First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2019/0316 P
Before
JUDGE HAZEL OLIVER
Sitting in Chambers on 23 March 2020
Between
MR KHAN
Appellant
and
INFORMATION COMMISSIONER
Respondent
DECISION
The appeal is dismissed.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 9 August (FS50812088, the “Decision Notice”). It concerns information sought from the
Local Government and Social Care Ombudsman (“LGSCO”) under the Freedom of Information
Act 2000 (“FOIA”) about the number of cases involving the death of a hospital in-patient which
LGSCO has investigated, and the number of such cases that two named individuals had
investigated. The request is made against the background of the death of the appellant’s father
in hospital, which was investigated by LGSCO.
2. The parties and the Tribunal agreed that this matter was suitable for determination on the
papers in accordance with rule 32 Chamber’s Procedure Rules.
3. On 7 December 2018 the appellant made the following request for information through his
solicitors (the “Request”):
“(1) How many hospital in-patient death complaints have the LGSCO investigated;
(2) How many hospital in-patient death complaints has [named officer A] (LGSCO case
handler) investigated;
(3) How many hospital in-patient death complaints has [named officer B] (LGSCO
superviser) managed and/or investigated. Can you please acknowledge the above FOIA
request. I look forward to receiving the information within the stipulated timeframe.…...”
4. LGSCO responded on 7 January 2019. It refused to provide the requested information in
reliance on section 12 FOIA (cost of compliance) and section 40(2) FOIA (personal information).
LGSCO upheld its original decision in an internal review on 13 February 2019.
5. The appellant initially complained to the Commissioner on 7 January 2019, and the
complaint was investigated after conclusion of the internal review. During her investigation the
Commissioner obtained detailed information about how searches for the requested information
could be carried out, including during a telephone conversation with the Information and
Records Officer at LGSCO.
6. The Commissioner issued her Decision Notice on 9 August 2019. She found that LGSCO
was entitled to refuse the first part of the Request under section 12, but had not complied with
its duty under section 16 to provide advice and assistance. She also found that LGSCO was
entitled to refuse the requests relating to specific individuals under section 40(2).
7. LGSCO wrote to the appellant on 30 August 2019 to advise him that they would be able to
respond within the appropriate time limit if he refined his request to the number of closed
complaints investigated by them under the subcategory “Hospital acute services: Inpatient” for
the years April 2015 to March 2019.
The Appeal
8. The appellant appealed against the Commissioner’s decision on 9 August 2019. The initial
appeal document referred to the first part of the Request – the number of cases investigated
by LGSCO. The appellant sent some subsequent emails to the Tribunal which also refer to the
second part of the Request - information about named individuals. Although these emails were
not included in the appeal document, I will consider them as part of the overall appeal grounds.
These grounds can be summarised as follows:
a. The request relating to LGSCO could have easily been fulfilled as they handle very
few death incidents, only one or two in total. Their own reports say less than 1% of
their cases are health cases.
b. LGSCO could easily filter down to the likely one death incident with the new computer
system they have.
c. The health, safety and wellbeing of the public outweighs the privacy rights of the
named individuals. It is of public interest and also in the interest of public safety to
know how experienced the investigator was in handling such critical investigations.
LGSCO could easily identify the number of investigations that an investigator has
carried out by entering their name onto the computer system.
9. The Commissioner’s response maintains that LGSCO would have had to undertake
extensive searches to identify the information about investigations carried out by LGSCO,
which would exceed the appropriate limit. It also maintains that the moderate legitimate interest
in disclosure of the requested information about named individuals is outweighed by the rights
of the data subjects. I address the Commissioner’s arguments on these points in the discussion
below.
10. The appellant sent a reply on 4 October 2019 which repeats his point about the low number
of serious health cases handled by LGSCO. He also complains about a lack of response from
LGSCO to two voicemail messages he left after their letter of 30 August about refining his
request. The appellant also sent further submissions on 6 October which provide details about
the situation involving his father, why he felt the LGSCO investigation was handled
incompetently, and why the public has the right to know that decisions made by public servants
are made by competent and experienced people.
Applicable law
11. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
….
12 Exemption where cost of compliance exceeds appropriate limit.
(1) Section 1(1) does not oblige a public authority to comply with a request for
information if the authority estimates that the cost of complying with the
request would exceed the appropriate limit.
….
40 Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
(2) Any information to which a request for information relates is also exempt
information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the
public otherwise than under this Act would contravene –
(a) any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act
2018 (manual unstructured data held by public authorities) were
disregarded.
…..
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion
differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
12. The “appropriate limit” under section 12(1) is £600 for central government and £450 for
any other public authority (regulations 3(2) and 3(3) of the Freedom of Information and Data
Protection (Appropriate Limits and Fees) Regulations 2004).
13. Costs are estimated at a rate of £25 per person per hour (Regulation 4(4)). This means
that the limit for a public authority (which is not central government) is exceeded after 18
hours of work. The costs which a public authority can take into account are set out in
Regulation 4(3) as follows: (a) determining whether it holds the information; (b) locating the
information, or a document which may contain the information; (c) retrieving the information,
or a document which may contain the information; and (d) extracting the information from a
document containing it.
14. A public authority does not have to provide a precise calculation of the cost of complying
with a request, only an estimate is required. However, it must be a reasonable estimate.
McInerney v Information Commissioner and the Department for Education [2015] UKUT
0047 (AAC) para 40 states, “[s12(1)]…depends on an estimate and…the issue for the
Commissioner is whether the estimate is reasonable. If the public authority relies on the
section before the Tribunal it will take the same approach as the Commissioner would.”
15. The data protection principles are those set out in Article 5(1) of the GDPR, and section
34(1) of the Data Protection Act 2018 (“DPA”). Section 3(2) of the DPA defines “personal data”
as “any information relating to an identified or identifiable living individual”.
16. The first data protection principle under Article 5(1)(a) GDPR provides that, “Personal data
shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.
17. In order to be lawful, processing must meet one of the conditions in Article 6(1) GDPR.
The relevant condition in this case is condition 6(1)(f) GDPR – “processing is necessary for the
purposes of the legitimate interests pursued by the controller or by a third party, except where
such interests are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data subject is a child.”
18. This involves consideration of three questions (as set out by Lady Hale DP in South
Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
Evidence and factual findings
19. I had an agreed bundle of documents, which I have read. I have also considered the
submissions set out in the appeal and associated emails, Commissioner’s response, and
further responses provided by the appellant.
20. LGSCO provided information during the Commissioner’s investigation about how the
information in the Request was held and could be searched for, as set out in the Decision
Notice. In summary:
a. LGSCO deals primarily with complaints about local authorities and adult social service
providers. It may handle complaints about a hospital patient’s treatment as part of a
“Joint Working Team” with the Parliamentary and Health Service Ombudsman (PHSO),
which deals with complaints about NHS bodies in England. Some of these complaints
may involve the death of a patient.
b. LGSCO accepts that it does hold information within the scope of the Request, namely
information about complaints in which the person receiving the treatment complained
about died in hospital.
c. This information is held on LGSCO’s case management system. This has a limited
search function. It is not possible to search by cases involving “hospital in-patient
death”. It is possible to search by the category of “health”, which will locate cases
investigated jointly with PHSO. This information is held for cases from 2015 onwards.
d. The standard search function returns a maximum of 500 cases. This means that
LGSCO would need to create a bespoke report in order to produce a complete list of
cases. In order to identify whether the case involved a hospital in-patient death, the
information on each individual case file then needs to be looked at.
e. The “initial information” on the file may show whether the case involved a hospital in-
patient death. This information is not standardised, so it may contain some detail
about the case, or may simply state “PHSO referral”. If this does not provide sufficient
detail, a second sift would involve examining the case papers on the file. LGSCO says
that in some cases this does not provide sufficient detail either. If not, the third sift
involves looking at the final “decision statement”. These are only available where an
investigation has been concluded, and so would not capture health cases that are still
open and under investigation.
21. LGSCO conducted a second sampling exercise during the Commissioner’s investigation.
It looked at seven cases in total. In two of these cases, it was quickly established that the
person affected was still alive. In the other five cases, neither the initial information nor the file
provided sufficient information, and it was necessary to look at the decision statements. It took
37 minutes to read these five statements.
22. It is possible to search cases by the name of the investigating officer. This means that it
would be possible to provide the requested information about the two named individuals within
the appropriate limit, as each would only have been involved in a limited number of health
cases.
Discussion and Conclusions
23. In accordance with section 58 of FOIA, my role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), I may review any
finding of fact on which the notice in question was based. This means that I can review all of
the evidence provided to me and make my own decision. I shall consider the appeal grounds
in turn.
24. The request relating to LGSCO could have easily been fulfilled as they handle very
few death incidents. The appellant argues that LGSCO should be able to identify the small
number of the most serious cases that they handle. He says that less than 1% of LGSCO’s
cases are health related, and probably only one or two of these are death related.
25. The Commissioner submits that extensive searches are necessary because of the manner
in which the information is stored on LGSCO’s case management system. This does not allow
efficient searching for the criterion of “in-patient hospital deaths”. Extensive searches are
therefore needed even if there are only a small number of cases which fall within this category.
The Request was not limited to a particular year, and the Commissioner was entitled to accept
LGSCO’s explanations when it has provided persuasive evidence.
26. I have seen a copy of the LGSCO annual report and accounts for 2018-19, which states
that less than 1% of total complaints and enquiries received were about “Health” (page 154 in
the bundle). 18,896 complaints and enquiries were received in 2018-19, 1% of which would
be 189 cases. Of these, 4,458 were dealt with by an investigation. The report does not give a
percentage for the number of investigations that actually related to Health. This may be more
than 1% if a higher proportion of Health complaints and enquiries result in an investigation.
The appellant is correct that less than 1% of LGSCO’s overall complaints and enquiries for
2018-19 related to Health. However, this is still a very significant number, and we do not know
what proportion of complaints were pursued further and/or were investigations related to Health.
27. LGSCO’s evidence to the Commissioner is that a search for health cases produced over
500 results. This search went back to 2015, so it did not cover just one year. I have considered
the information provided by LGSCO about how its case management system works and its
search systems, and accept this is clear and persuasive evidence. The appellant believes that
LGSCO should be able to find easily the small number of cases involving in-patient deaths.
However, the structure of LGSCO’s case management system and search function means that
an extensive review of all health cases is needed in order to identify this small sub-category of
cases.
28. I agree with the Commissioner that the time estimate originally given by LGSCO may be
excessive, taking into account the second sampling exercise carried out during the
investigation. However, even on a conservative estimate, the limit of 18 hours would clearly
be exceeded. It would take 2 hours to request, write and run the original report to produce a
list of health cases. Assuming only 500 cases and 5 minutes to review each case, this would
take some 41 hours. Some cases may take less time to review, because it is immediately clear
that the patient involved in still alive, but others may take longer. I am also satisfied that more
than 500 cases would be returned by the original search. I therefore find that responding to
the Request would exceed the appropriate limit under section 12 FOIA.
29. LGSCO could easily filter down to the likely one death incident with the new
computer system they have. As explained above, I have accepted the evidence that
LGSCO’s case management system does not allow easy filtering in this way. As noted by the
Commissioner, the appellant may understandably find this frustrating. However, the
appropriate limit is assessed on the basis of the information storage and retrieval systems that
a public authority actually has - not on the basis of ideal systems, or the systems that an
appellant thinks a public authority ought to have (Commissioner of Police for the Metropolis
v Information Commissioner and Mackenzie [2014] UKUT 0479 (AAC)).
30. The health, safety and wellbeing of the public outweighs the privacy rights of the
named individuals. The appellant says that his request about the investigations and
management of investigations into in-patient deaths carried out by the two named individuals
is in the public interest, in the context of his submissions that the investigation into his own
father’s death was handled incompetently. Taking the stages of the test in turn:
a. Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests? The appellant says that it is important that
complaints about hospital in-patient deaths are investigated properly. This means
there is a legitimate interest in knowing the experience of individuals who carry out
such investigations as part of ensuring that they are competent to do so. I accept
that there is a legitimate interest in ensuring the quality of investigations into health
care and the causes on in-patient deaths, and this is being pursued by the appellant’s
Request.
b. Is the processing involved necessary for the purposes of those interests?
“Necessary” in this context means more than desirable but less than indispensable
or absolute necessity. The appellant says that the public have the right to know that
decisions on their safety are made by competent and experienced people, and
LGSCO are seeking to hide these individuals’ inexperience which put the public at
risk. As noted in the Commissioner’s Decision Notice, the types of cases an
individual has previously investigated may be a contributory factor in relation to their
competence when investigating a particular matter. I find that this is sufficient to
make the processing necessary for the purposes of the legitimate interests set out
above.
However, I agree with the Commissioner that experience is only a contributing factor.
The types of cases previously investigated or managed does not determine
competence, or ensure that any investigations and/or decisions are correct or robust.
I note the evidence provided by LGSCO to the Commissioner about recruitment of
its investigators. There is a standard job description which requires certain skill,
knowledge and experience in investigative techniques, and probationary periods are
used before an individual acquires the delegated authority to make decisions for the
Ombudsman. LGSCO does not recruit for experience in particular types of
investigations, and investigators are expected to investigate all types of complaints.
This indicates that none of the investigators specialise in health investigations, and
so knowledge of an investigator’s experience in this specific area would provide only
limited information about their competence and skill level. In addition, individuals
investigating a complaint jointly with PHSO would have access to the knowledge and
resources of both LGSCO and PHSO.
c. Are such interests overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data? I find that the limited
interest in knowing the experience of the named individuals in carrying out health
investigations, as explained above, is overridden by those individuals’ fundamental
rights and freedoms requiring protection of personal data.
d. The requested information is personal data within the meaning of the DPA. These
individuals have a reasonable expectation that this information will not be disclosed
to the public. Their level of experience in conducting health investigations is not
otherwise put into the public domain, and so they have a general expectation of
privacy in relation to this information. Disclosure is also likely to cause unwarranted
damage or distress to those individuals. As explained above, prior experience may
be a contributing factor towards competence, but will give only a limited picture of
performance and skill level. Nevertheless, release of this information to the public is
likely to cause inferences to be made about their professional competence. This
would be based on incomplete information and would be both intrusive and
potentially distressing for those individuals. These individual rights are sufficient to
override the limited interest in disclosure of the requested information.
31. For the avoidance of doubt, I do not find that responding to the second part of the Request
(information about cases handled by individual investigators) would exceed the appropriate
limit under section 12. This is on the understanding that cases can be filtered by the name of
the individual investigator. However, this was part of a single request for information, and
responding to the first part of the Request would exceed the appropriate limit. I also note that
requests from the same person can be aggregated for the purposes of assessing costs if they
relate to the same or similar information and are received within 60 consecutive working days
(Regulation 5 of the Freedom of Information and Data Protection (Appropriate Limits and Fees)
Regulations 2004). This means that the Request as a whole could be refused under section
12.
32. For the reasons explained above, I find that LGSCO was entitled to refuse the request for
information about investigations into hospital in-patient deaths under section 12 FOIA, and
information about such investigations by two named individuals under section 40(2) FOIA. The
appeal is dismissed.
Signed: Hazel Oliver
Judge of the First-tier Tribunal
Date: 14 April 2020