First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2020/0356
Decided without a hearing
On 31 August 2021
Before
JUDGE HAZEL OLIVER
EMMA YATES
MICHAEL JONES
Between
CHRISTOPHER HASTINGS
Appellant
and
INFORMATION COMMISSIONER
First Respondent
and
THE CABINET OFFICE
Second Respondent
DECISION
The appeal is dismissed.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 3 December 2020 (IC-48515-H5H4, the “Decision Notice). The appeal relates to the
application of the Freedom of Information Act 2000 (“FOIA”) and the Environmental Information
Regulations 2004 (“EIR”). It concerns information requested by the appellant from the
Department for Digital, Culture, Media and Sport (“DCMS”) about correspondence sent by Zara
Tindall MBE (“ZT”) or her brother Peter Phillips (“PP”) to the Secretary of State.
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it
can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. On 16 August 2019, the appellant wrote to DCMS and requested the following information
(the “Request”):
“I would like to request the following information under the Freedom of Information Act and
the Environmental Information Regulations. Please note that any reference to The
Queen’s grandchildren Zara Tindall and Peter Phillips in the questions below should be
taken to mean those two individuals; their private offices, and anyone specifically acting
on their behalf. Please note that the reference to The Secretary of State in the questions
below should include The Secretary of State his/herself and The Secretary of State’s
private office. Please note that the reference to written communications and
correspondence in the questions below should be taken to mean all traditional forms of
correspondence including letters and faxes, all emails (irrespective of whether they were
received and/or sent through private or official email accounts/addresses) and any
communications sent through encrypted messaging services.
Please note that neither Zara Tindall or Peter Phillips enjoys any automatic exemption from
the FOI. Please note that they are not exempt from the EIR.
1) Since January 2018, have Zara Tindall and/or Peter Phillips (acting together or as
individuals) sent written correspondence and communications to The Secretary of State
which in any way relates to the following:
(a) The Hong Kong businessman Dr Johnny Hon. This correspondence and
communications will include but not be limited to communications about his actual
and proposed investments and his actual and proposed business activities in both the
UK and abroad. It will also include but not be limited to his actual and proposed charity
commitments in the UK and overseas. It will also include but not be limited to Dr
Hon’s residency or amount of time spent in the UK. Please note that I am interested
in all correspondence and communications irrespective of how it relates to Dr Hon.
(b) The Global Group of Companies owned by Dr Hon. This will include correspondence
and communications about the company’s actual and proposed business activities in
the UK and abroad. Again, I am interested in all correspondence and communications
irrespective of how it relates to The Global Group of Companies.
(c) Any other business which you know is owned by Dr Hon.
2) If the answer to question one is yes, can you please provide copies of this written
correspondence and communications, including any letters, faxes, emails (sent and
received through private and official accounts/addresses) and any communications sent
through encrypted messaging services.
3) Did the Secretary of State reply to this correspondence and communications?
4) If the answer to question three is yes, can you please provide copies of this written
correspondence and communications including any letters. Faxes, emails (sent and
received through private and official accounts/addresses) and any communications sent
through encrypted messaging services”.
4. DCMS responded on 16 September 2019. They stated the request had been dealt with
under FOIA, and they could neither confirm nor deny whether the information was held under
section 40(5B)(a)(i) FOIA (a “NCND” response). They explained, “It will be clear that if the
Department were to hold information in scope of the request, it would contain personal
information of both Zara Tindall and Peter Phillips. To confirm we held information would
confirm both whether the named people have written to us, and specifically what they have
written concerning. For this reason, the Department neither confirms nor denies it holds
information under section 40(5B)(a)(i).”
5. The appellant requested an internal review and DCMS upheld its position in the internal
review outcome on 15 October 2019.
6. The appellant complained to the Commissioner on 3 December 2019. On 30 April 2020
the Commissioner asked DCMS to revisit its decision, noting that DCMS was required to
consider whether there could be lawful processing of personal data and had failed to consider
whether the appellant was pursuing legitimate interests. DCMS provided a detailed response
on 24 July 2020. DCMS apologised for having failed to apply the legitimate interest test. They
provided detailed reasons for the NCND response and why the application of the legitimate
interest test did not lead to a different outcome.
7. The Commissioner informed the appellant on 30 July 2020 that she was highly likely to
find that DCMS were correct to provide a NCND response. The appellant requested a formal
decision notice.
8. The Commissioner decided that DCMS was correct to provide a NCND response.
Confirming whether information was held would reveal personal data about ZT, PP and Dr Hon.
The appellant did have legitimate interests in pursuing the Request which could not be satisfied
in any other way. However, these interests were not strong enough to outweigh the individuals’
privacy rights. The Commissioner was not persuaded that any relevant information would be
environmental and so needed to be dealt with under EIR, but in any event DCMS would have
been able to rely on the equivalent exemption in EIR to provide a NCND response.
The Appeal and Responses
9. The appellant appealed on 8 December 2020. His grounds of appeal are:
a. He had requested copies of the documentation, not just a statement of confirmation
or denial.
b. The Commissioner should have viewed the relevant documentation and made a
decision on disclosure, which is particularly important as this request included the
EIR and Mr Hon’s business interests in the oil and energy sectors.
c. Disclosure would be in the public interest, as any occasion when an individual is
seeking to lobby ministers on behalf of their own or a third party’s interests should
be made public.
d. The argument that ZT and PP are not working Royals and so should be entitled to
an extra level of protection is disingenuous, as the opposite argument has been used
in the past and it appears public bodies are trying to operate a blanket ban.
e. Dr Hon makes a point of employing individuals with a connection to the British Royal
Family, and has said this is because of what they can do for individual projects.
f. There were failings in how DCMS dealt with the request, in relation to the legitimate
interest test and failing to consider EIR.
10. The Commissioner’s response maintains that the Decision Notice was correct, having
carried out a careful investigation and considered all relevant factors in applying the balancing
exercise.
a. The issue here is the duty to confirm or deny, not whether requested information
should be provided.
b. It was not necessary to view relevant documentation as the issue was whether
DCMS was entitled to provide a NCND response.
c. Section 40 is an absolute exemption, meaning there is no public interest test. There
are legitimate interests in knowing when and where ministers are being
corresponded with by members of the Royal Family, but these should not override
the individuals’ fundamental rights and freedoms in this case.
d. There is no blanket ban applied by the Commissioner for members of the Royal
Family.
e. DCMS did make an error on the legitimate interest point, but this was
comprehensively considered by the Commissioner. Even if EIR applied, DCMS
would still have been entitled to provide a NCND response.
11. By directions dated 27 January 2021, the Cabinet Office was joined as a party to the appeal.
Their response maintains that the Commissioner’s decision was correct. There is no obligation
for the Commissioner to ask DCMS to produce documentation in a NCND case, as this would
defeat NCND protection. There is a legitimate public interest, but this is reduced where the
individuals are not “working Royals”. Necessity is accepted. However, the privacy rights of the
individuals are not outweighed by a pressing social need for confirmation or denial.
12. The appellant submitted a reply to the Commissioner which states he believes there are
strong public interest grounds for disclosure, he is concerned the Commissioner has not viewed
material which DCMS may hold, the matter should not have been restricted to NCND, and he
believes government departments are operating a blanket ban on the release of Royal
correspondence.
Applicable law
13. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
40 Personal information.
…….
(5B) The duty to confirm or deny does not arise in relation to other information if or
to the extent that any of the following applies –
(a) Giving a member of the public the confirmation or denial that would have
to be given to comply with section 1(1)(a) –
(i) would (apart from this Act) contravene any of the data protection
principles...
…….
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
14. The relevant provisions of the EIR are as follows.
5(1) …a public authority that holds environmental information shall make it available
on request.
……
12(3) To the extent that the information requested includes personal data of which the
applicant is not the data subject, the personal data shall not be disclosed
otherwise than in accordance with regulation 13.
……
13(5A) For the purposes of this regulation a public authority may respond to a request
by neither confirming nor denying whether such information exists and is held
by the public authority, whether or not it holds such information, to the extent
that —
(a) the condition in paragraph (5B)(a) is satisfied…
……
(5B) The conditions mentioned in paragraph (5A) are—
(a) giving a member of the public the confirmation or denial—
(i) would (apart from these Regulations) contravene any of the data
protection principles…
15. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA or EIR.
16. The data protection principles are those set out in Article 5(1) of the General Data
Protection Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle
under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall
be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”. To
be lawful, the processing must meet one of the conditions for lawful processing listed in Article
6(1) GDPR. These include where “the data subject has given consent to the processing of his
or her personal data for one or more specific purposes” (Article 6(1)(a)). It also includes where
“processing is necessary for the purposes of the legitimate interests pursued by the controller
or by a third party, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data, in particular
where the data subject is a child.” (Article 6(1)(f)).
17. This involves consideration of three questions (as set out by Lady Hale DP in South
Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
Issues and evidence
18. The issues are:
a. Was DCMS entitled to provide a “neither confirm nor deny” response under section
40(5B)(a)(i) FOIA?
b. Alternatively, if EIR applied to the Request, was DCMS entitled to provide a “neither
confirm nor deny” response under Regulation 13(5B)(a)(i) EIR?
c. In both cases, this requires us to consider:
(i) Is the data controller or third party or parties to whom the data are disclosed
pursuing a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Are such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data?
19. By way of evidence and submissions we had the following, all of which we have taken into
account in making our decision:
a. An agreed bundle of open documents, which included the appeal, responses and
appellant’s reply.
b. A small closed bundle containing an unedited copy of DCMS’s response to the
Commissioner dated 24 July 2020.
c. An email from the Commissioner containing final comments dated 8 June 2021.
Discussion and Conclusions
20. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review
any finding of fact on which the notice in question was based. This means that we can review
all of the evidence provided to us and make our own decision.
21. Was DCMS entitled to provide a “neither confirm nor deny” response under section
40(5B)(a)(i) FOIA? We start with some of the specific issues raised by the appellant.
22. The appellant says he requested copies of documentation, not simply a confirmation or
denial. The Commissioner and Cabinet Office maintain that the issue here is NCND, and the
requirement to provide information only applies once a public authority has complied with its
duty to confirm or deny if it holds that information. The Tribunal confirms that NCND is a
permitted response under FOIA. It applies where confirmation or denial would in itself reveal
exempt information – in this case, personal data. Where NCND is relied on, there is no
requirement to provide copies of any information.
23. The appellant says that the Commissioner should have asked to view relevant
documentation before making her decision, particularly because the Request included the EIR.
He asks how the Commissioner can be sure there is not environmental information without
examining the documents. The Commissioner says it was not necessary to view documents
in an NCND case, and in this case she was able to consider the appellant’s full reasons in detail
and so had all the information needed to carry out the balancing exercise. The Commissioner’s
email of 6 June clarifies that she is entitled to request information but is not required to do so.
The Cabinet Office says that a requirement to produce documentation would mean NCND
protection would be lost and the provision deprived of its purpose, as this would reveal whether
information is held. We agree that there is no requirement on the Commissioner to view
documentation, and this was not necessary in this case. A NCND response can usually be
dealt with without viewing any information, and in most cases this would not be appropriate as
producing information would confirm that it is held and so defeat the purpose of the NCND
response. We address the issue about environmental information in paragraph 35 below.
24. The appellant maintains that disclosure of the material would be in the public interest. The
Commissioner says that the NCND exemption in section 40 FOIA is an absolute exemption,
and so there is no requirement to consider the public interest if the exemption is engaged. We
agree that this is an absolute exemption, and so there is no public interest test. We note that
public interest considerations are relevant to legitimate interests and the balancing exercise
under the GDPR, and are considered below.
25. The appellant complains that there were failings in how DCMS dealt with the request, in
relation to the legitimate interest test and failing to consider EIR. The Commissioner notes that
DCMS did make an error on the legitimate interest point, but this was comprehensively
considered by her after it was addressed by DCMS during her investigation. She also says
that even if EIR applied, DCMS would still have been entitled to provide a NCND response.
DCMS did fail to address all parts of the relevant test, but did so fully during the Commissioner’s
investigation and provided an apology for not having done so earlier. The Tribunal’s role is to
make its own decision on whether DCMS was entitled to rely on NCND, based on all the
information we now have from the parties. We address the issue about environmental
information in paragraph 35 below.
26. We note that the appellant’s Request asks for specific and detailed information, and so
confirming or denying whether this information is held would reveal personal data about
communications by and about the named individuals ZT, PP and Dr Hon. We are satisfied that
confirming or denying whether the requested information is held would reveal personal
information about the third parties. This means we must determine whether processing of the
personal information by confirmation or denial under FOIA would be lawful. As identified by
the Commissioner, the condition most applicable for lawful processing in this case is Article
6(1)(f) GDPR, which involves the following tests.
27. Is the data controller or third party or parties to whom the data are disclosed
pursuing a legitimate interest or interests? Yes, there are various legitimate interests in
disclosure of the information through confirmation or denial. There are legitimate interests in
understanding whether there is communication with ministers by members of the Royal Family,
especially where third parties are involved. The Cabinet Office says there is a legitimate
interest in matters concerning Royal family and extended Royal family. The appellant makes
the point that any lobbying of ministers on behalf of someone’s own interests, or for the interests
of third parties that they are in a financial relationship with, should be made public. There is
certainly a general interest in government transparency, particularly where there is lobbying by
public figures who may be using their position to influence the outcome.
28. Is the processing involved necessary for the purposes of those interests? The
parties agree that confirmation or denial is necessary for the purposes of those interests. We
agree that it is reasonably necessary. There is no less intrusive means of furthering these
interests than confirming or denying if information is held.
29. Are such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data? The parties hold
different views on this point.
30. The appellant says that ZT and PP are in a financial relationship with Dr Hon, and any
government department which has given preferential treatment to an individual due to the
lobbying of others should expect its actions to be scrutinised. He says there is a public right to
know if there is this kind of lobbying. He believes that the factors behind ministerial decisions,
inputs into the formulation of policy and the awarding of public sector contracts should be fully
transparent. The appellant also makes the point that ZT and PP, as grandchildren of the Queen,
will have influence denied to other members of the public. He says that Dr Hon makes a point
of employing individuals with connections to Royal Family. He also says that there appears to
be blanket ban on disclosure of information about the Royal Family.
31. The Commissioner says that neither ZT nor PP has the title “HRH”, and they do not receive
the Sovereign Grant. They are non-working Royals and do not conduct engagements for the
Queen. The Commissioner acknowledges that they have a higher profile than ordinary
members of the public but they still have rights to privacy, as does Dr Hon. The Request asks
for highly specific information, and ordinary members of the public do not expect the fact or
content of private correspondence with a government department to be disclosed under FOIA.
When the balancing test is applied, these privacy rights should not be overridden.
32. The Cabinet Office says that the right range of balancing factors has been taken into
account – the interests of individuals in confidentiality and privacy of their business dealings;
the public profile of PP and ZT as non-working royals; the interests in public authority
transparency; the fact both PP and ZT are entitled and expected to pursue economic activity
to earn a living and the degree to which their business dealings were in the public domain; the
absence of any suggestion of wrongdoing; and the expectation that correspondence in
private/business matters with public authorities is not disclosed to world at large. The Cabinet
Office also notes the privacy interests of Dr Hon.
33. We have considered the balance carefully. The legitimate interests here are not simply a
general interest in government transparency, but a more specific interest in lobbying on behalf
of third parties and how this affects ministerial decisions. ZT and PP are public figures, and so
may have more influence than others if they contact a government department. We note the
appellant’s point that Dr Hon appears to engage individuals who are connected with the Royal
Family in order to assist with his business dealings. However, we also note that ZT and PP
are not working Royals and are required to earn their own living. They do have privacy rights
in the same way as other members of the public, as does Dr Hon. If there have been any
correspondence or other communications within the scope of the Request, this will have been
in relation to private business matters which these individuals would not expect to have been
made public under FOIA. There may be circumstances in which these privacy rights would not
override the legitimate interests in government transparency, such as where there is evidence
of potential wrongdoing. There is no such evidence in this case.
34. We therefore find that the legitimate interests in confirmation or denial that the requested
information is held are overridden by the privacy rights of ZT, PP and Dr Hon. For the
avoidance of doubt, this Tribunal has not applied a “blanket ban” on disclosure of information
about members of the Royal Family. We have reached this decision after balancing the
relevant factors in the case, as we would with personal information about any other individual.
This means that disclosure of the personal information through confirmation or denial would
not be lawful processing of personal data and would breach one of the data protection principles.
DCMS was entitled to provide a NCND response under section 40(5B)(a)(i) FOIA.
35. Alternatively, if EIR applied to the Request, was DCMS entitled to provide a “neither
confirm nor deny” response under Regulation 13(5B)(a)(i) EIR? We can confirm that the
Tribunal has not seen any of the requested information (and does not know whether it exists),
and so has not been able to assess whether the requested information is environmental. If so,
the EIR would apply rather than FOIA. The Commissioner was in the same position, and DCMS
did not address the EIR in its response to the Request. However, this is not a problem in an
NCND case involving personal information, because the test under the EIR is exactly the same
as the test under FOIA (as set out in paragraphs 13 and 14 above). In both cases, a NCND
response can be provided if confirmation or denial would contravene any of the data protection
principles. We have found that it would breach the requirement for lawful processing of
personal data. If the EIR did apply to the Request, DCMS would be entitled to provide a NCND
response under Regulation 13(5B)(a)(i) EIR for the same reasons as explained above.
36. We dismiss the appeal.
Signed: Hazel Oliver
Judge of the First-tier Tribunal
Date of Decision: 10 September 2021
Date Promulgated: 13 September 2021