First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2020/0215 P
Decided without a hearing
On 2 December 2020
Before
JUDGE HAZEL OLIVER
PIETER DE WAAL
MICHAEL JONES
Between
PETER CLEASBY
Appellant
and
INFORMATION COMMISSIONER
Respondent
DECISION
The appeal is upheld in part.
SUBSTITUTE DECISION NOTICE
Exeter City Council did not act correctly in withholding the information requested by Mr Peter
Cleasby under section 40(2) of the Freedom of Information Act 2000 in relation to names of
individual suppliers who received payments from the Council in excess of £500, because
disclosure would not contravene any of the data protection principles. Names of individual
suppliers who received payments of £500 or below can be withheld under section 40(2). Exeter
City Council is to either disclose this information or explain its basis for relying on an alternative
exemption to disclosure by 20 January 2021.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 15 June 2020 (FS59823461, the “Decision Notice). It concerns information about the
names of individual suppliers contracted to provide goods and services to Exeter City Council
(the “Council”).
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it
can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. The appellant made a request for information under the Freedom of Information Act 2000
(“FOIA”) on 21 October 2019 (the “Request”), as follows:
“I attach a spreadsheet showing payments made by the Council where the supplier name
has been redacted on personal data grounds. It has been derived from the quarterly lists
of payment published by the Council, and I have sought to limit those items of payment for
commercial services. I request that the redacted supplier names be published on the
grounds that there is a clear public interest in knowing who is being paid from public funds
for commercial services.”
4. The Council responded on 13 November 2019. It updated five entries on the spreadsheet
with details of companies that had received payments. It refused to release the names of
individuals in reliance on section 40 FOIA (personal information) (the “Withheld Information”).
5. The appellant requested an internal review on 18 November 2019. The Council provided
a response on 13 December 2019 which maintained its position that the names of individuals
would not be disclosed, and provided more detailed information about why the Council believed
the exemption in section 40 FOIA applied.
6. The appellant complained to the Commissioner on 20 December 2019. The Commissioner
decided that section 40(2) applied:
a. The information is personal data, as it consisted of individuals’ first and last names.
b. The lawful basis for processing most applicable is Article 6(1)(f) GDPR.
c. There is a legitimate interest in the information being disclosed, being greater
accountability and transparency in the Council’s expenditure of public funds.
d. However, disclosure was not necessary as the published information contains
sufficient details on payments processed by the Council, and publication of names
would not significantly contribute to transparency without unwarranted intrusion into
the privacy of the named individuals.
The Appeal and Responses
7. The appellant appealed on 10 July 2020. His grounds of appeal are:
a. Article 6(1)(c) applies as a lawful basis for processing, as the Local Government
Transparency Code 2015 (the “Code”) requires publication of the beneficiaries of
payments for goods and services.
b. The absence of consent from the suppliers is of little merit, as they should have made
themselves aware of the disclosure requirements when entering into a commercial
relationship with a public body and/or the Council should have drawn their attention
to this in contractual documentation.
c. Without supplier names, there is no way of knowing how many times the same
supplier is being used, and if the Council is favouring particular suppliers. Or whether
the Council is using local suppliers. The press and public cannot ask the right
questions without knowing who the suppliers are.
8. The Commissioner’s response can be summarised as follows:
a. The individual suppliers had not consented to disclosure of their names.
b. The Code is not a legal obligation which would override the Council’s disclosure
considerations under FOIA.
c. Disclosure is not necessary for the legitimate interest put forward by the appellant,
applying the test of pressing social need and the ability to meet the legitimate interest
by another less intrusive means.
d. If the balancing test needs to be applied, it is reasonable for the suppliers to expect
their names would not be disclosed, and this would not significantly contribute to
transparency on spending of public funds.
9. The appellant’s reply says that there is a legal obligation to publish information as set out
in part 2 of the Code, and this can be done in compliance with data protection requirements.
There is a pressing social need for the information as part of concerns about counter-fraud and
transparency of tendering, and this required details of the beneficiary of the payments. There
is no less intrusive way of achieving this objective. The balancing test favours disclosure for
the same reasons.
Applicable law
10. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
2 Effect of the exemptions in Part II.
…….
(2) In respect of any information which is exempt information by virtue of any
provision of Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring
absolute exemption, or
(b) in all the circumstances of the case, the public interest in maintaining
the exemption outweighs the public interest in disclosing the
information.
……..
40 Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
(2) Any information to which a request for information relates is also exempt
information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the
public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act
2018 (manual unstructured data held by public authorities) were disregarded.
.……
58 Determination of appeals.
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion
differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
11. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA.
12. The data protection principles are those set out in Article 5(1) of the General Data
Protection Regulation (“GDPR”), and section 34(1) of the DPA. The first data protection
principle under Article 5(1)(a) GDPR is that personal data shall be: “processed lawfully, fairly
and in a transparent manner in relation to the data subject”.
13. To be lawful, the processing must meet one of the conditions for lawful processing listed
in Article 6(1) GDPR. These include:
a. Where “processing is necessary for compliance with a legal obligation to which the
controller is subject” (Article 6(c)).
b. Where “processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data” (Article 6(f)). The GDPR goes on to
state that this condition shall not apply to processing carried out by public
authorities in the performance of their tasks, but section 40(8) FOIA omits this
provision, meaning that Article 6(1)(f) can be used as a lawful basis for the
disclosure of personal data under FOIA.
14. The balancing test in Article 6(f) involves consideration of three questions (as set out by
Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013]
UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
15. Even where a lawful condition for processing applies, the data must still be processed fairly
and transparently in order to comply with the first data protection principle. This involves
considering whether: the processor has considered how the processing may affect the
individuals concerned and can justify any adverse impact; data is processed in ways that the
data subjects may reasonably expect; and data subjects are not deceived or misled about the
collection of their personal data.
16. Section 40(2) is an absolute exemption, and so not subject to the public interest test where
the first condition in section 40(3A) applies (disclosure would contravene any of the data
protection principles).
Issues and evidence
17. The issue in the case is whether the exemption in section 40(2) applies to the Withheld
Information, based on whether the processing of the individual suppliers’ personal data would
breach the data protection principles. This can be broken down into the following issues:
a. Is the Withheld Information personal data?
b. Does Article 6(c) GDPR provide a lawful basis for processing the data?
c. Does Article 6(f) GDPR provide a lawful basis for processing the data?
d. If there is a lawful basis for processing the data, would disclosure under FOIA be fair
and transparent?
18. In evidence we had an agreed bundle of open documents, which included the appeal,
Commissioner’s response, and appellant’s reply. We also had a closed bundle which showed
the Withheld Information in the spreadsheets of supplier payments.
Discussion and Conclusions
19. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review
any finding of fact on which the notice in question was based. This means that we can review
all of the evidence provided to us and make our own decision. We deal in turn with the issues.
20. Is the Withheld Information personal data? Yes, the closed bundle clearly shows that
the Withheld Information is the first and second names of individuals who have received
payments as suppliers to the Council.
21. Does Article 6(c) GDPR provide a lawful basis for processing the data?
22. The appellant says that part 2 of Code is a legal obligation, which requires publication of
the names of beneficiaries of payments in excess of £500. Regulation 2 of the Local
Government (Transparency Requirements) (England) Regulations 2015 (the “Regulations”)
provides as follows:
“An authority to which the Code applies, other than a parish council whose gross annual
income or expenditure (whichever is the higher) is £6.5 million or less, must publish the
information specified in Part 2 of the Code in the manner and form and on the occasions
specified in Part 2 of the Code”.
23. The Council and the Commissioner have both taken the position that the Code provides
guidance only, and is not a legal obligation. We disagree. These statutory Regulations clearly
make compliance with Part 2 of the Code a legal obligation for all public authorities to which
the Regulations apply. The Council is subject to the Regulations and to the Code.
24. Part 2.1 of the Code specifies that data on expenditure exceeding £500 must be published
quarterly. Paragraph 28 sets out a list of examples of items that must be published, which
includes individual invoices and payments for goods and services. Footnote 15 to this
paragraph states, “…local authorities should publish details of payments to individual
contractors (e.g. individuals from consultancy firms, employment agencies, direct personal
contracts, personal service companies etc) either here or under contract information.”
Paragraph 29 lists the information that must be published for each individual item of expenditure,
which includes the “beneficiary”. Part 2 of the Code therefore requires the Council to publish
details of the “beneficiary” (i.e. the name) of all organisations or individuals who received
payments over £500.
25. The appellant has also referred to paragraph 15 in part 1 of the Code - "The Data Protection
Act 1998 also does not automatically prohibit information being published naming the suppliers
with whom the authority has contracts, including sole traders, because of the public interest in
accountability and transparency in the spending of public money". This anticipates that the
names of sole traders may be published. Although this is subject to the requirements of the
DPA, privacy right under the DPA are not an absolute bar to disclosure. The Commissioner
has referred to paragraph 16 of the Code, which suggests anonymisation of datasets where
information “contains public data that cannot be disclosed in a Data Protection Act compliant
manner.” However, this paragraph refers to “other” situations than information about suppliers,
which is covered in paragraph 15.
26. Paragraph 22 in part 1 of the Code states that it is at the discretion of the local authority
whether or not to rely on an exemption under FOIA where applicable, or publish the data. This
paragraph goes on to state, “Local authorities should start from the presumption of openness
and disclosure of information, and not rely on exemptions to withhold information unless
absolutely necessary.”
27. We note the Commissioner’s point that the Code has not been updated for the GDPR.
However, we can apply the GDPR in making our assessment of whether it is fair to publish the
data under FOIA. The fact the Code has not been updated does not invalidate it or remove its
legal force under the Regulations.
28. We therefore find that Article 6(c) does provide a lawful basis for publishing the Withheld
Information, but only in relation to payments in excess of £500 – the processing is necessary
for compliance with a legal obligation to which the controller is subject, namely the obligation
to publish information as set out in the Regulations.
29. Although we have found there is a lawful basis for the publication of the Withheld
Information (for payments in excess of £500), it is still necessary for this disclosure to comply
with the remainder of the data protection principles. In particular, the disclosure must be fair
and transparent.
30. “Fairness” requires an assessment of the expectations of the individuals about use of their
data, and the effects of disclosure on those individuals. As put in the Commissioner’s guidance
on the DPA, “fairness means that you should only handle personal data in ways that people
would reasonably expect and not use it in ways that have unjustified adverse effects on them.”
We have relatively limited information on this point, as the Commissioner’s decision relied on
Article 6(f) and did not expressly consider the principle of fairness and transparency. We have
considered aspects of the Commissioner’s decision and response to appeal that are relevant
to this question, and also the information that was provided by the Council during the
Commissioner’s investigation.
31. In relation to whether the individuals have a reasonable expectation of privacy, the Council
has said that they do not have the explicit consent of the suppliers to publish their personal
information. They also say that it is not reasonable that they should have their personal
information published for the world at large to see, and the Council would be disclosing details
of their income that would not occur in the private sector. The Commissioner says in the
response to the appeal that she agrees it is reasonable for the data subjects to expect that their
names alongside information already published regarding their private income would not be
disclosed in the public domain.
32. We do not have any other evidence about the individuals’ expectations. It is not necessary
for the Council to have explicit consent to publish the information – an expectation that
information may be published may arise without express consent. The Council did not provide
any examples of contractual terms with suppliers that might be relevant, e.g. a commitment not
to publish individual names. These are individual suppliers who are fully aware that they are
contracting with a public authority, which is subject to rules designed to ensure transparency.
The Code makes it clear that the names of individual suppliers may need to be disclosed, and
this is not automatically prohibited by the DPA. The appellant makes the following point in his
comments on the Council’s internal review outcome (page C52 in the open bundle) – “There is
a case that people who choose to contract with public authorities should not expect the same
degree of privacy as business conducted wholly within the private sector. Government policy
on transparency, by its very existence, makes it clear that there is not a level playing field
between the two sectors.” In the absence of any specific evidence to the contrary, we agree
that individuals who choose to contract with a public authority would not necessarily expect that
their identity and amount of payments made to them would remain private.
33. In relation to the adverse effects of disclosure on the individuals, we have considered the
arguments put forward by the Council and relied on by the Commissioner. The Council said
that the information relates to the individual’s income, and publication may cause unjustified
distress as their income could then be identified. The Commissioner also refers to unwarranted
intrusion into the privacy of the named individuals by disclosing information relating to their
income. It is correct that publication of names would reveal how much those individuals were
paid for items of work for the Council. However, this is not publication of an individual’s full
private income, but simply what they charged for particular services provided to this Council.
The information would not reveal total earnings, or profit and loss. We have no evidence as to
why disclosure of this limited information would cause “distress” to individual suppliers. They
are providing a professional, commercial service to the Council, and being paid for that service
from public funds. We do not find that this would be an unjustified effect that would make
publication unfair.
34. The Council also said that publication of suppliers’ names may put them at risk. Suppliers
with unique names would be easily identified, and they may not want information about their
personal information made public, or they may not want anyone to know they are working in
and around Exeter. The Council said they were not prepared to publish the personal
information for security reasons. We do not understand this point (and note it is not addressed
by the Commissioner). We have no evidence as to how or why this would create a security
risk for suppliers, and in particular do not see how knowledge that a particular individual does
work in and around Exeter would create a security risk.
35. Having considered the above, we find that publication of the data would be fair and so
comply with that aspect of the first data protection principle.
36. We have also considered whether publication of the data would be transparent. As
explained in the Commissioner’s guidance, “Transparency is fundamentally linked to fairness.
Transparent processing is about being clear, open and honest with people from the start about
who you are, and how and why you use their personal data.” From the information we have, it
does not appear that the Council expressly tells individual suppliers that their names may be
published alongside details of payments for their services. However, as noted above, these
are individual suppliers who are fully aware that they are contracting with a public authority,
which is subject to rules designed to ensure transparency. The publication would take place in
accordance with a clear published Code which has legal force. We therefore find that
publication of the data would not breach the transparency aspect of the first data protection
principle
37. The Council’s response to the Commissioner addresses some other data protection
principles that they say would be breached by disclosure of the information. We have
considered these as follows:
a. Purpose limitation (principle (b)). The Council says the data is collected to maintain
a relationship with the suppliers and process their payment, not for the purpose of
publishing their details on the Council’s website. We do not agree – part 2 of the
Code legally requires publication of supplier details, so this must be one of the
purposes for collecting information on their identity.
b. Data minimisation (principle (c)). The Council says the other information it publishes
is sufficient for the public to hold them to account for payments made. We do not
agree. The appellant submits that the names are required to show whether particular
suppliers are being favoured, and to enable questions to be asked about competence
and suitability. The other information published by the Council does not address
these issues. We accept that these issues are relevant to transparency of supplier
payments, and note that publication of supplier identity is specifically required by the
Code.
c. Integrity and confidentiality (principle (f)). The Council refers here to the concerns
about security risks, which we have addressed and rejected above.
38. We therefore find that general publication of individual supplier names would not breach
any of the data protection principles, in relation to payments in excess of £500. Publication is
lawful as it is required by a legal obligation, is fair and transparent, and would not breach any
of the other principles. The Council was not entitled to rely on the exemption in section 40(2)
FOIA in relation to individual supplier names for payments in excess of £500.
39. We note that this finding relates to using section 40(2) FOIA as a blanket exemption from
disclosure, as was done in this case. There may be individual cases where it is not lawful, fair
and transparent to publish the name of a particular supplier, depending on their individual
circumstances and the application of the tests under the DPA and GDPR.
40. This finding means it is not necessary for us to address lawfulness under Article 6(f) in any
detail. In brief, we would have found that this applied in the alternative. We disagree with the
Commissioner’s finding that disclosure would not be necessary for the purpose of the specific
legitimate interests in transparency put forward by the appellant. As explained above, he
submits that the names are required to show whether particular suppliers are being favoured,
and to enable questions to be asked about competence and suitability, and the other
information already published by the Council does not address these issues. We would also
take a different view on the balancing test, taking into account the importance of transparency
in light of the Code, and the limited impact on individual privacy as discussed above. However,
this would be limited to payments in excess of £500, as lower payments are not covered by the
Code and would also involve a lower public interest in transparency as they would be payments
of small amounts.
41. We uphold the appeal in part and issue the substitute decision notice set out at the start of
this decision.
Signed: Hazel Oliver
Judge of the First-tier Tribunal
Date: 11 December 2020
Date promulgated: 14 December 2020