IN THE FIRST-TIER TRIBUNAL Case No. EA/2019/0211
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
ON APPEAL FROM:
The Information Commissioner’s
Decision Notice No: FS50831430
Dated: 7 June 2019
Appellant: George Greenwood
Respondent: The Information Commissioner
Date of hearing: 15 January 2020 at Field House, London
Date of decision: 31 January 2020
Before
Anisa Dhanji
Judge
and
Alison Lowton
Stephen Shaw
Panel Members
Subject matter
FOIA section 40(2) - whether disclosure of personal data would breach the first
data protection principle.
-1-
IN THE FIRST-TIER TRIBUNAL Case No. EA/2019/0211
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
DECISION
The appeal is dismissed.
Anisa Dhanji
Judge
-2-
Case No. EA/2019/0211
IN THE FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
REASONS FOR DECISION
Introduction
1. This is an appeal by Mr George Greenwood (the “Appellant”), against a
Decision Notice (“DN”), issued by the Information Commissioner (the
“Commissioner”), on 7 June 2019.
2. It concerns a request made by the Appellant to the Department for Exiting
the European Union (“DExEU”), under the Freedom of Information Act 2000
(“FOIA”).
3. The request was for information about complaints relating to expenses
claimed by special advisers in DExEU.
4. DExEU refused part of the request, citing the exemption in section 40(2) of
FOIA relating to personal data of third parties.
5. DExEU closes on 31 January 2020. That does not affect this appeal which
is decided on the facts as they were as at the date of the refusal.
The Request
6. The Appellant’s request was made on 15 January 2019 on the following
terms:
1. Please provide the total amount in expenses claimed by special
advisors of your department in each of the last five financial years, and the
current financial year to date.
2. Please provide this broken down by named special advisor, and
provide for each item, the amount claimed, the supplier, the reason for
claim and the date of the expense, as well as any other information held
centrally about these transactions in the accounting software used to record
and process them.”
7. DExEU responded on 12 February 2019. It provided the amounts requested
paragraph 1.
8. In respect of paragraph 2, DExEU relied on section 40(2) and refused the
request.
9. Following an internal review requested by the Appellant, DExEU wrote to
the Appellant on 15 March 2019, maintaining its refusal.
Complaint to the Commissioner
-3-
10. On 21 March 2019, the Appellant complained to the Commissioner about
the way in which DExEU had responded to paragraph 2 of his request. He
considered that section 40(2) did not apply to the withheld information.
11. The Commissioner asked DExEU to reconsider its position. DExEU then
disclosed some further information to the Appellant.
12. The scope of the Commissioner’s investigation, therefore, focused on
DExEU’s application of section 40(2) to the remaining information,
comprising:
• names, employee numbers, and email addresses of the special
advisors;
• supervisor and approvers’ names, and employee numbers; and
• invoice numbers and dates of expenses.
13. We shall refer to this information as the “disputed information”.
14. The Commissioner decided, in her DN, that DExEU had appropriately
withheld the disputed information under section 40(2), and therefore did not
require DExEU to take any steps to ensure compliance with FOIA.
Appeal to the Tribunal
15. The Appellant has appealed against the DN under section 50 of FOIA.
16. The scope of the Tribunal’s jurisdiction in dealing with an appeal from a DN
is set out in section 58(1) of FOIA. If the Tribunal considers that the DN is
not in accordance with the law, or to the extent that it involved an exercise
of discretion by the Commissioner, she ought to have exercised the
discretion differently, the Tribunal must allow the appeal or substitute such
other notice as could have been served by the Commissioner. Otherwise,
the Tribunal must dismiss the appeal.
17. Section 58(2) confirms that on an appeal, the Tribunal may review any
finding of fact on which the Decision Notice is based. In other words, the
Tribunal may make different findings of fact from those made by the
Commissioner, and indeed, as in this case, the Tribunal will often receive
evidence that was not before the Commissioner.
18. The parties have lodged an agreed open bundle. In addition, we have been
supplied with a closed bundle which includes the withheld information.
19. DExEU has not been joined as a party, although we have considered its
responses to the Commissioner’s inquiries as contained in the open bundle.
20. The parties have requested that this appeal be determined on the papers
without an oral hearing. Having regard to the nature of the issues raised,
and the nature of the evidence, we are satisfied that the appeal can
properly be determined without an oral hearing.
The Disputed Information
-4-
21. We will begin by describing the disputed information. In line with the
Supreme Court’s decision in Bank Mellat v Her Majesty’s Treasury [2013]
UKSC 38, we will try to say as much as we reasonably can about that
information, without undermining the purpose of this appeal. We have also
kept in mind the Court of Appeal’s guidance in Browning v Information
Commissioner and the Department for Business, Innovation and Skills
[2014] EWCA Civ 1050, as regards closed material generally.
22. The Tribunal has received a closed bundle comprising some 14 pages.
Redacted copies are in the open bundle, so the Appellant already knows the
structure of the information and the nature of what has been withheld.
23. Briefly, the disputed information comprises a spreadsheet with a number of
columns. The following information has been redacted
• Column A – the names of the special advisers
• Column B – their employee numbers
• Column D – entity (these are numerical entries)
• Column F – home cost centre (these are also numerical entries)
• Column G – work telephone numbers
• Column H – e mail addresses
• Column I – invoice numbers
• Column M – expense template
• Column O – supervisor name
• Column P – supervisor employee number
24. To put this in context, the information provided includes:
• The number of special advisers, namely 8)
• The part of DExEU to which the expense relates
• The amounts (in £) claimed by each of the special advisers, namely
18.80
13.00
20.00
21.31
18.00
30.00
15.67
-5-
11.28
40.00
• What the expense was for in each case (they were primarily taxi
fares).
Statutory Framework
25. Under section 1 of FOIA, any person who makes a request for information to
a public authority is entitled to be informed if the public authority holds that
information, and if it does, to be provided with it.
26. The duty on a public authority to provide the information requested does not
arise if the information is exempt under Part II of FOIA. Personal data is
exempt subject to certain exceptions.
27. “Personal data” is defined in section 3(2) of the Data Protection Act 2018
(“DPA”) as meaning:
“any information relating to an identified or identifiable living individual
(subject to subsection (14)(c)).
28. Under section 3(3):
“Identifiable living individual” means a living individual who can be
identified, directly or indirectly, in particular by reference to—
(a) an identifier such as a name, an identification number, location
data or an online identifier, or
(b) one or more factors specific to the physical, physiological,
genetic, mental, economic, cultural or social identity of the
individual.
29. The exception which DExEU relies upon is set out in section 40 of FOIA,
which provides that information is exempt from disclosure if it constitutes
personal data of an individual other than the requester and where the first,
second or third condition below is satisfied.
30. The only relevant condition here is the first condition contained in section
40(3)(A)(a) which provides as follows:
(3A) The first condition is that the disclosure of the information to a
member of the public otherwise than under this Act-
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data
Protection Act 2018 (manual unstructured data held by public
authorities) were disregarded.
31. Under section 40(7)
-6-
“…the data protection principles” means the principles set out in –
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018.
32. Section 40(8) provides that:
In determining for the purposes of this section whether the lawfulness
principle in Article 5(1)(a) of the GDPR would be contravened by the
disclosure of the information, Article 6(1) of the GDPR (lawfulness) is
to be read as if the second sub-paragraph (disapplying the legitimate
interests gateway in relation to public authorities) were omitted.
33. GDPR is of course a reference to the General Data Protection Regulations.
34. The first question, therefore, is whether disclosure of the disputed
information would breach any of the data protection principles. There are
seven data protection principles. However, only the first data protection
principle is relevant here. This is set out in Article 5(1)(a) of the GDPR. It
provides that “personal data shall be processed lawfully, fairly and in a
transparent manner in relation to the data subject.”
35. Processing, in the context of FOIA, occurs when the personal data is
disclosed in response to a request. This means that the data can only be
disclosed if it would be lawful, fair and transparent.
36. Processing is lawful if one of the conditions in Article 6(1) is satisfied. The
relevant condition in the present case is set out in Article 6(1)(f) which
provides as follows:
“Processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such
interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal
data, in particular where the data subject is a child.”
37. The key questions here, therefore, are whether disclosure is necessary,
whether there is a legitimate interest in disclosure, and whether even if there
is, the legitimate interests outweigh the interests and rights of the data
subject.
The Commissioner’s Findings
38. The Commissioner considered the Appellant’s and DExEU’s arguments
relating to each of the above questions.
39. In considering whether there was a legitimate interests in the disclosure of
the disputed information, the Commissioner accepted that there is a clear
public interest in the scrutiny of the spending of public money by politically
appointed figures, in openness and transparency in government, and in the
enhancement in public trust in the government that may result from
disclosure.
-7-
40. As to whether disclosure was necessary, the Commissioner considered the
definition of necessity, and noted that disclosure under FOIA must be the
least restrictive means of achieving the legitimate aim in question. She
considered, however, that there was no reasonable necessity in the present
case. She considered that the legitimate interest in the spending of public
money was not materially addressed by disclosure of the disputed
information because the amounts involved were not excessive or warranting
further scrutiny. The Commissioner did not consider that disclosure of the
identity of the individual claiming the expense, for example of a taxi fare,
added to transparency. She considered, therefore, that there was limited
necessity in disclosure.
41. As regards the balancing test, the Commissioner considered that the data
subjects were unlikely to expect their personal data would be disclosed under
FOIA. They do not have public facing roles at DExEU, they do not have an
executive function like civil servants at senior civil servant grade and above.
Also, they cannot authorise expenditure, exercise management powers or
statutory or prerogative powers.
42. For all these reasons, the Commissioner considered that there was an
insufficient legitimate interest to outweigh the data subjects’ fundamental
rights and freedoms, and found, accordingly, that the disclosure of the
information therefore would not be lawful. It followed that she found DExEU
was entitled to rely on section 40(2) to withhold the requested information.
Our Findings
51. It is clear that the disputed information comprises personal data. Indeed the
Appellant does not argue otherwise. His arguments are focused on the
nature and weight of the public interest in disclosure which he says is at
stake. He says that there is an important public interest in knowing the
expenses claimed by special advisers, and he seeks to draw parallels with
the expenses of civil servants. In particular, he argues that:
• there is a legitimate interest in the disclosure of the information;
• Special advisors do not have a reasonable expectation of privacy due
to their role; and
• just knowing the amount of expenses claimed is not enough to
properly hold these high profile government figures to account.
52. We consider the Appellant’s position to be misconceived in his view that the
issue here is whether there is a sufficiently strong public interest to justify
disclosure of the identity of special advisers who claim expenses. It is not.
We are not empowered to make generic findings. We are only able to make
findings in relation to the specific information before us.
55. In other words, the assessment as regards legitimate interest is in relation
only the particular information in issue, and the particular public interest
factors that arise based on that information. It is not an exercise based simply
on a generic categorization as the Appellant has positioned it. This does not
-8-
mean that generic factors are not relevant, but they must be borne out by the
particular information in issue.
56. It is also important to clarify that although the assessment of the competing
interests in the context of section 40(2), is referred to as a balancing
exercise, in fact, one does not start with the scales evenly balanced. The
continued primacy of the DPA, notwithstanding freedom of information
legislation, and the high degree of protection it affords data subjects, has
been strongly emphasised by Lord Hope in Common Services Agency v
Scottish Information Commissioner [2008] 1 WLR 1550 where he states
(at para 7):
“In my opinion there is no presumption in favour of the release of
personal data under the general obligation that [FOIA] lays down. The
references which that Act makes to provisions of DPA 1998 must be
understood in the light of the legislative purpose of that Act …. The
guiding principle is the protection of the fundamental rights and
freedoms of persons, and in particular their right to privacy with
respect to the processing of personal data.”
57. In the present case, given the relatively small amounts in issue, and given
also that the nature of each expense has been disclosed, and that the
amounts are not such as to suggest any misuse of public funds, we consider
that disclosure of the disputed information is not necessary for the purposes
of a legitimate interest that is being pursued. We consider that it would do
little to further the public interest referred to at paragraph 39. We also find
that such legitimate interest as there is, does not outweigh the interests of
the data subjects.
58. We make no observations about whether special advisers are in positions
comparable to senior civil servants, or otherwise. Our finding is simply based
on the disputed information in this case. Different information may of course,
lead to different findings.
Decision
59. For all these reasons, we dismiss this appeal.
Anisa Dhanji
Judge
Date: 31 January 2020
-9-