First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2019/0216
Heard at Wigan Magistrates Court
On 29 January 2020
Before
JUDGE HOLMES
PAUL TAYLOR
JEAN NELSON
Between
MR E CARPANINI
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
DECISION AND REASONS
The Tribunal dismisses the appeal and decision notice, no. FS50824497, dated 4 June
2019 is confirmed and no further action is required from the public authority.
REASONS
1. In this appeal the Appellant, Tony (E) Carpanini appeals against a Decision
Notice issued by the Information Commissioner on 4 June 2019, in which she
determined that the public authority, Devon and Cornwall Constabulary (“the Police
Force”), was entitled to rely upon s.40(5) of the FOIA to neither confirm nor deny
whether it held the requested information.
2. The Appellant appealed the Decision Notice by a Notice of Appeal dated 26
June 2019. In the Notice the Appellant indicated that he required a Decision without a
hearing.
3. The Commissioner filed her response to the appeal on 24 July 2019. She too
was content with a paper hearing of the appeal.
4. The Appellant filed a response to the Commissioner’s response dated 5 August
2019. The Registrar issued case management directions on 26 July 2019. She directed
1
redaction of two pages of the open bundle, and receipt of that material on a closed
basis pursuant to rule 14(6).
5. Accordingly, neither party attended the appeal hearing, which was held at
Wigan Magistrates Court on 29 January 2020. The Tribunal had before it an open
bundle, which included both parties’ representations, and a closed bundle,
comprising of some two pages from the bundle, in redacted form.
The Background.
6. The request made by the Appellant which gives rise to this appeal was dated
29 January 2019 and is at page 86 of the bundle. The background to it is as follows.
7. The Appellant is legally qualified (and probably a retired solicitor, the
Tribunal surmises) who is assisting, on a pro bono basis, a lady, referred to as his
client, who was on 6 December 2014 arrested by an officer of the public authority
Police Force, on suspicion of criminal damage to her matrimonial home in the course
of the breakup of her marriage and subsequent divorce. Following further enquiries,
and the attendance of her ex-husband at the police station where she had been
detained, the Appellant’s client was then questioned about alleged fraud, in relation
to the ordering various items on her ex-husband’s current account with HSBC.
8. The subject of the Appellant’s FOIA request, a lady who can be referred to as
“TT”, attended the police station as a representative of the Duty Solicitor, apparently
acting as a Police Station Accredited Representative, and advised the Appellant’s
client during her interviews with the Police.
9. The outcome of the arrest was that the Appellant’s client was released without
charge, but after two further interviews, she accepted a “Simple Caution” on 15 April
2015 (page 58 of the bundle) for the allegations of fraud.
10. That caution has presented problems for the Appellant’s client in pursuing her
chosen career in dentistry, and she has consulted the Appellant with a view to having
the caution removed , and potentially taking action against the Police Force and/or
TT, who , it is alleged by the Appellant, had a conflict of interest, having previously
been a police officer, and possibly still being employed by the Police Force, such that
she did not represent her client’s interests, but threatened and blackmailed the client
into accepting the caution.
11. The Appellant has set out this background, and indeed a considerable amount
of supporting documentation, in rather more detail than is needed, in the documents
that he submitted with his Notice of Appeal.
12. There is little doubt, and this is clear from information that is in the public
domain, and which TT herself had put in the public domain, that she has at some
time in the past been a serving Police Officer in the Police Force in question.
2
13. The Appellant made a FOI request dated 7 April 2018 (page 112 the bundle)
addressed to the Police Force, in which he asked for the employment details of TT
under her former name, and her married name , since April 2015. He referred to the
information that he had from National Archive records, which revealed that she had
been a Police Officer until at least 2009, and he asked questions as to whether and
when she had left Police Force, and if having left prior to December 2014, she was
then employed by the Police Force as a civilian particularly during the period
December 2014 and April 2015 inclusive.
14. There was no response to that request, nor any explanation as to why it was
not answered. The Appellant, having apparently sought advice from the Information
Commissioner, on 29 January 2019 accordingly made a further request, the subject of
this appeal in which he repeated the two questions he had raised in his previous
request. In this request the Appellant referred to further information that he had
obtained as to the role that TT had taken in the police interviews of his client, and
what in his view this showed. He went on to say that TT could expect no special
considerations of privacy for this information, as she clearly advertises herself in
several legal justice documents as published in the National archives copies of which
he had, and which have indeed been included in the documents he submitted with
his Notice of Appeal.
15. The Freedom of Information Unit of the Police Force responded to the
Appellant the following day (pages 87 to 98 of the bundle), to the effect that the
information requested was considered to be a request for personal information,
release of which the FOIA did not permit. The letter went on to state how even
confirmation or denial that such information existed would breach the GDPR, and
contravene the first principle of data protection. The letter went on to explain how
there was alternative legislation that allowed for requests such information be
provided if legal proceedings were intended, and it was confirmed that this letter
acted as a Refusal Notice under section 17(4) of FOIA.
16. The Appellant responded by letter to the Freedom of Information Officer on 10
February 2019 (page 90 of the bundle) disputing the refusal, and requesting a review.
He reiterated that he did not consider that TT was entitled to any privacy, and
rhetorically asked what privacy she had afforded his client whose unjust Caution
would continue for her lifetime. His letter then continued to refer to legal issues and
the propriety or otherwise of the caution, and to criticise the actions of TT and a
detective constable who was involved in the case. He went on to say that until this
unjust Caution was removed he would continue with his action. It appears likely that
he enclosed with this letter copies of some of the material that he had obtained (pages
91 to 98 of the bundle), which have also been enclosed with his notice of appeal.
17. The Police Force did conduct an internal review, and the result was
communicated to the Appellant by letter dated 15 February 2019 (pages 99 to 100 of
the bundle), which was the fact that the decision to confirm or deny that the
3
information was held would be a breach of the data subject’s rights under the Data
Protection Act was correct, and the Police Force stood by the refusal notice it had
issued. Again, reference was made to the alternative route whereby such information
could be provided. The letter also informed the Appellant of his right to appeal and
how to make such an appeal.
The ICO’s involvement.
18. The Appellant referred the matter to the ICO by letter of 25 February 2019
(page 101 of the bundle). The Appellant completed the application form (pages 102 to
to 104 of the bundle). The ICO acknowledged the complaint on 14 March 2019 and
informed the Police Force accordingly.
19. On 8 April 2019 the Freedom of Information Officer for the Police Force
provided the ICO caseworker the copy of the Appellant’s previous FOI request of 7
February 2018.
20. On 8 April 2019 also the ICO wrote to the Police Force (pages 113 to 118 of the
bundle) raising a number of questions, in the context of the determination that the
Information Commissioner considered that she would was likely to have to make as
to the lawfulness of the processing of any requested personal data of the subject of
the Appellant’s request.
21. The Appellant was informed of the steps being taken, and on 8 April 2019 he
replied to the ICO. This communication adds very little, other than the Appellant
offering to provide further documentation or proof of his client’s wrongful arrest and
its consequences for her life.
22. The Police Force responded to the ICO letter of 8 April 2019 (although
described in this response as “0th” April 2019) on 3 May 2019 (pages 123 to 124 of the
bundle), which has been redacted in one paragraph in the open bundle. This response
explains the results of an Internet search against the two names provided by the
Appellant, and the justification for not providing the information requested.
23. The Information Commissioner on 4 June 2009 accordingly issued her Decision
Notice.
The IC’s Decision Notice.
24. The Decision Notice is at pages 1 to 9 of the bundle. In it the Commissioner
considers the relevant law enforcement provisions, and based upon which the Police
Force is processing the data. She considers that it is doing so as a public authority,
and not for law enforcement purposes. She recites the provisions of section 40 FOIA
in relation to personal information, and section 3(2) of the DPA 2018. Being satisfied
that the requested information would reveal personal data of a third party, she went
on to consider whether to confirm or deny that this information was held would
4
contravene any of the data protection principles. She concluded that it would do so,
and that the requester had a legitimate interest in requesting information, she was not
aware of any wider public interest in confirming or denying whether the information
was held.
25. She went on to consider whether confirmation was necessary to meet the
legitimate interest in question. In considering whether this test was met she gave
consideration as to whether or not the requested information should be provided if
the legitimate aim could be achieved by something less. Confirmation or denial must
therefore be the least intrusive means of achieving a legitimate aim in question. The
Commissioner could not see how the request could be met without disclosing
personal data, and noted how the requester had been advised about other legislation
or the availability of obtaining a court order which would allow such a request to be
answered. She therefore considered this to be the least intrusive means of achieving
the legitimate aim, rather than public disclosure of whether or not the named
individual was employed by the Police Force. She therefore decided that the police
force was entitled to refuse to confirm whether or not it held request information on
the basis of section 50 (5B)(a) (i) of FOIA.
The Appellant’s grounds of appeal, and submissions.
26. The Appellant’s Grounds of Appeal are at page 13 of the bundle. He refers to
Schedule 11 Clause 3 of the DPA. He recites the treatment his client was subjected to,
and how it has affected her career. In essence his grounds of appeal centre upon the
provisions of the DPA that he cites. He attached to the Notice of Appeal a List of 50
documents, and , at pages 17 to 21, a submission which rehearses in some detail his
client’s potential case against the Police Force, and in the closing paragraphs makes
reference again to the DPA, and how TT should not be protected from the disclosure
that he seeks.
The IC’s response to the appeal.
27. The IC did not appear, but her written submissions, dated 24 July 2019, are at
pages 73 to 84 of the bundle. The relevant provisions of FOIA, and the DPA are set
out, along with the data protection principles of the GDPR. She cites South
Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 as to the
test to be applied, that is whether the processing was necessary for the purposes of
the legitimate interests pursued by the controller or a third party. Reference is also
made to Goldsmith International Business School v Information Commissioner and
the Home Office [2014] UKUT 563.
28. The Commissioner points out that the Schedule 11 DPA provisions do not
apply to this public authority, which is a Police Force, and not one of the intelligence
services to which this Part applies. She does accept, however, that similar provisions
which do apply to this public authority, namely Schedule 2, Part 1, section 5(3). She
argues, however, that these provisions do not assist the Appellant is still subject
5
requirement for the data processing to be lawful, even if it necessary to be processed
for the purposes of, or in connection with legal proceedings, obtaining legal advice or
establishing, exercising or defending legal rights.
29. The Commissioner contends that the processing of the data in question would
not be lawful in these circumstances. She does not consider it “necessary” for the
Police Force to confirm or deny whether it holds the requested information for the
purposes referred to above. This is because she considers that the requester (or rather
his client) can pursue all her legal option without having such information.
30. In relation to the Appellant’s second ground, the Commissioner accepts that
the Appellant has a legitimate interest in the information being provided, but
considers that there are less intrusive means of meeting that interest, by the means set
out in her Decision Notice , in the course of legal proceedings.
The Appellant’s response.
31. The Appellant responded (supplemental pages, not included in the original
bundle) on 5 August 2019. In it the Appellant rejects the argument that there are less
intrusive means of obtaining the same information, and points out the information
that he was able to obtain from the National Archive documents. He referred to his
attempts to refer the matter to the IPCC, and how the case was to be resolved locally
by the Police Force. He went on to say that the only legal action that he contemplated
was removal of the Caution, and that seeking a court order without proof appeared to
be putting the cart before the horse. He went on to say that in his experience there
would be likely to be journalistic interest in any court case which would be far more
intrusive. He went on to refer to the enormous injustice to which his client had been
subjected, and alleged that there had been lies told by police officers. Finally, he
mentioned that there were specialist firms dealing with the removal of Cautions but
that these were beyond the means of himself and his client.
The closed material.
32. The Tribunal then viewed the closed material. It cannot, of course, reveal its
contents, but suffice it to say that its contents do indeed fall within the type of
information that the public authority has suggested they would, and to provide
confirmation or denial would indeed reveal personal data.
The Law.
32. The relevant provisions of the Freedom of Information Act 2000 are as follows:
40 Personal information
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
6
(2) Any information to which a request for information relates is also exempt information
if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual
unstructured data held by public authorities) were disregarded.
4 .. N/A
(5A) The duty to confirm or deny does not arise in relation to information which is (or if it
were held by the public authority would be) exempt information by virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or to the
extent that any of the following applies—
(a) giving a member of the public the confirmation or denial that would have to be given to
comply with section 1(1)(a)—
(i) would (apart from this Act) contravene any of the data protection principles, or
(ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual
unstructured data held by public authorities) were disregarded;
(b) giving a member of the public the confirmation or denial that would have to be given to
(6) ...
(7) In this section—
“the data protection principles” means the principles set out in—
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that
Act);
“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part
2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see
section 3(2), (4), (10), (11) and (14) of that Act)
(8) In determining for the purposes of this section whether the lawfulness principle in
Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article
6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the
legitimate interests gateway in relation to public authorities) were omitted.
7
33. The relevant provisions of the GDPR are as follows:
Article 5 Principles relating to processing of personal data
1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject
('lawfulness, fairness and transparency');
Article 6 Lawfulness of processing
1. Processing shall be lawful only if and to the extent that at least one of the following
applies:
(a) to (e) – N/A
(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require protection of personal data,
in particular where the data subject is a child.
34. The Appellant has cited Para. 3 of Schedule 11 to the Data Protection Act 2018,
but this is not applicable, as the Information Commissioner’s response points out, it
applies as set out below:
SCHEDULE 11 – Other Exemptions under Part 4
Part 4 Intelligence Services Processing
Scope and Definitions
Scope
82 Processing to which this Part applies
(1) This Part applies to—
(a) the processing by an intelligence service of personal data wholly or partly by automated
means, and
(b) the processing by an intelligence service otherwise than by automated means of personal
data which forms part of a filing system or is intended to form part of a filing system.
(2) In this Part, “intelligence service” means—
(a) the Security Service;
(b) the Secret Intelligence Service;
8
(c) the Government Communications Headquarters.
(3) A reference in this Part to the processing of personal data is to processing to which this
Part applies.
35. The relevant provision is to be found in Schedule 2, Part 1:
SCHEDULE 2 Exemptions etc from the GDPR
Part 1 Adaptations and Restrictions Based on [as Described in] Articles 6(3) and
23(1)
5(1) The listed GDPR provisions do not apply to personal data consisting of information
that the controller is obliged by an enactment to make available to the public, to the extent that
the application of those provisions would prevent the controller from complying with that
obligation.
(2) The listed GDPR provisions do not apply to personal data where disclosure of the data is
required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the
application of those provisions would prevent the controller from making the disclosure.
(3) The listed GDPR provisions do not apply to personal data where disclosure of the data—
(a) is necessary for the purpose of, or in connection with, legal proceedings (including
prospective legal proceedings),
(b) is necessary for the purpose of obtaining legal advice, or
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal
rights,
to the extent that the application of those provisions would prevent the controller from making
the disclosure.
36. The Information Commissioner’s position is that the processing of this data in
this was would be unlawful, and in any event, is not necessary for the purpose of, or
in connection with any prospective (for there are no current) legal proceedings, or for
the purpose of obtaining legal advice, or of establishing or defending any legal rights.
37. Necessary is a strong word, it means more than just “desirable” or
“advantageous to”. It suggests that without the information the requester would
either be prevented from, or seriously hampered in, pursuing any of the purposes
prescribed in para. 5(3) (a), (b) and (c). That is not the case here. As the Appellant has
set out in considerable detail, he has already assembled a considerable body of
evidence to present in support of any claim that his client may choose to make –
whether that be by way of civil action against the Police Force, TT personally, or by
way of seeking to have the Caution rescinded, although what type of legal
proceedings, precisely, would be involved in such an exercise is unclear. The
Appellant and his client know the identity of the person whose negligence, conflict of
9
interest, or even malicious and undue influence led to the client accepting a Police
caution when she should not have done.
38. Further, he knows that her credentials as a Police Station Accredited
Representative are open to question, and that whatever the position between
December 2014 and April 2015, she had certainly been a serving officer in the Police
Force in question up until 2009. All he is seeking to do is ascertain whether at the
material time she might also still have been employed by the Police Force is some
capacity, thereby creating an even greater conflict of interest at the very least. What
he is seeking therefore is something that may be evidentially helpful to his client’s
case, but it is hardly a pre-requisite to her being able to bring one.
39. Further, as the Police Force has itself pointed out, and the Commissioner too
has highlighted, this is information that is obtainable by other means, primarily by
the process of disclosure in any proceedings that are brought.
40. The Appellant in his response has suggested that seeking a Court Order
without proof appeared to be putting the cart before the horse. The Tribunal
appreciates that, but he is confusing, with respect, the making of a claim with the
evidence necessary to prove it. The evidence that TT may still have been employed in
some capacity by the Police Force after 2009 would as observed above, doubtless be
useful in establishing that she had a conflict of interest and may not have advised her
client appropriately in the circumstances. It is not, however, the only evidence that
this was the case, the Appellant has set out a considerable case already as to why
there may be a claim against TT, and/or the Police Force. In short, what he seeks is
not necessary to ascertain if the Appellant’s client has a claim, nor how it can be put.
41. The Appellant, with respect, misses the point when he argues that there would
be intrusion if these facts relating to TT came out in the course of legal proceedings.
That may be so, but the essence of data protection is that personal data must be
restricted unless and until there are circumstances where it loses that legal protection.
Disclosure under FOIA is disclosure to the world, once and for all. Further, whatever
the Appellant’s view of TT, a person does not forfeit their right to legal protection of
their personal data by reason of any (alleged) misconduct on their part.
42. For the reasons given by the Police Force, and the Information Commissioner,
the Tribunal agrees that the Decision Notice was correctly issued, and appeal fails.
No steps are required to be taken by the IC, whose Decision Notice is confirmed.
Signed:
Judge Paul Holmes
Judge of the First-tier Tribunal
Date: 10 March 2020 – Promulgated: 11 March 2020
10