First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal References: EA/2021/0055P
Determined, by consent, on written evidence and submissions
Considered on the papers on 1 October 2021.
Before
Judge Stephen Cragg Q.C.
Tribunal Members
Ms Susan Wolf
and
Ms Suzanne Cosgrave
Between
William Stevenson
Appellant
And
The Information Commissioner
Respondent
DECISION AND REASONS
DECISION
1
1. The appeal is partially allowed.
MODE OF HEARING
2. The parties and the Tribunal agreed that these matters were suitable for determination on
the papers in accordance with rule 32 Chamber’s Procedure Rules.
3. The Tribunal considered an agreed open bundle of evidence of 255 pages, a CLOSED
bundle and additional submissions from both parties.
BACKGROUND
4. This case concerns a request to the Information Commissioner for information. In this
decision the term ‘ICO’ is used to denote the ICO dealing with the request, and the term
‘Commissioner’ denotes the ICO dealing with the complaint.
5. On 10 February 2020 the Appellant wrote to the ICO and requested information in the
following terms:
On 12.7.19 the Commissioner issued DN FS50800552.
On 9.8.19 appeal EA/2019/0284 was lodged with the Information Tribunal.
On 20.9.19 the Commissioner renounced her Decision Notice.
This FoI request is for the complete record held by ICO of all communications
between the public body concerned (NHS Improvement, now merely a name for
a function within NHS England) and the Commissioner regarding the complaint
referred to in FS50800552, from the date the complaint was made to the
Commissioner (7.11.18) up to today’s date (10.2.20). I request electronic copies of
all letters and email communications and any record of telephone communication
connected with this case. I have attempted to ensure that the requested information
is included by the Commissioner in the collection of papers produced in the usual
way for the Tribunal panel, but my applications have not been successful.
Therefore this FoI request became necessary.
2
6. The ICO responded on 5 March 2020 and advised that the request included information
that was the Appellant’s own personal data and that this would be processed separately.
The ICO released some information – copies of correspondence and records of contact
with NHS Improvement - and withheld some under section 40(2) FOIA and section 44(1)
FOIA.
7. The ICO provided an internal review on 8 April 2020. It maintained its reliance on
sections 40(2) and 44(1) FOIA and explained why it does not hold further information
which the Appellant considered it should hold. The Appellant contacted the
Commissioner on 30 April 2020 to complain about the way his request for information
had been handled.
THE STATUTORY FRAMEWORK
8. Section 40 (2) FOIA reads as follows:-
(2) Any information to which a request for information relates is also exempt
information if—
(a) it constitutes personal data which does not fall within subsection (1)
(personal information of the applicant], and
(b) the first, second or third condition below is satisfied.
9. Section 3(2) of the Data Protection Act 2018 (DPA) defines personal data as ‘any
information relating to an identified or identifiable living individual’.
10. The relevant condition (as referred to in s40(2)(b) FOIA) in this case is found in
s40(3A)(a) FOIA:-
(3A) The first condition is that the disclosure of the information to a member of
the public otherwise than under this Act—
(a) would contravene any of the data protection principles.
11. Under s40(7) FOIA the relevant data protection principles in this case are to be found,
first, in Article 5(1) of the GDPR. Materially, Article 5(1)(a) reads:-
Personal data shall be: (a) processed lawfully, fairly and in a transparent manner
in relation to the data subject (‘lawfulness, fairness and transparency’).
3
12. Further, by Article 6(1) GDPR:-
Processing shall be lawful only if and to the extent that at least one of the
following applies:
(a) the data subject has given consent to the processing of his or her personal
data for one or more specific purposes;
…
(f) processing is necessary for the purposes of the legitimate interests pursued
by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data…
13. Section 44(1)(a) FOIA states:-
(1) Information is exempt information if its disclosure (otherwise than under
this Act) by the public authority holding it—
(a) is prohibited by or under any enactment..
14. Section 132 DPA reads:-
(1) A person who is or has been the Commissioner, or a member of the
Commissioner's staff or an agent of the Commissioner, must not disclose
information which—
(a) has been obtained by, or provided to, the Commissioner in the course of,
or for the purposes of, the discharging of the Commissioner's functions,
(b) relates to an identified or identifiable individual or business, and
(c) is not available to the public from other sources at the time of the
disclosure and has not previously been available to the public from other
sources,
unless the disclosure is made with lawful authority.
(2) For the purposes of subsection (1), a disclosure is made with lawful
authority only if and to the extent that—
(a) the disclosure was made with the consent of the individual or of the
person for the time being carrying on the business,
(b) the information was obtained or provided as described in subsection
(1)(a) for the purpose of its being made available to the public (in whatever
manner),
(c) the disclosure was made for the purposes of, and is necessary for, the
discharge of one or more of the Commissioner's functions,
4
(e) the disclosure was made for the purposes of criminal or civil proceedings,
however arising, or
(f) having regard to the rights, freedoms and legitimate interests of any
person, the disclosure was necessary in the public interest.
(3) It is an offence for a person knowingly or recklessly to disclose information
in contravention of subsection (1).
THE DECISION NOTICE
15. In the decision notice dated 5 February 2021, the Commissioner states that the ICO has
withheld names and contact details of a member of its staff and members of NHS
Improvement staff under section 40(2) FOIA. The Commissioner found that this
information fell within the definition of ‘personal data’ in section 3(2) DPA. The
Commissioner decided that the Appellant had a legitimate interest in the disclosure of
the information, as he was concerned about the independence of the ICO from the
influence of NHS Improvement. The Commissioner accepted that that disclosure would
be necessary to meet the complainant’s legitimate interests.
16. However, the Commissioner went to find that:-
43. The ICO considers that the condition at section 40(3A)(a) applies in this
instance. It does not consider that disclosing this personal data into the public
domain is necessary or justified. With no strong legitimate interest that would
override the prejudice to the rights and freedoms of the relevant data subjects, the
ICO says it took the decision that disclosing this information would have been
unlawful, triggering the exemption at section 40(2) of the FOIA.
44…. the Commissioner has determined that there is insufficient legitimate interest
to outweigh the data subjects’ fundamental rights and freedoms. The complainant’s
interest in this information is a valid interest for him to have, but he has not made
a case that it has any wider public interest. The wider public interest in the ICO
demonstrating that it is open, transparent and independent has been met, in the
Commissioner’s view, through its release of other information in response to the
complainant’s request. The Commissioner therefore considers that there is no
Article 6 basis for processing the personal data in question and so disclosing the
information would not be lawful.
5
17. Section 44(1)(a) FOIA says that information is exempt information if its disclosure
(otherwise than under the FOIA) by the public authority holding it is prohibited by or
under any enactment. Section 44 FOIA is an absolute exemption which means it is not
subject to the public interest test. In its submission to the Commissioner the ICO has
explained that when it considers a complaint about a response to a freedom of
information request it will often need to consult with the public authority that issued the
response. In many cases the public authority will provide the ICO with copies of the
information that was withheld in its response to the request.
18. The Commissioner says that ICO explained that in this case, the scope of the request
included the correspondence which it had exchanged with the relevant public authority,
NHS Improvement, about the complaint reference FS50800552. This correspondence
included the information that had been withheld by the public authority which was
information NHS Improvement had provided to the ICO for the sole purpose of its
investigation into that complaint. The ICO confirmed that this information was
withheld in reliance on section 44(1)(a) FOIA, along with a small amount of content
provided to it for the purpose of handling the complaint, as well as the names and
contact details of staff at NHS Improvement which the Commissioner discussed also in
the section 40(2) FOIA analysis.
19. Thus, the Commissioner found that:-
(a) In relation to s132(1)(a) DPA the information was provided by NHS
Improvement during the course of the Commissioner’s investigation
under section 50 FOIA into a complaint submitted to it about NHS
Improvement’s response to a FOIA request, and therefore for the
purposes of the discharging of the Commissioner’s functions.
(b) With regard to s132(1)(b) DPA, the information relates to an identifiable
public authority (a ‘business’ for the purposes of the legislation). For the
purposes of s132(1) (c) FOIA the information was not, and had not
previously been, available to the public at the time of the disclosure.
6
(c) Section 132(2)(a-f) DPA provides gateways for lawful disclosure even if
the criteria in s132(1) FOIA are met. None of these gateways applies and
the ICO has not acquired consent from NHS Improvement (with whom it
has consulted) to disclose the information.
(d) The ICO is entitled to rely on section 44(1) FOIA to withhold the personal
data of NHS Improvement staff and the remaining information falling
within the scope of the Appellant’s request not covered by section 40(2)
FOIA.
THE APPEAL AND RESPONSE
20. The Appellant’s grounds of appeal can be summarised as follows (with the
Commissioner’s response summarised in italics):-
(a) An earlier Tribunal in 2013 (concerning a different request) did not
uphold the Commissioner’s decision on a s40(2) FOIA issue about the
publication of the names of officials, and therefore the Commissioner
cannot be ‘relied upon’ to have got the issue right in the current case.
Simply because a Tribunal has found in favour of the Appellant on a previous
appeal involving s40(2) FOIA does not mean that the decision notice in this case
is incorrect.
(b) The disclosure of the name and details of a reporter in an email dated 6
January 2010 have not been dealt with in the decision notice.
The Commissioner accepts this is the case and was an omission for which she
apologises.
7
(c) Other information had been redacted from a letter dated 17 June 2019
without explanation, and which seems unlikely to be covered by s40(2)
FOIA.
The Commissioner refers to paragraph 51 of the decision notice which notes that
there is ‘a small amount of content provided to the ICO for the purpose of
handling the complaint’ as relevant to this information and that the
Commissioner found that the information was covered by s44(1) FOIA.
(d) Issues were raised about whether the Appellant’s own personal data
was properly excluded.
The Commissioner points out that issues about the Appellant’s own personal
data cannot be dealt with by this Tribunal.
(e) This concerns whether records were made of telephone conversations.
The Commissioner notes that the Appellant does not argue that there are
records which have not been disclosed.
21. The Commissioner’s response also explains some more of the background to
the case. The Appellant had made a previous request to NHS Improvement
for information on 4 September 2018. NHS Improvement had sought to rely
on s14 FOIA on the basis that the request was ‘vexatious’. The Commissioner
issued a decision notice on 12 July 2019 (FS50800552) upholding NHS
Improvement’s approach but, upon reconsidering the matter during the
subsequent appeal, decided that s14 FOIA was not applicable and that it
would not defend the Appellant’s appeal. Rather than agreeing to a consent
order allowing his appeal, the Appellant wanted the Tribunal to make a
decision allowing his appeal.
8
22. Case management directions were made that limited the documentation that
would be provided to the Tribunal for it to determine the uncontested appeal.
The Appellant made the current request to obtain the additional information
held by the ICO which was not made available in the ‘s14 FOIA’ appeal,
leading to the current decision notice and appeal. The Tribunal did in fact
consider the s14 FOIA appeal with the limited material available, and
allowed the appeal on 23 October 2020 (EA/2019/0284), directing NHS
Improvement to provide a response to the 4 September 2018 request.
23. Following receipt of the Commissioner’s response the Appellant emailed the
Tribunal on 8 April 2021 to say that ‘I am interested in the redactions of the
names of the NHSE lawyers and the redaction of the newspaper item’. On
27 April 2021 Judge Griffin made directions allowing for the Appellant to file
a Reply by 11 May 2021 but this was not done. Further directions were made
on 15 June 2021 for final submissions by 29 June 2021. On 16 June 2021 the
Commissioner made further submissions on the basis that the Appellant only
sought the names of the NHSE lawyers and redactions from January 2010
email from the reporter.
24. However, on 29 June 2021, the Appellant filed submissions which made it
clear that he was still seeking all the ‘disputed information in this
case…which means the removal of all the redactions’, and he explained that
he had appealed the Commissioner’s DN because ‘I know from personal
experience that the Commissioner cannot be trusted with justifiable
redaction of, for instance, names’.
DISCUSSION
25. We understand some of the frustration of the Appellant in relation to the s14
FOIA appeal, and the Commissioner’s initial support for NHS
9
Improvement’s position. We note that the outcome of that appeal was that
NHSI would need to consider the request for information in that case. We do
not know what happened as a result of that.
26. The scope of the request in this case includes the correspondence which the
ICO had exchanged with NHS Improvement, about the complaint reference
FS50800552, which also covered the information that had been withheld by
NHS Improvement and provided to the ICO for the sole purpose of its
investigation into that complaint. The ICO argued that this information was
withheld in reliance on section 44(1)(a) FOIA, along with a small amount of
content provided to it for the purpose of handling the complaint as well as
the names and contact details of staff at NHS Improvement.
27. It seems clear to us that the material provided by NHS Improvements to the
Commissioner in the course of the s14 FOIA appeal and not disclosed to the
Appellant during the appeal process must be covered by s132 FOIA as
explained by the Commissioner in her decision notice. Therefore s44 FOIA
will apply to prevent the disclosure of that information by the ICO to the
Appellant, and we so find.
28. As the Commissioner argues, s44 FOIA will also cover the names and details
of NHS Improvement officials which appear in the material provided to the
Commissioner. In addition, the names and details of those officials will
clearly amount to personal data. We accept the Commissioner’s finding that
the Appellant had a legitimate interest in the disclosure of the information, as he was
concerned about the independence of the ICO from the influence of NHS
Improvement and that disclosure would be necessary to meet the Appellant’s legitimate
interests. However, we also agree with the Commissioner’s findings at paragraphs 42-43
of the decision notice that there is no wider public interest in the disclosure of this
information and the legitimate interest of the Appellant does not outweigh the
fundamental rights of the subjects not to have their personal data disclosed, and so
disclosure is exempt under s40(2) FOIA.
10
29. In our view, there is also no legitimate interest put forward for the disclosure of the
personal data of the ICO staff member (other than job title which have not been
redacted) which could outweigh their fundamental rights, including the right not to have
personal data disclosed, and so this is exempt under s40(2) FOIA also.
30. That leaves the redactions to the email from the Health Reporter dated 6 January 2010
(over 11 years ago) where it appears that the Appellant is seeking the reporter’s name,
the recipient’s name, the reporter’s email address, direct telephone number and mobile
telephone number as they would have been in 2010. This is all clearly personal data, but
there appears to be no legitimate interest in requiring disclosure of this information
which was, in respect of contact information, mostly likely wrong and certainly out of
date at the time of the request in this appeal. We note for example the Commissioner’s
comment that the ‘North West Evening Mail’ no longer seems to exist. As the
Commissioner also notes the entire email and the person’s role in 2010 has been
disclosed already. Disclosure of this information is not necessary to meet any legitimate
interest, and so it is also exempt pursuant to s40(2) FOIA.
31. We do note, though, that the Commissioner admits that she failed to deal
with this aspect of the request in her decision notice. To that extent only we
uphold the Appellant’s appeal, but do not require any further steps to be
taken, as we agree with the Commissioner’s later submissions that the
information is exempt from disclosure. The other parts of the appeal are
dismissed
Stephen Cragg QC
Judge of the First-tier Tribunal
Date: 4 October 2021
Promulgation Date: 5 October 2021
11