Case Reference: EA/2020/0002
First-tier Tribunal
General Regulatory Chamber
Information Rights
Decided without a hearing
On: 7 June 2022
Decision given on: 17 June 2022
Before
TRIBUNAL JUDGE HAZEL OLIVER
TRIBUNAL MEMBER ROSALIND TATAM
TRIBUNAL MEMBER DAVE SIVERS
Between
BIRMINGHAM CITY COUNCIL
Appellant
and
INFORMATION COMMISSIONER
Respondent
Decision: The appeal is allowed in part.
Substituted Decision Notice:
The Information Commissioner’s Decision Notice FS50853594 (including the Confidential Annex)
is amended as follows:
• Birmingham City Council is entitled to rely on section 40(2) FOIA (third party personal data)
to withhold the names of specific individuals as listed in the Closed Annex to this decision
(in addition to those already identified in the Confidential Appendix to the Decision Notice).
• Birmingham City Council is entitled to rely on section 21 FOIA (information accessible by
other means) to withhold the names of specific individuals as listed in the Closed Annex to
this decision.
• Birmingham City Council is entitled to rely on section 21 FOIA (information accessible by
other means) to withhold information in the Secondary Bundle (as defined below).
• Birmingham City Council is entitled to rely on section 42 FOIA (legal professional privilege)
to withhold information in the Secondary Bundle (as defined below).
© CROWN COPYRIGHT 2022
• The remainder of the Information Commissioner’s Decision Notice FS50853594 remains
valid (including the Confidential Annex where not amended by this decision).
To the extent than it has not done so already, Birmingham City Council is to disclose the parts of
the Primary Bundle and Secondary Bundle (as defined below) containing the personal data to
which sections 40(2), 21 and 42 do not apply. This is to be done within 42 days of the date when
this decision is sent to the parties.
Failure to comply may result in the Tribunal making written certification of this fact to the Upper
Tribunal, in accordance with rule 7A of the First-tier Tribunal (General Regulatory Chamber) Rules,
and may be dealt with as a contempt of court.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated
4 December 2019 (FS50853594, the “Decision Notice). The appeal relates to the application of the
Freedom of Information Act 2000 (“FOIA”). It concerns information about the handling of a previous
FOIA request which was requested from Birmingham City Council (the “Council”).
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can
properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-
tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. The background to this matter is a previous request made by the requester to the Council
under FOIA, for information relating to the Trojan Horse affair (the “Original Request”). The Trojan
Horse affair/letter refers to the alleged conspiracy to introduce strict Islamic principles into schools
in Birmingham, which was originally raised in an anonymous letter. This request was subject to a
decision notice by the Commissioner (FS 50805864) which found that the Council had not been
entitled to rely on section 30 FOIA to withhold information, time compliance breaches, and general
poor handling of the request.
4. On 27 November 2018, the requester wrote to the Council and requested the following
information (the “Request”):
“I am requesting under the Freedom of Information Act all information and records held by the
Birmingham City Council relating to the consideration and processing of the previous FOI
request I submitted with reference number 1076136.”
The requester made it clear that he was asking for all internal information and records, including
those relating to the review decision in his Original Request.
5. The Council responded on 24 January 2019. It provided some information. It withheld other
information under Regulation 40(2) FOIA (third party personal data) and 42 FOIA (legal professional
privilege). The requester asked for an internal review on 15 March. The Council responded on 15
April and upheld its decision in relation to section 42, and did not refer to section 40(2).
2
6. The appellant complained to the Commissioner on 7 June 2019. The Commissioner decided:
a. The withheld information consisting of names, email addresses and other contact
information of Council staff, was personal data about those individuals.
b. The Council accepted that there was a legitimate interest in understanding how decisions
were made and who made them, given the requester’s experience of how the Original
Request was handled. The Council also accepted that disclosure was necessary to meet
the legitimate interests of transparency and accountability, but only the names and job
titles of staff.
c. The Council was entitled to rely on section 40(2) to withhold personal data of junior
administrative staff involved in the handling of the Original Request. The legitimate
interests in disclosure did not outweigh the individuals’ fundamental rights and freedoms.
d. The Council was not entitled to rely on section 40(2) to withhold personal data of senior
staff or those with a decision-making role in the handling of the Original Request, which
consisted of names and job titles. There was sufficient legitimate interest in disclosure
of this information to outweigh these individuals’ fundamental rights and freedoms. In
addition, disclosure would be fair and transparent.
e. The Council was entitled to rely on section 42 to withhold information that was subject to
legal professional privilege.
7. The Council was required to disclose pages from three redacted bundles, including the
personal data to which section 40(2) did not apply as set out in a Confidential Appendix. The Council
was also ordered to disclose a 1120 page bundle that had been disclosed to the Commissioner, with
personal data redacted as detailed in a Confidential Appendix.
The Appeal and Responses
8. The Council appealed on 31 December 2019. Its grounds of appeal relate to the information
that it was required to disclose by the Commissioner. The appeal related to the information to be
disclosed from the three redacted bundles (referred to as the “Primary Bundle”), and information to
be disclosed from the 1120 page bundle (the “Secondary Bundle”).
9. In relation to the Primary Bundle, the Council does not dispute the Commissioner’s analysis in
the Decision Notice. However, the Council says that the Confidential Annex was marked-up
incorrectly. Some data subjects’ information was marked as “N” (meaning it should be disclosed)
when it should have been marked as “Y” (meaning it could be withheld).
10. In relation to the Secondary Bundle, there are three issues:
a. The Commissioner was too restrictive in the personal data permitted to be withheld
(marked “Y” in the Confidential Annex).
b. Some information is exempt under section 42(1) FOIA, for the same reasons as were
accepted for the Primary Bundle.
c. Some information is exempt under section 21 FOIA (information reasonably accessible
by other means).
11. The Commissioner’s response maintains that the Decision Notice was correct in relation to the
application of section 40(2) to the Primary and Secondary Bundles. The response accepts that
sections 42(1) and 21 can be relied on to withhold information in the Secondary Bundle as described
by the Council.
3
12. The requester was joined to the proceedings, but later made an application to withdraw from
the proceedings which was granted. There was a delay in these proceedings coming to a full hearing
due to a preliminary issue relating to territorial jurisdiction. The case was stayed until the Tribunal’s
decision on this point (announced verbally on 27 January 2021) which allowed the case to proceed.
Applicable law
13. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the
description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
2 Effect of the exemptions in Part II.
…….
(2) In respect of any information which is exempt information by virtue of any provision of
Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring absolute
exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exemption
outweighs the public interest in disclosing the information.
……..
40 Personal information.
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual
unstructured data held by public authorities) were disregarded.
…….
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that
he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been
served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in
question was based.
14. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
4
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA.
15. The data protection principles are those set out in Article 5(1) of the General Data Protection
Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a)
General Data Protection Regulation (GDPR) is that personal data shall be: “processed lawfully, fairly
and in a transparent manner in relation to the data subject”. To be lawful, the processing must meet
one of the conditions for lawful processing listed in Article 6(1) GDPR. These include where “the
data subject has given consent to the processing of his or her personal data for one or more specific
purposes” (Article 6(1)(a)). It also includes where “processing is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The GDPR
goes on to state that this condition shall not apply to processing carried out by public authorities in
the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article
6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA. (The GDPR
rather than the new UK GDPR applies in this case as the Request was prior to 1 January 2021).
16. The balancing exercise under Article 6(1)(f) involves consideration of three questions (as set
out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013]
UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a
legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
17. The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
Issues and evidence
18. There have been various developments since the appeal was filed, and only a limited number
of issues now remain in dispute. Based on the Commissioner’s closed submissions, it appears that
the following matters are now agreed:
a. The Commissioner agrees that redactions can be made to the Secondary Bundle on same
basis as for the Primary Bundle, under section 42 FOIA (legal professional privilege) and
section 21 FOIA (information accessible by other means).
b. The Council has potentially agreed to disclosure of three further names, on the basis that
the requester liaised with these individuals when he made the Request. The
Commissioner says he was told by the Council’s representative that they intend to release
these names after these proceedings are concluded. One of these is the individual who
has provided an open witness statement in these proceedings. The other individuals are
more junior members of staff. We note that disclosure to the world at large under FOIA is
5
different from names the requester happens to know, and so consider these individuals in
our discussion below.
c. The Commissioner agrees that some additional names are exempt under section 40(2)
FOIA, and one name under section 21 FOIA.
19. We have set out in a Closed Annex to this decision each of these names, the applicable
exemption, and whether they should be disclosed.
20. The remaining dispute relates to four named individuals. We have also considered the
application of section 40(2) to the other three individuals discussed in paragraph 18(b) above. The
issue for determination is whether section 40(2) FOIA can be relied on to withhold these names and
associated job titles from the Primary and Secondary Bundle. It is accepted by the parties that this
is personal data. The issues for us to decide are:
a. Is the data controller or third party or parties to whom the data are disclosed pursuing a
legitimate interest or interests?
b. Is the processing involved necessary for the purposes of those interests?
c. Are such interests overridden by the interests or fundamental rights and freedoms of the
data subjects which require protection of personal data?
21. We had the following, all of which we have taken into account in making our decision:
a. An agreed bundle of open documents.
b. A witness statement from Malkiat Thiarai, Head of Corporate Information Governance
Unit. This covers the approach to the Request, background context relating to the
requester and the Trojan Horse affair, issues with the Commissioner’s decision relating
to the Original Request, and the basis for the appeal on withholding various names which
focusses on the implications for the more junior staff.
c. A closed bundle of documents and supplementary closed bundle containing the relevant
withheld information.
d. Closed further submissions from the Commissioner.
Discussion and Conclusions
22. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review any
finding of fact on which the notice in question was based. This means that we can review all of the
evidence provided to us and make our own decision.
23. Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests? The Council argues in its appeal that there is no legitimate
interest in disclosure of the personal data of these data subjects, because they do not occupy senior
roles, they are not decision-makers in practice, and their roles are not public-facing. The
Commissioner’s position is that the named individuals had some or some significant influence on the
processing of the Original Request, and there is a legitimate interest in ascertaining who shaped the
way that request was handled and in transparency in order to understand what happened with this
request. We accept that the requester is pursuing a legitimate interest in seeking to understand what
went happened with the response to his Original Request, in the context of the Trojan horse
affair/letter which is a highly controversial issue and continues to be a matter of public interest.
6
24. Is the processing involved necessary for the purposes of those interests? We start with
the four individuals in dispute. Having considered this issue carefully, we find that disclosure of the
four individuals’ names is not reasonably necessary for the purpose of this legitimate interest. We
have applied the test of reasonable necessity and considered whether there are less intrusive ways
of achieving the relevant aim. This is for the following reasons.
a. We have considered the roles of the individuals. None of them are senior in the sense
of having final accountability for decisions made by the Council. One is head of an area,
and three out of the four are in more junior roles.
b. More importantly, they all provide internal services to the Council. Correspondence to
the public is not written in their names. Their work in relation to this matter involved
providing internal advice and assistance to others whose names have already been (or
will be) disclosed.
c. The legitimate aim here is understanding what took place in relation to the Original
Request. This can largely be satisfied by seeing internal communications (when not
covered by other exemptions), and knowing the names of the key decision-makers who
were actually responsible for providing the response to the Original Request. These four
individuals did not make final decisions. Although there is a reference to the most senior
individual reviewing and approving the response, in context we understand this as a final
check by an internal adviser – it does not mean that this individual is responsible for the
decision.
d. The Commissioner says that there is a legitimate interest in disclosure of staff names
where they had some significant influence on the processing of the Original Request –
so that an interested individual can ascertain who shaped the way this was handled. We
disagree in this case. There may be situations in which it is necessary to know the
names of staff involved in the internal handling of a particular matter in a public authority,
but that is not the case here. We do not see that disclosure of these individual names
(as opposed to redacted internal documents showing what happened) is necessary to
understanding how the Council handled the Original Request.
e. We therefore find that knowing the names of these four internal advisers adds little if
anything to the legitimate aim, and so is not reasonably necessary or proportionate in
light of the information and names that have already been provided.
25. Are such interests overridden by the interests or fundamental rights and freedoms of
the data subjects which require protection of personal data? Although we have found that
disclosure is not reasonably necessary, we have gone on to consider the balancing test on the basis
that the necessity threshold was met. We find that the four individuals’ privacy rights do override the
legitimate interests in disclosure.
26. The legitimate interests in disclosure of these four names is limited, for the reasons set out in
paragraph 24 above. Disclosure of these four names may add something to the overall
understanding of how the Original Request was handled. The names may provide additional
transparency. But disclosure of the internal documents and the names of the accountable decision
makers already largely explains what happened.
7
27. We have balanced the interest in disclosure against the privacy rights of the four individuals.
We have looked at their reasonable expectations of privacy and the context of the Request.
28. The four individuals did not occupy public facing roles. They provide internal advice and
support to others in the Council. Although in some cases this may be at a relatively senior level,
salary and job title alone is not a reliable indication of reasonable expectations. None of these
individuals are accountable to the public for decisions made by the Council. We agree with the
Council’s submissions in its appeal that these individuals would reasonably expect that their personal
data would not be disclosed to the public in this context.
29. We note the following from the Commissioner’s guidance on requests for personal data about
employees and public facing roles: “It may also be fair to release more information about employees
who are not senior managers but who represent your organisation to the outside world, as a
spokesperson or at meetings with other bodies. This implies that the employee has some
responsibility for explaining the policies or actions of your organisation. However, it does not apply
simply because an employee deals with enquiries from the public or sends out material produced by
others.” None of the four individuals here represent the Council to the outside world.
30. The Commissioner makes the point that these staff had some influence on how the Original
Request was handled. His closed submissions detail the reasons why each of these individuals had
a key role in handling the Original Request. We agree that these individuals were all involved in
providing internal advice and assistance in relation to the response to the Original Request. We also
agree that in some cases it may be appropriate to disclose names of junior staff who are not public
facing. However, we do not agree that they had a “key” role as described by the Commissioner.
The three more junior members of staff provided internal drafting and other advice – but they were
not the ultimate decision makers. The more senior individual reviewed and approved the response.
But we regard this as part of an internal advisory role, as explained in paragraph 24(c) above. This
individual was not the ultimate decision-maker, and was not public facing.
31. We have also considered the likelihood of distress to the data subjects if their names are
released. We have considered this in the context of the Trojan Horse affair/letter, which was and
remains a sensitive and controversial matter. This increases the risk that these individuals will be
targeted or publicly criticised for their role in advising on the Original Request, simply because that
was related to the Trojan Horse affair. We do not suggest that this would necessarily be done by
the requester. We do not think that it is necessary for us to engage with the parties’ representations
about the requester’s conduct and journalistic intentions. We have taken into account the fact that
disclosure under FOIA is disclosure to the world at large. We agree that release of these names
could lead to distressing or harassing conduct from members of the public, taking into account the
background context. It may be appropriate to name senior officers at the Council who are public
facing and accountable for the Council’s decisions, despite the risk of criticism or harassment.
However, the four individuals in question would not reasonably expect to have their names released
in this context, and it would not be fair to do.
32. We note the Commissioner’s position that the Council was only required to release names and
job titles, not email addresses or telephone numbers. We do not agree that this limits the risk of
criticism or harassment. Email addresses can be researched or constructed from the usual structure
of addresses at the Council, and individuals can be telephoned through a central switchboard.
Release of names at a Council immediately opens up the possibility that those individuals can be
contacted by email, telephone, or even in person at the Council’s offices.
8
33. We therefore find that the data subjects’ reasonable expectations of privacy and risk of distress
or harassment outweighs the legitimate interests in disclosure of their names.
34. We have also considered the three names discussed in paragraph 18(b) above, which the
Council says it intends to release after these proceedings because they are known to the requester.
One of these individuals is a senior employee and has provided an open witness statement for these
proceedings. It appears he does not have a reasonable expectation that his name will be withheld
and he is not concerned about his name being linked with this matter, and so section 40(2) does not
apply. The other individuals are more junior employees in a similar position to the four individuals
discussed above. They do not appear to be in public facing roles or accountable for the Council’s
decisions. We have not had any detailed submissions on their position, but based on the documents,
we find that the same considerations apply as for the other four individuals. Their reasonable
expectations of privacy and risk of distress or harassment outweighs the legitimate interests in
disclosure of their names.
35. We note that the Council’s lengthy witness statement gives considerable detail on why the
Commissioner’s Decision Notice in relation to the Original Request contained errors of fact and law,
which meant the decision on this Request was based on a false premise about lack of compliance.
The Commissioner disagrees with the majority of these points. It is not necessary for us to decide
this issue in order to decide this case. The requester has a finding from the Commissioner that his
Original Request was not dealt with correctly, and this provides the legitimate interest in finding out
how that request was handled by the Council.
36. In summary - we do not agree with the Commissioner’s decision that the four names in dispute
should be disclosed. We also find that two other names are exempt from disclosure, despite the
Council’s intention to release these names to the requester. The Council was entitled to rely on
section 40(2) to withhold these names. This is because disclosure would not be lawful under the
DPA. Disclosure is not necessary for the interests in understanding what happened in relation to
the Original Request, and in any event these interests are overridden by the individuals’ privacy
rights.
37. We uphold the appeal in part. We issue the Substitute Decision Notice set out at the start of
this decision. This covers:
a. Our decision on the application of section 40(2) to four names where this remained in
dispute between the parties, and in relation to two further names.
b. The withholding of names under section 21 and 40(2) as has been agreed by the
Commissioner.
c. The agreed application of section 42 to the Secondary Bundle.
d. The agreed application of section 21 to the Secondary Bundle.
Signed Judge Hazel Oliver Date: 15 June 2022
Promulgated Date: 17 June 2022
9
10