understand how the FTT formed the view that this information was not Mr
Wilby’s personal data, and that he would not be identified by its disclosure. For the
reasons set out above that is not the situation in the Appellant’s case.
35. We also see significant differences in the 2016 requests for information about NYP
operations referred to by the Appellant as directly analogous. As explained above
those requests do not indicate to whom the operations related or the addresses to
which they were directed, and it certainly is not possible to ascertain whether the
requester was seeking information which related to himself or his home (which is
obviously the case in the Appellant’s appeal). The NYP segmented approach to
responding to parts of this 2016 requests, such as the costs incurred, thus does not
assist the Appellant.
10
36. For all these reasons we are satisfied that the Commissioner was correct to include
that in this case, if information were held, then it would be the Appellant’s personal
information/data and therefore NYP were not obliged under the FOIA framework
to confirm or deny whether the information was held, and therefore this appeal must
be dismissed. There is no further public interest test to be considered once that
conclusion has been reached.
37. We should mention the Appellant’s arguments that NYP’s refusal infringes his
Article 10 ECHR rights. However, as has been recently confirmed by the UT, in Moss
v Information Commissioner [2020] UKUT 242 (AAC) (a decision which is binding on
us), Article 10 does not confer a right of access to information held by public
authorities and has no application in the context of requests for information made
under FOIA.
38. We also recognise that the process to reach this stage has been frustrating for the
Appellant and that there have been delays, in particular while the FTT and the UT
resolved the issue of allowing this appeal to continue, and that the unsuccessful
application for SAR compounded matters. However, as the Commissioner had
(correctly in our view) concluded that the Appellant was seeking his personal data
through this request, she was not wrong to point the Appellant towards the data
subject access provisions set out in separate regime governing rights of access, and
the Commissioner certainly did not state anywhere that the Appellant’s application
under that regime would be successful. The issue raised about the remedy against a
regulator under s. 167 DPA 2018 is outside our remit
CONCLUSION
39. For the reasons set out above we are satisfied that the Commissioner was correct to
find that NYP were able to rely on s40(5)(a) FOIA to decline to confirm or deny
that the information is held, and, as already mentioned, the appeal is dismissed.
Recorder Stephen Cragg QC
11
Sitting as a Judge of the First-tier Tribunal
Date: 13 November 2021
12