First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2019/0250 P
Decided without a hearing
On 12 November 2020
Before
JUDGE HAZEL OLIVER
MARION SAUNDERS
JOHN RANDALL
Between
DES MOORE
Appellant
and
INFORMATION COMMISSIONER
Respondent
and
PARLIAMENTARY AND HEALTH SERVICES OMBUDSMAN
Second Respondent
DECISION
The appeal is dismissed.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 5 July 2019 (FS59823461, the “Decision Notice). It concerns information about the
names of in-house clinical advisers of the Parliamentary and Health Services Ombudsman
(“PHSO”).
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it
can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. The appellant made a request for information under the Freedom of Information Act 2000
(“FOIA”) on 7 December 2018 (the “Request”), as follows:
“1. Please provide the name of each senior member of staff and their corresponding job
title. Please also state the pay grade for each. Previously, senior pay grades were '0', '1'
and '2'.
2. Please provide the job title of each unfilled senior position. Where interviews have been
carried out for positions as yet unfilled, please state the date(s) of the interviews.
3. Please indicate all new senior staff employed since 10 September 2018.
4. lf you have used recruitment agencies to recruit senior staff since 10 September 2018,
please provide their names.”
4. The PHSO responded on 9 January 2019. It provided much of the requested information,
but withheld the names of grade 2 staff (who are in-house clinical advisers), a senior lawyer
and a solutions architect, under point (3) of the Request. This was on the grounds it was the
personal data of a third party and exempt under section 40(2) FOIA. The appellant requested
an internal review on 9 January 2019. The PHSO agreed to disclose the names of the senior
lawyer and solutions architect, but it maintained that the names of in-house clinical advisers
were exempt. We have seen a spreadsheet which provides information in response to the
Request and withholds 23 names of in-house clinical advisers (the “Withheld Information”).
5. The appellant complained to the Commissioner on 14 February 2019. The Commissioner
decided that section 40(2) applied:
a. This was a request for personal data, so could only be disclosed if it was lawful in
accordance with the data protection principles.
b. There may be legitimate interests in knowing who the PHSO uses when clinical
advice is required.
c. Disclosure would be reasonably necessary to meet these interests.
d. However, the legitimate interests were insufficient to outweigh the data subjects’
fundamental rights and freedoms. The individuals had a reasonable expectation that
the information would not be disclosed, and the Commissioner was satisfied that
there was a real risk they would be vulnerable to harassment if their names were
released to the world at large.
The Appeal and Responses
6. The appellant appealed on 11 July 2019. His grounds of appeal are:
a. There is no reason in principle why the clinicians’ names should not be released
when the names of other senior grade 2 staff were provided.
b. He does not accept that disclosure of the names would led to harassment – he was
not seeking information linking individual clinicians to a particular report, he disputes
that individuals would compile a mosaic of information to identify who wrote which
report, any campaigns would be nipped in the bud as the NHS has procedures in
place to deal with this, and senior clinicians are not “shrinking violets” who fall to
pieces when their professional opinions are challenged.
7. The Commissioner’s response can be summarised as follows:
a. She was correct to give weight to the PHSO’s policy regarding the identity of clinical
advisers when considering their reasonable expectations, which is based on a policy
that they will remain anonymous to safeguard their objectivity and privacy, and so
they are not exposed to public pressure and harassment.
b. Although a complainant may receive the names and advice of clinical advisers in a
draft report, this is anonymised in the final report and the complainant is advised that
this is confidential by law.
c. She was entitled to accept the word of the PHSO that, based on its experience, there
was a real risk of harassment – either by being contacted by those dissatisfied with
the PHSO’s findings, or by internet campaigns, including by compiling a mosaic of
information.
d. In the alternative, even if lawful, disclosure would not be fair for the same reasons.
8. The appellant’s reply maintains that the 23 clinicians cannot reasonably expect anonymity,
when their names are divulged in draft reports which may result in harassment. He also
questions the Commissioner accepting the word of the PHSO without having seen evidence.
He says that releasing the information would increase the transparency of the PHSO while
maintaining anonymity of clinicians with regard to individual reports. He questions a public
body giving anonymity to nearly 50% of senior staff, and says there is a high public interest in
knowing who they are in light of a staff turnover rate of 43% in 2017/18. The appellant also
says that the question of distress should be “undue” distress, and reiterates that clinical
advisers are resilient professionals.
9. The PHSO was made a party to the appeal on 6 September 2019. The PHSO has not
submitted a formal response to the appeal.
10. This appeal was originally listed for paper determination on 3 February 2020. The Tribunal
panel decided that they required further information, and made directions on 14 February 2020
for the PHSO to provide a submission addressing various listed points. The PHSO provided
submissions, which we have considered and we address below. The appeal was relisted to be
considered by this Tribunal panel.
Applicable law
11. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
2 Effect of the exemptions in Part II.
…….
(2) In respect of any information which is exempt information by virtue of any
provision of Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring
absolute exemption, or
(b) in all the circumstances of the case, the public interest in maintaining
the exemption outweighs the public interest in disclosing the
information.
……..
40 Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
(2) Any information to which a request for information relates is also exempt
information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the
public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act
2018 (manual unstructured data held by public authorities) were disregarded.
.……
58 Determination of appeals.
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion
differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
12. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA.
13. The data protection principles are those set out in Article 5(1) of the General Data
Protection Regulation (“GDPR”), and section 34(1) of the DPA. The first data protection
principle under Article 5(1)(a) GDPR is that personal data shall be: “processed lawfully, fairly
and in a transparent manner in relation to the data subject”.
14. To be lawful, the processing must meet one of the conditions for lawful processing listed
in Article 6(1) GDPR. These include where “processing is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party, except where such interests
are overridden by the interests or fundamental rights and freedoms of the data subject which
require protection of personal data” (Article 6(f)). The GDPR goes on to state that this
condition shall not apply to processing carried out by public authorities in the performance of
their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be
used as a lawful basis for the disclosure of personal data under FOIA.
15. The balancing test in Article 6(f) involves consideration of three questions (as set out by
Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013]
UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
16. In Goldsmith International Business School v Information Commissioner and the
Home Office [2014] UKUT 563 (AAC), Upper Tribunal Judge Wikeley set out a number of
propositions taken from case law as to the approach to answering these questions. These
include: “necessity” carries its ordinary English meaning, being more than desirable but less
than indispensable or absolute necessity; and the test is one of “reasonable necessity”,
reflecting European jurisprudence on proportionality.
17. Section 40(2) is an absolute exemption, and so not subject to the public interest test, where
the first condition applies (disclosure would contravene any of the data protection principles).
Issues and evidence
18. The issue in the case is whether the exemption in section 40(2) applies to the Withheld
Information, based on whether the processing of the in-house clinicians’ personal data would
breach the data protection principles. This can be broken down into the following issues:
a. Are the names of the in-house clinicians personal data?
b. Are there legitimate interests in disclosure of the data?
c. Is the disclosure necessary for the purpose of those legitimate interests?
d. Are such interests overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data?
19. In evidence we had an agreed bundle of open documents, which included the appeal,
Commissioner’s response, and appellant’s reply. We also had the submissions from the PHSO.
Discussion and Conclusions
20. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review
any finding of fact on which the notice in question was based. This means that we can review
all of the evidence provided to us and make our own decision. We deal in turn with the issues.
21. Are the names of the in-house clinicians personal data? Yes, these are clearly names
from which the clinicians can be personally identified. Disclosure of the names under FOIA
would be processing of this personal data.
22. Are there legitimate interests in disclosure of the data? There are a number of
legitimate interests for disclosure of the names of the clinicians, as identified by the appellant.
The in-house clinicians provide clinical advice to assist the PHSO decide on the merits of a
complaint. The appellant puts forward a number of linked interests in disclosure:
a. He says that there is a general interest in transparency of the PHSO, including
knowing the identity of the clinicians who are employed to provide advice. The
appellant complains that at the moment their identity is “cloaked in anonymity”.
b. He says that there is public interest in knowing who the senior staff are because the
PHSO has a high turnover rate (43 percent in 2017/18), and this may be contributed
to by a culture of anonymity at the top of the organisation. We accept that this is a
potential legitimate interest, although it is not clear to us how the anonymity of 23
clinical advisers is relevant to the overall staff turnover of the PHSO.
c. In his reply, the appellant also says that blanket anonymity could mean that the public
would not know about the PHSO past of a clinical adviser later exposed as a “dodgy
doctor”. If complainants knew the names of clinical advisers, they could contact the
PHSO if a particular individual who was later found to be unqualified had written a
report on them. We accept that this is also a potential legitimate interest in the
information. We note that it is the PHSO’s role to verify the credentials of their in-
house advisers and it is likely they would become aware of any concerns about
current or previous advisers’ qualifications in any event, but there may be some
additional interest in the public having access to this information as well.
23. Is the disclosure necessary for the purpose of those legitimate interests? We find
that disclosure is necessary for the purpose of the interests put forward by the appellant,
applying the test of reasonable necessity. There is no obvious less intrusive way of furthering
these interests, including in particular the interest in general transparency of the identity of the
in-house clinicians engaged by PHSO.
24. Are such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data?
25. We find that the in-house clinicians do have a reasonable expectation that their names will
remain confidential and will not be disclosed to the world at large. The PHSO explains in its
submissions that it has always taken the view it is not appropriate to publish the names of
clinical advisers – whether in-house or external. This is in order to safeguard their privacy and
objectivity. The policy is set out in the Ombudsman Service Model Guidance, and we accept
that the clinical advisers are aware of this approach.
26. The appellant says that this is not a reasonable expectation. He refers to the fact that the
names of clinicians may be given in draft reports which are shown to the complainants in PHSO
cases before publication. However, these reports are anonymised before being published.
The draft reports are provided to complainants in confidence with an express requirement that
they are not disclosed to anyone else. This is very different from publication to the world at
large. The appellant also says that some individuals choose to reveal that they provide reports
for the PHSO. The PHSO accepts this may be the case, but says the majority of clinicians
choose not to do so. We find that the fact some individuals choose to make their names public
does not prevent there being a general reasonable expectation amongst the in-house clinicians
that their names will not be disclosed, based on the PHSO’s published policy.
27. The PHSO says that in-house clinicians would be exposed to potential harassment if their
names were disclosed, which would cause distress. We note that the PHSO did not provide
any specific examples of this having occurred due to someone being named as an in-house
adviser (as opposed to named as having been involved in a particular case). However, we
accept that there is a real risk that clinical advisers may nevertheless be vulnerable to
harassment – either by being contacted by individuals who were dissatisfied with PHSO
findings, or by being subjected to internet campaigns. We are aware that some harassment of
this nature can be very persistent, and is likely to cause distress to the person targeted.
28. The appellant says that he is only asking for a name which shows that someone is an in-
house clinician at the PHSO, and this would not link that person with particular reports.
However, we agree that there is a real risk a clinician would be linked with particular reports
through a mosaic effect, where an individual searches for information from different sources
based on the person’s name and uses this to mount a campaign against that person. In
addition, as noted by the Commissioner, the anonymised spreadsheet we have seen shows
that there is only one person listed for a number of specialities. The PHSO has explained that
in-house clinicians are very likely to be used for a report if they have the required competence
and availability (and no conflict), and otherwise external advisers are used. This indicates that
the listed in-house clinicians are likely to be used for all appropriate reports in their area of
expertise. For those specialities where there is only one name, those individuals are likely to
be assumed to have been involved with reports on that speciality, and so would be particularly
vulnerable to harassment if their names were published.
29. The appellant says that clinicians are robust rather than “shrinking violets”, and may be
subject to harassment in their NHS roles. However, we find that confidential doctor-patient
relationships in the NHS are very different from the role of providing reports for the PHSO. The
clinicians choose to assist the PHSO with this important work. They provide reports which the
PHSO then takes into account when deciding often contentious complaints. This work is more
likely to result in harassment from disgruntled complainants and/or internet campaigns than the
clinician’s general NHS work. We also note a combination of information-gathering on an
individual and persistent campaigns using social media platforms can be extremely distressing,
including for senior professionals who carry out difficult work.
30. The appellant says that the release of names in draft reports is more likely to result in
harassment by a particular complainant than a general release of names. We note the PHSO
says that name may be released in draft reports, so this does not always happen, and that
when it does it is released in confidence and removed from the published version of the report.
They also say that they ensure they have consent from the clinical adviser before disclosing
their name. This means the individual has control over the disclosure of their name, which is
very different from publication to the world at large.
31. We therefore find that the legitimate interests put forward by the appellant are overridden
by the in-house clinicians’ expectation of privacy, based on the real risk of harassment if their
names were published and the distress that this is likely to cause. Although there are legitimate
interests in disclosure of the information, these are outweighed by the requirement to protect
personal data in this case.
32. We dismiss the appeal and uphold the decision of the Commissioner.
Hazel Oliver
Judge of the First-tier Tribunal
Date: 14 November 2020
Date Promulgated: 16 November 2020