First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2020/0212P
Decided without a hearing on 13 September 2021
Before
JUDGE BUCKLEY
DAVE SIVERS
MICHAEL JONES
Between
MICHAEL RICHARDSON
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
DECISION
1. For the reasons set out below the appeal is dismissed.
MODE OF HEARING
2. The parties and the Tribunal agreed that this matter was suitable for
determination on the papers in accordance with rule 32 Chamber’s Procedure
Rules.
REASONS
Introduction
1
1. This is an appeal against the Commissioner’s decision notice FS50908339 of 11 June
2020 which held that the University of London (The University) was entitled to rely
on s 40(2) of the Freedom of Information Act 2000 (FOIA). The Commissioner did
not require the public authority to take any steps.
Factual background to the appeal
2. The appeal relates to President Tsai Ing-wen. There has been speculation in the
media about whether President Tsai was correctly awarded a PhD in Law in 1984.
Requests, Decision Notice and appeal
The Request
3. This appeal concerns the following request made on 29 October 2019:
I am requesting the names of the Examiners for the 1984 Ph.D. thesis of Tsai Ing-wen.
The thesis is entitled “Unfair Trade Practices and Safeguard Actions”. Please also inform
me of the date the Examiners signed approval of the thesis.
The response
4. The University replied on 2 December 2019 withholding the information on the
basis that it was exempt under s 40(2) FOIA because disclosure would breach the
data protection principles.
5. Mr Richardson requested an internal review on 3 December 2019. The University
upheld its refusal.
6. Mr Richardson referred the matter to the Commissioner on 5 February 2020.
The Decision Notice
7. In a decision notice dated 11 June 2020 the Commissioner decided that the
University had correctly applied s 40(2) FOIA for the following reasons.
8. The information requested was, in part, personal data of the examiners (their
names). It was also personal data of President Tsai (the names of the examiners and
the date it was assessed) because it concerns the thesis she produced. The
information both identifies and relates to these individuals.
9. In the Commissioner’s view the legitimacy or otherwise of President Tsai’s thesis is
a private concern for the complainant. However, given the position of one of the
data subjects – President Tsai – she acknowledged that there may be some broader
public interest in the matter.
2
10. The University’s position is that the validity of President Tsai’s 1984 thesis is
confirmed by publicly available information. To a large degree the Commissioner
agreed that the validity of the thesis has been demonstrated and that releasing the
thesis examiners’ names and the requested date is not necessary to meet the
complainant’s legitimate interests. However, ‘for the sake of completeness’ the
Commissioner accepted that disclosure was necessary and went on the conduct the
balancing test.
11. The Commissioner stated that it was unfortunate that the original copy of the thesis
that the University held was lost or misplaced, but concluded that other
information evidences that, at the time, the thesis had been completed and assessed.
The Commissioner considers that the University has demonstrated sufficient
transparency in relation to this thesis and there is no compelling reason to doubt
that the University’s award processes were not robust in 1984 or now.
12. Such public interest as there is in the matter of this thesis is outweighed by the data
subjects’ (President Tsai, and, in particular, the examiners) reasonable expectations.
Neither President Tsai nor the examiners would have expected their personal data
to be released so many years before the introduction of FOIA. Whilst President Tsai
might reasonably expect this now the Commissioner considered that disclosure
remained beyond the examiners’ expectations. It is therefore possible that
disclosing the information would cause them distress.
13. The Commissioner concluded that there was insufficient legitimate interest to
outweigh the data subjects’ fundamental rights and freedoms. She concluded that
there was no Article 6 basis for processing and so the disclosure of the information
would not be lawful. The Commissioner did not need to go on to consider whether
disclosure would be fair or transparent.
Notice of Appeal
14. The tribunal understands the Grounds of Appeal, broadly, to be that the
Commissioner was wrong to conclude that there was insufficient legitimate interest
to outweigh the data subjects’ fundamental rights and freedoms.
15. Mr. Richardson makes the following points in particular:
15.1. The Republic of China presidential office disclosed President Tsai Ing-wen’s
student record on 4 September 2019. President Tsai Ing-wen has waived her
right to privacy and has no reasonable expectation of privacy of her student
record. Further the selective disclosure provides an unbalanced view of
events.
15.2. The student record states that she withdrew from the course in November
1982 and does not list her as a student with fees paid or name an advisor for
1982/1983 or 1083/1984. The date for submission was June 1983.
3
15.3. The Commissioner did not take account of her own guidance on suspicion
of misrepresentation or wrongdoing.
15.4. The Commissioner failed to weigh President Tsai Ing-wen’s use of her PhD
into the balancing test.
15.5. In applying the balancing test the Commissioner repeated speculation about
the absence of the thesis.
15.6. In applying the balancing test the Commissioner relied on an IALS index
which is not an official IALS record.
15.7. The thesis had not been filed with the LSE library, the Senate House library
or the IALS in accordance with academic protocol. An attempt by an
unidentified person to file a copy with the Senate House library in 2011
undermines public confidence that the thesis was properly assessed and
raises the question of academic fraud.
15.8. The unsigned copy of the thesis submitted by President Tsai to the LSE
library in 2019 appears to be a draft document.
15.9. The Commissioner speculates that the examiners are alive and therefore
subject to protection under the Act.
15.10. The Commissioner has ignored the fact that the LSE released the names of
thesis examiners to the Woolf inquiry.
15.11. Releasing the date of thesis approval would cause no more distress to the
examiners than the disclosure of the viva date, which has been disclosed.
15.12. The date is not the personal data of the examiners.
15.13. President Tsai provided consent to disclose personal information in her PhD
thesis by email dated 12 June 2019.
15.14. The individuals who approved the thesis must of necessity be identified to
protect the integrity of the University of London degree.
15.15. To protect the transparency of the University degree process and the
integrity of the PhD degree the question of legitimacy must of necessity
outweigh any distress the examiners or President Tsai might suffer.
15.16. The examiners are gatekeepers of the University degree which means they
must be excluded from any personal data exemption.
The ICO’s response
Scope of the appeal
16. The tribunal does not have the power to make the orders set out in the grounds of
appeal, save for an order to compel the University to disclose the requested
information.
Personal data
17. The information requested concerns the President’s and the examiner’s data. The
President is still alive and the Commissioner is assuming that the examiners are
also still alive.
Lawful basis
4
Legitimate interest
18. The Commissioner recognised Mr. Richardson’s legitimate interest in the
information as he is interested in the legitimacy of the President’s 1984 thesis. The
Commissioner agreed that there was a wider public interest in the information
because the President was a public figure and there has been speculation about her
time at the University and her thesis.
Necessity
19. The test is of ‘reasonable necessity’. The Commissioner maintains that it is not
necessary for the information requested to be disclosed to the world at large
because:
a. The legitimate interest is in the validity of the President’s thesis.
b. This legitimate interest has been met to an extremely large degree by the fact
that
a. The thesis is available online;
b. there is a listing of President Tsai’s thesis ‘Unfair trade practices and
safeguard actions’ in the Institute of Advanced Legal Studies (IALS)
index document “Legal Research in the United Kingdom 1905‐1984”,
which was published in 1985;
c. The University has advised that, in its responses to separate FOI
requests, it has stated that it holds records of the viva and the pass list
in regard to this graduate – President Tsai – and can therefore confirm
the award of the degree.
20. The Commissioner concludes that releasing the names of the examiners and the
requested date is not necessary to meet the legitimate interest. The Commissioner
does not go on to consider the balancing test.
Mr. Richardson’s reply
21. The Commissioner accepted in the decision notice that disclosure was necessary
and has reversed this in the response.
22. The fact that a digital version of the copy of the thesis submitted by President Tsai
Ing-wen in June 2019 is available online raises questions about the thesis validity
and is not the version that was assessed.
23. The biographical index relied on is a quasi-official IALS index document and not
an official IALS record or communication.
24. An IALS email dated 9 October 2019 states that they do not have a copy of the thesis
in their collection and have no record that they ever received the copy that was sent
to them.
5
25. The Commissioner has relied on the University’s assertion without evidence.
26. The University’s assertions about its library acquisitions of the thesis contradict its
email dated 9 October 2019 raising doubts about the veracity of the University’s
assertions about the thesis.
27. Transparency mandates verification of the visa examination.
28. The Commissioner relies on a 2019 public relations statement from LSE but they
could not issue doctoral degrees in 1983.
29. Public Relations statements and news reports do not constitute academic
authentication or verification of the PhD thesis.
30. There should be no expectation of privacy and no distress would be caused by the
disclosure of the examiners’ identities.
31. President Tsai Ing-wen waived her privacy by issuing a public statement that one
examiner was a law professor and one an economist.
32. Current academic practice in the UK is to disclose examiner identities.
33. The tribunal has power to make the orders requested.
Evidence
34. We have read and taken account of an open and a small closed bundle of
documents.
35. It is necessary that the documents in the closed bundle are not revealed to Mr
Richardson because to do otherwise would defeat the purpose of the proceedings.
The tribunal accepts that in accordance with the guidance given by the Court of
Appeal in Browning we are required to disclose as much as possible about the
closed bundle when writing our decision.
36. In accordance with the guidance in Browning, the tribunal records that the closed
bundle is limited to a document containing the requested information i.e. the names
of the examiners and the date the examiners signed approval of the thesis.
Legal framework
Personal data
37. The relevant parts of s 40 of FOIA provide:
6
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information
if –
(a) It constitutes personal data which does not fall within subsection (1), and
(b) either the first, second or the third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act -
(a) would contravene any of the data protection principles, or..
38. Personal data is defined in s 3(2) of the Data Protection Act 2018 (DPA) as:
Any information relating to an identified or identifiable living individual
39. The definition of "personal data" consists of two limbs:
i) Whether the data in question "relate to" a living individual and
ii) Whether the individual is identified or identifiable from those data.
40. The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v
Cheyne Gardens Ltd [2017] EWCA Civ 121; Durant v FSA [2003] EWCA Civ 1746
and Edem v Information Commissioner [2014] EWCA Civ 92, from which the
following principles are drawn.
41. In Durant, Auld LJ, giving the leading judgment said at [28]:
Mere mention of the data subject in a document held by a data controller does not necessarily
amount to his personal data. Whether it does so in any particular instance depends on where it
falls in a continuum of relevance or proximity to the data subject as distinct, say, from
transactions or matters in which he may have been involved to a greater or lesser degree. It
seems to me that there are two notions that may be of assistance. The first is whether the
information is biographical in a significant sense, that is, going beyond the recording of the
putative data subject's involvement in a matter or an event that has no personal connotations, a
life event in respect of which his privacy could not be said to be compromised. The second is
one of focus. The information should have the putative data subject as its focus rather than some
other person with whom he may have been involved or some transaction or event in which he
may have figured or have had an interest, for example, as in this case, an investigation into some
other person's or body's conduct that he may have instigated. In short, it is information that
affects his privacy, whether in his personal or family life, business or professional capacity.
42. In Edem Moses LJ held that it was not necessary to apply the notions of biographical
significance where the information was plainly concerned with or obviously about
the individual, approving the following statement in the Information
Commissioner's Guidance:
It is important to remember that it is not always necessary to consider 'biographical significance'
to determine whether data is personal data. In many cases data may be personal data simply
because its content is such that it is 'obviously about' an individual. Alternatively, data may be
personal data because it is clearly 'linked to' an individual because it is about his activities and
is processed for the purpose of determining or influencing the way in which that person is
treated. You need to consider 'biographical significance' only where information is not
'obviously about' an individual or clearly 'linked to' him.
7
43. The data protection principles are set out Article 5(1) of the GDPR and s 34(1) DPA.
Article 5(1)(a) GDPR provides: that personal data shall be processed lawfully, fairly
and in a transparent manner in relation to the data subject. Article 6(1) GDPR
provides that processing shall be lawful only if and to the extent that at least one of
the lawful bases for processing listed in the Article applies.
44. The only potentially relevant basis here is article 6(1)(f):
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by
a third party, except where such interests are overridden by the interests or fundamental rights
and freedoms of the data subject which requires protection of personal data, in particular where
the data subject is a child.
45. The case law on article 6(1)(f)’s predecessor established that it required three
questions to be answered, which we consider are still appropriate if reworded as
follows
1. Is the data controller or a third party pursuing a legitimate interest or interests?
2. Is the processing involved necessary for the purposes of those interests?
3. Are the above interests overridden by the interests or fundamental rights and
freedoms of the data subject?
46. S 40(3A) is an absolute exemption and therefore the separate public interest
balancing test under FOIA does not apply.
The role of the tribunal
47. The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider
whether the decision made by the Commissioner is in accordance with the law or,
where the Commissioner’s decision involved exercising discretion, whether she
should have exercised it differently. The Tribunal may receive evidence that was
not before the Commissioner, and may make different findings of fact from the
Commissioner.
48. The tribunal is a creature of statute and does not have any inherent power to make
the orders requested by Mr. Richardson other than the power, if appropriate, to
order the University to disclose the requested information.
Issues
49. The issues for the tribunal to determine are:
49.1. Does the information relate to an identified or identifiable living individual?
49.2. Is the data controller or a third party pursuing a legitimate interest or interests?
49.3. Is the processing involved necessary for the purposes of those interests?
8
49.4. Are the above interests overridden by the interests or fundamental rights and
freedoms of the data subject?
Discussion and conclusions
Personal data
50. The tribunal has not been provided with any evidence on whether or not the
examiners are alive. In the absence of any evidence to the contrary, the tribunal
finds that the examiners, who were of working age in 1984, are more likely than not
to be alive. The examiners’ names are information that relates to identifiable living
individuals and is personal data of which they are the subject.
51. We find that the requested information is also the personal data of which President
Tsai is the subject. Taken with the request, she is clearly identifiable from that data.
The information has President Tsai as its focus and is clearly linked to or about her
because it is about the assessment of her PhD.
Legitimate interest
52. We accept that Mr. Richardson has a legitimate private interest and that there is a
broader public interest in the legitimacy of President Tsai’s PhD.
Reasonable necessity
53. We have considered whether the disclosure of the requested information is
reasonably necessary for the purposes of the identified legitimate interest.
Disclosure must be more than desirable, but less than indispensable or an absolute
necessity. Disclosure must be the least restrictive means of achieving the legitimate
aim in question, because it would not be necessary if it could be achieved by
anything less. We must consider whether the legitimate aim could be achieved by
means that interfere less with the privacy of the data subjects.
54. The University has not relied on the provision that allows it, in certain
circumstances, to neither confirm nor deny that it holds the requested information.
The closed bundle contains the requested information. In effect the University has
publicly confirmed that it holds a written record of (a) the names of the examiners
and (b) the date that the Examiners signed approval of the thesis.
55. We find that the legitimate interest can be achieved by the University’s
confirmation that there is a written record of the names of the examiners and of the
date that they signed approval of the thesis, and we find that this interferes less
with the privacy of the data subjects than releasing the specific date or the names
of the examiner. Accordingly, it is not reasonably necessary for the names or the
date to be released.
9
56. Further, we find that there is sufficient evidence already in the public domain to
satisfy Mr. Richardson’s or the public’s concerns about whether or not President
Tsai was awarded a PhD, without the need to release this particular information.
This includes the fact that the University has publicly confirmed that the degree
was correctly awarded and that it holds records of the viva and the pass list in
relation to President Tsai and the fact that the thesis appeared in the IALS list of
legal theses successfully completed for postgraduate degrees published in 1985. In
our view it is not reasonably necessary to also disclose the names of the examiners
and the date that they signed approval of the thesis.
57. Having concluded that it is not reasonably necessary to disclose the requested
information it is not necessary to consider whether the legitimate interests are
overridden by the interests of the data subjects and we find that the University was
entitled to rely on the exemption in s 40(2) FOIA.
Signed Sophie Buckley
Judge of the First-tier Tribunal
Date of Decision: 20 September 2021
Date: Promulgated: 21 September 2021
10