First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2021/0097
Before
Judge Stephen Cragg Q.C.
Tribunal Members
Ms Marion Saunders
Ms Anne Chafer
Heard via the CVP platform on 29 March 2022
BETWEEN:
Noel Pereira
Appellant
And
The Information Commissioner
Respondent
The Appellant represented himself
The Commissioner was not represented.
DECISION AND REASONS
1
DECISION
1. The appeal is partially allowed and a decision notice substituted for that issued by the
Commissioner.
MODE OF HEARING
2. The proceedings were held via the Cloud Video Platform. The Appellant joined
remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing
in this way
3. The Tribunal considered an agreed open bundle of evidence comprising 185 pages,
some additional papers and submissions from the Appellant, and a closed bundle.
BACKGROUND AND INITIAL DECISION MAKING
4. On 27 December 2019, the Appellant wrote to the Insolvency Service and requested
information in the following terms:
‘Please inform me, under the Freedom of Information Act, the steps your
service took to verify the information proved by [name of third party] prior
to your initially granting him a DRO [on] 19 November 2019. You do not
give the date he applied. You rejected, very promptly (22 November 2019)
and in a very patronising manner saying I must be ‘disappointed’, the
evidence I gave re his assets etc, in particular the guitar returned to him, the
subject of his debt to me, which suggests you made no further enquiries.
Enquiries of this nature are far easier for a Government organisation than
for a private citizen, but I was able to provide further evidence of his
purchases etc subsequently (I all ready [sic] had this information but you did
not refer back to me before very rapidly issuing the DRO). It concerns me
that others in my position may have lost because of your promptness in
issuing DROs without your having made essential checks.
2
2 Please also inform me, under the Freedom of Information Act, of what
further investigations you performed after my objection and complaint.
Another person in my situation may not have had the amount of evidence I
provided and may have had to accept your initial ruling, an injustice.’
5. As the request indicates, the Appellant was aggrieved by the grant of a Debt Relief
Order (DRO) applied for and given to a particular individual by the Insolvency
Service and with whom the Appellant had a dispute about money owed, and had had
information he wanted the Insolvency Service to consider as part of that objection.
The information provided by the Appellant led to the DRO being revoked.
6. The request was to do with the processes carried out by the Insolvency Service, as
well as the details of the specific DRO, and it is clear that the Appellant was
concerned that other people would have lost out because of deficiencies in checking
whether DROs should be granted.
7. A DRO is a way by which an individual can deal with their debts if they cannot afford
to pay them. The DRO means that the individual does not need to pay certain kinds
of debt. An individual can only apply for a DRO through an ‘approved intermediary’.
This is an authorised debt adviser who will make the application on an individual’s
behalf.
8. The Insolvency Service responded on 27 January 2020, under reference number
FOI2019-140, and explained that it held information falling within the scope of this
request but it considered this to be exempt from disclosure on the basis of section
40(2) of the Freedom of Information Act 2000 (FOIA) which relates to the disclosure
of personal data. The Appellant contacted the Insolvency Service on the same day
and submitted a further request in the following terms:
‘I presume I have to accept that you cannot legally inform me of the details
regarding the person to whom the DRO was initially allowed. I therefore
rephrase the request to ask what steps your team takes, in general, to ensure
that claims have merit.’
3
9. The Insolvency Service responded on 12 February 2020, under reference number
FOI2019-151, and confirmed that it held the requested information. It provided the
complainant with a description of the process followed and a link to the DRO
process. The Appellant contacted the Insolvency Service on 13 February 2020 and
asked it to conduct an internal review of this response. In his email he also included
the following two additional requests:
1. ‘Please inform me of the debt adviser involved in this case’, and
2. ‘What checks are performed in these circumstances (before granting a
DRO or if your circumstances change during your DRO)…and, if the info
is allowable, were performed in this case, particularly after my objection
where [name of Insolvency Service employee] in her letter dated 22
November 2019 states ‘extensive investigations’ were performed.’
10. The Insolvency Service responded on 23 March 2020. With regard to the internal
review on request FOI2019-151 it explained that it did not hold any further
information about the general steps that are taken to ensure a DRO application claim
has merit. With regard to the additional requests, in relation to the first request the
Insolvency Service confirmed that it held information but it considered this to be
exempt from disclosure on the basis of section 40(2) of FOIA. In relation to the
second request, the Insolvency Service explained that the checks that are performed
in the circumstances outlined had already been provided in response to request
FOI2019-151. Therefore, the Insolvency Service considered this to be a repeated
request and refused it under section 14(2) of FOIA. In relation to the information
falling within the scope of the second request specific to named third party’s case,
the Insolvency Service explained that such information was held but it considered
this to be exempt from disclosure on the basis of section 40(2) of FOIA.
11. We note that the Insolvency Service is not listed as a separate public authority in
Schedule 1 of the FOIA because it is an executive agency of the Department for
Department for Business, Energy and Industrial Strategy (DBEIS). However, as it
has its own FOI unit and as both the Appellant and the Commissioner have
corresponded with ‘the Insolvency Service’ during the course of the request and
complaint, we will refer (as did the Commissioner) to ‘the Insolvency Service’ for the
purposes of this notice – although the public authority is, ultimately, DBEIS.
4
THE LAW
12. Under section 1(1)(a) FOIA, a public authority is obliged to tell an applicant whether
or not it holds the information requested. The ‘scope’ of the request itself is
something to be interpreted by the public authority and the Commissioner, and now
by the Tribunal.
13. There are also issues in this case which relation to the disclosure of information
which is potentially ‘personal’ in nature. Section 40 (2) FOIA reads as follows:-
(2) Any information to which a request for information relates is also exempt
information if—
(a) it constitutes personal data which does not fall within subsection (1)
(personal information of the applicant], and
(b) the first, second or third condition below is satisfied.
14. Section 3(2) of the Data Protection Act 2018 (DPA 2018) defines personal data as
‘any information relating to an identified or identifiable living individual’.
15. The relevant condition (as referred to in s40(2)(b) FOIA) in this case is found in
s40(3A)(a):-
(3A) The first condition is that the disclosure of the information to a member of
the public otherwise than under this Act—
(a) would contravene any of the data protection principles.
16. Under s40(7) FOIA the relevant data protection principles in this case are to be
found, first, in Article 5(1) of the General Data Protection Regulation (GDPR).
Materially, Article 5(1)(a) reads:-
Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the
data subject (‘lawfulness, fairness and transparency’).
17. Further, and relevantly for this case by Article 6(1) GDPR:-
Processing shall be lawful only if and to the extent that at least one of the
following applies:
(a) the data subject has given consent to the processing of his or her
personal data for one or more specific purposes;
5
…
(f) processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such
interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal
data…
18. In relation to the tests to be applied at this last stage the principles are set out in
Goldsmith International Business School v IC and the Home Office [2014] UKUT 0563
(AAC) and explained as follows:-
33. In making his submissions Mr Knight referred me to four authorities,
being (in date order) decisions of the Information Tribunal, the Divisional
Court, the Supreme Court and the Upper Tribunal respectively. These were:
(1) Corporate Officer of the House of Commons v Information Commissioner and Others
(EA/2007/0060-0063, 0122-0123 and 10131) (abbreviated here to “Corporate
Officer (Information Tribunal)”); (2) Corporate Officer of the House of Commons v
Information Commissioner and Others [2008] EWHC 1084 (Admin) (“Corporate
Officer (Divisional Court)”); (3) South Lanarkshire Council v Scottish Information
Commissioner [2013] UKSC 55 (“South Lanarkshire”); and finally (4) Farrand v
Information Commissioner [2014] UKUT 310 (AAC) (“Farrand”). The last, of
course, was decided after the Tribunal had given its decision on the present
appeal.
34. Mr Knight helpfully set out eight principles or, as I prefer to call
them, eight propositions, derived from this case law. I set them out below,
including references to the relevant passages in the various decisions as
authority for these propositions as (a) I endorse them; (b) they assist in
resolving the present appeal; and (c) this taxonomy may well prove a useful
roadmap for the Commissioner and other First-tier Tribunals when seeking
to chart a path through the thicket of issues thrown up by Condition 6(1) of
Schedule 2 in other cases…
35. Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three
questions to be asked:
“(i) Is the data controller or the third party or parties to whom the data
are disclosed pursuing a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those
interests?
6
(iii) Is the processing unwarranted in this case by reason of prejudice to
the rights and freedoms or legitimate interests of the data subject?”
Authority: South Lanarkshire at [18].
36. Proposition 2: The test of “necessity” under stage (ii) must be met
before the balancing test under stage (iii) is applied.
Authority: Corporate Officer (Information Tribunal) at [58], South Lanarkshire
at [18] and Farrand at [29].
37. Proposition 3: “Necessity” carries its ordinary English meaning, being
more than desirable but less than indispensable or absolute necessity.
Authority: Corporate Officer (Divisional Court) at [43] and Farrand at [26]-
[27].
38. Proposition 4: Accordingly the test is one of “reasonable necessity”,
reflecting the European jurisprudence on proportionality, although this may
not add much to the ordinary English meaning of the term.
Authority: Corporate Officer (Divisional Court) at [43], South Lanarkshire at [27]
and Farrand at [26].
39. Proposition 5: The test of reasonable necessity itself involves the
consideration of alternative measures, and so “a measure would not be
necessary if the legitimate aim could be achieved by something less”;
accordingly, the measure must be the “least restrictive” means of achieving
the legitimate aim in question.
Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South
Lanarkshire at [27].
40. Proposition 6: Where no Article 8 privacy rights are in issue, the
question posed under Proposition 1 can be resolved at the necessity stage,
i.e. at stage (ii) of the three-part test.
Authority: South Lanarkshire at [27].
41. Proposition 7: Where Article 8 privacy rights are in issue, the question
posed under Proposition 1 can only be resolved after considering the
excessive interference question posted by stage (iii).
Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South
Lanarkshire at [25].
42. Proposition 8: The Supreme Court in South Lanarkshire did not purport
to suggest a test which is any different to that adopted by the Information
Tribunal in Corporate Officer (Information Tribunal).
Authority: South Lanarkshire at [19]-[20] and Farrand at [26].
THE DECISION NOTICE
7
19. The contents of the Commissioner’s decision notice dated 15 March 2021 (ref: IC-
42312- X4C8) can be set out fairly briefly given the grounds of appeal before us, and
given the conclusions we have reached.
20. The first relevant issue dealt with by the Commissioner was whether the Insolvency
Service had disclosed all the information it had in relation to the process of how a
DRO was awarded. The Commissioner records as follows:-
21…the Insolvency Service explained that the process for granting a DRO
involves a number of automated checks being undertaken. It noted that these
checks do not involve individuals from the DRO team within the Insolvency
Service. Rather, if these checks are ‘passed’ then an application for the DRO
is made without any intervention by the DRO team. The Insolvency Service
noted that in this case the named third party’s application ‘passed’ these
checks and the DRO was made. In terms of recorded information held about
this process, the Insolvency Service explained to the Commissioner it held a
flow chart detailing these automated checks. At the Commissioner’s request
the Insolvency Service provided the complainant with a copy of this
flowchart during the course of her investigation.
22…The Insolvency Service explained that the failsafe for creditors is that if
they consider an application has been wrongly made they can object (which
is what the complainant did in this case). The Insolvency Service explained
that were an objection made the case is reviewed, further information is
requested if required, and a decision made whether or not to revoke the DRO
(in this case the DRO was revoked on the basis of information provided by
complainant).
21. Having set out that explanation, the Commissioner continued as follows:-
25…the Commissioner sought further clarification as to whether it held any
written guidance for staff in the small number of cases where objections or
complaints are received against DROs. In response the Insolvency Service
confirmed that it held such guidance, and provided the Commissioner with
a copy of it, but explained that it was not prepared to disclose this under
FOIA as it was not used in the case of the third party’s DRO and therefore
was not relevant.
22. The Commissioner considered this approach and noted that the Appellant had used
the words ‘in general’ when seeking details of the steps the Insolvency Service takes
to assess DRO applications. Nevertheless, even though the Insolvency Service had
confirmed that further guidance was held (albeit not used in the specific DRO the
Appellant was most concerned about), the Commissioner concluded that:-
8
27…Although the Insolvency Service does hold guidance for its staff on how
to deal with contested DROs, as this guidance was not used in the particular
circumstances of this case, the Commissioner accepts that it falls outside the
scope of this request.
28. In light of the above the Commissioner is satisfied, on the balance of
probabilities, that the Insolvency Service does not hold any further recorded
information falling within the scope of these parts of the complainant’s
requests beyond that which has now been provided to him.
23. The next issue which has been referred to in the appeal, is that the Insolvency Service
withheld the name of the Authorised Intermediary, through whom the third party in
question applied for the DRO, on the basis of section 40(2) of FOIA. The
Commissioner agreed that this was ‘personal information’. Although the
Commissioner accepted that the Appellant had a legitimate interest in being provided
with the name of the intermediary, but that it was not necessary to provide the
Appellant with the information because Insolvency Service had provided the
Appellant with the name of the organisation they work for, namely, National
Debtline, and this would facilitate the Appellant making a complaint to them about
the actions of the authorised intermediary in referring the case for a DRO if that is
what he wanted to do. Given the Appellant’s approach to this issue, we do not need
to explain the Commissioner’s approach in depth (see paragraphs 29-54 of the
decision notice for the relevant detail).
24. The final relevant issue is that the Insolvency Service also sought to withhold the
information relating to the specific actions it took in relation to the DRO applied for
by the named third party, on the basis of section 40(2) of FOIA. Having accepted
that this information was personal data of the third party, the Commissioner decided
that the Appellant wished to access this information in order to better understand
the Insolvency Service’s decision making in relation to this DRO, and therefore had
a legitimate interest in disclosure, and that disclosure would be necessary to meet this
legitimate interest, and so continued as follows:-
60. Therefore it is necessary to balance the legitimate interests in disclosure
against the data subject’s interests or fundamental rights and freedoms. In
doing so, it is necessary to consider the impact of disclosure. For example, if
the data subject would not reasonably expect that the information would be
9
disclosed to the public under the FOIA in response to the request, or if such
disclosure would cause unjustified harm, their interests or rights are likely to
override legitimate interests in disclosure.
….
62. In the Commissioner’s view, a key issue is whether the individual
concerned has a reasonable expectation that their information will not be
disclosed. These expectations can be shaped by factors such as an individual’s
general expectation of privacy, whether the information relates to an
employee in their professional role or to them as individuals, and the purpose
for which they provided their personal data.
63. It is also important to consider whether disclosure would be likely to
result in unwarranted damage or distress to that individual.
64. In the Commissioner’s view the named third party would have no
expectation that the Insolvency Service would disclose, under FOIA, details
of his DRO application to the general public. Having considered the nature
of the withheld information, in the Commissioner’s view its disclosure would
clearly invade the privacy of the named third party and be likely to cause him
harm and/or distress. Therefore, whilst the Commissioner accepts that the
complainant has a legitimate interest in accessing this information, she
considers that this is clearly insufficient to outweigh the named third party’s
fundamental rights and freedoms. The Commissioner therefore considers
that there is no Article 6 [GDPR] basis for processing and so the disclosure
of the information would not be lawful.
65. Given the above conclusion that disclosure would be unlawful, the
Commissioner considers that she does not need to go on to separately
consider whether disclosure would be fair or transparent.
THE APPEAL AND RESPONSE
25. The Appellant’s appeal is dated 11 April 2021. He explains that he still seeks details
of the third party’s DRO application. The Appellant has provided us with a link to
the Insolvency Service’s website where details can be found. This includes the third
party’s name, address, date of birth, employment status and the dates to which they
are subject to a Debt Relief Restrictions Order (which we understand is issued after
a DRO is revoked). The Appellant says:-
Revocation of the DRO, the reason for it, and the subsequent DRRO are all
ready in the public domain in the Individual Insolvency Register and is all
ready known to all creditors so I believe that the Insolvency service cannot
rely on section 40(2) of FOIA… to withhold this information, especially
bearing in mind that this was a dishonest application. Where an application
is made, to a taxpayer-funded Government organisation, for discharge of
10
debts, where another individual is affected, the applicant should not have the
right to withhold financial and other relevant information from those
affected by their application.
26. The Appellant seeks disclosure of the guidance withheld by the Insolvency Service
as not being in scope of the request (see above). He says:-
This written guidance should have been used at my initial objections, which
were eventually verified by the service … and certainly was relevant so should
be provided…It should be available for the public in general to view since it
is available to use in all cases if necessary….it should have been used after
my initial objections and evidence, rather than dismissing my evidence so I
continue to request that information as it is relevant not only to myself but
to the general public and should be open to public scrutiny.
…
The Insolvency Service is a government body, so [the Commissioner’] advice
re disclosure of records and published best practices should be followed. The
Insolvency Service should therefore disclose its methods of investigation. My
requests are consistent with her stated aims.
27. The Appellant confirmed that he was not seeking the name of the individual
intermediary adviser, but just the name of the organisation to which the intermediary
adviser belonged, which had now been provided.
28. The Commissioner’s response supports the conclusions in the decision notice in
relation to whether the additional guidance is within the scope of the request.
29. The Commissioner notes that it does not seem to be disputed that in relation to the
particular DRO the information requested is personal information, and stands by the
analysis in the decision notice as to why it should not be disclosed. The fact that the
Appellant knows some information about the third party is not a reason to release
further information into the public domain.
THE HEARING
11
30. The Appellant appeared in person, and the Commissioner was not represented. The
Appellant provided us with some background to this matter which was helpful to
understand why he was pursuing the issue.
31. We explained to the Appellant the limited nature of the Tribunal’s enquiries which
extended only to issues about the disclosure of information by the Insolvency
Service, rather than the grievances that the Appellant had about the carrying out of
its functions by the Insolvency Service. We noted also that in the Appellant’s
supplementary bundle of documents he had included a decision from the
Parliamentary and Health Service Ombudsman dated 11 August 2021 which clearly
identified shortcomings by the Insolvency Service in dealing with the matters raised
by the Appellant in relation to the particular DRO.
32. The Appellant confirmed that his request for information extended to general
information about its processes by the Insolvency Service, not just information about
the particular DRO, and he saw himself as making the request on behalf of future
objectors to DROs. He said, though, that he was also seeking information about the
particular DRO application in this case. He confirmed that he now had the
information he required concerning the intermediary adviser, and was not pursuing
anything further on that matter.
33. The Appellant has provided the Tribunal with further information since the hearing,
but this appears to relate to his underlying dispute with the Insolvency Service and
the third party, and not directly to his request for information.
DISCUSSION
34. As set out above the Commissioner decided in paragraph 27 of the decision notice
that ‘Although the Insolvency Service does hold guidance for its staff on how to deal
with contested DROs, as this guidance was not used in the particular circumstances
of this case, the Commissioner accepts that it falls outside the scope of this request’.
35. This approach is premised on the finding that the Appellant is only interested in, and
has only requested, information which relates to the particular case in which he found
himself involved.
12
36. However, we do not agree that the Appellant’s request is limited in this way. As also
noted above, the Appellant asked ‘what steps your team takes, in general, to ensure
that claims have merit’. The Appellant has reiterated in his appeal document and in
the hearing before us that he is seeking information wider than just that used in one
particular case, because he is interested in the way the Insolvency Service works ‘in
general’. In our view the scope of the request includes all guidance for the staff of
the Insolvency Service on how to deal with contested DROs. The Insolvency Service
confirms that it holds such guidance and it is included in our CLOSED bundle.
37. The upshot of our conclusion is that the Insolvency Service must respond to the
Appellant’s requests afresh on the basis that it does hold further information within
scope of the requests. We are not deciding that the guidance on how to deal with
contested DROs must be disclosed to the Appellant at this stage, as it is possible that
the Insolvency Service will claim that one or more of the exemptions to disclosure
under the FOIA applies. But the Insolvency Service must consider the request afresh
on the basis that the Appellant’s request encompasses all guidance provided to staff
on how to deal with contested DROs.
38. We would mention at this stage, that we are also quite surprised that the only
information said to be held in relation to automated checks is a flowchart. From
experience we would expect a flowchart to be a distillation of fuller guidance
provided elsewhere, rather than a ‘stand alone’ document, and we would ask the
Insolvency Service, when reconsidering the Appellant’s request as we direct below,
to confirm the position in relation to this.
39. The other ‘live’ issue in this case is whether disclosure of information relating to the
specific DRO application with which the Appellant is involved, is covered by s40(2)
FOIA and exempted from disclosure.
40. Applying the legal framework above, it is our view that the information sought is
clearly the personal information of the third party applicant, and it is additional to
the information currently available about the third party online.
13
41. We accept the Commissioner’s analysis in the decision notice that the Appellant has
a legitimate interest in the disclosure of the information, to enable him to discover
how the third party was able to successfully apply for a DRO in the circumstances of
the case. Given the availability of some information online, the process which led to
the revocation of the DRO, and the availability of the Ombudsman to investigate the
procedures of the Insolvency Service this must lessen the Appellant’s legitimate
interest in disclosure. We are also less sure than the Commissioner that disclosure
would be necessary to fulfil this legitimate interest, but on balance we accept that
there may be undisclosed information which it would still be necessary for the
Appellant to have access to.
42. Therefore, to complete our analysis, it is necessary to balance these legitimate
interests in disclosure to the Appellant against the data subject’s interests or
fundamental rights and freedoms. In doing so, it is necessary to consider the impact
of disclosure.
43. We agree with the Commissioner’s view that the named third party would have no
expectation that the Insolvency Service would disclose details of his DRO application
to the ‘world at large’ (as disclosure under FOIA cannot be restricted). We have
viewed the withheld information, and its disclosure would clearly interfere with the
privacy rights of the named third party and be likely to cause him harm and/or
distress. We note the Appellant’s allegation that the third party has been dishonest in
his application, but it seems to us that, even if that is so, that does not remove the
third party’s reasonable expectation that the information will not be disclosed.
44. Therefore, we accept that Appellant has a limited legitimate interest in accessing this
information, but in our view this is insufficient to outweigh the third party’s
fundamental rights and freedoms relating to their private life, even if the information
provided during the application process was not all true.
45. On the basis of this, the appeal is partially allowed and a decision notice substituted
in the above terms in relation to the further guidance held by the Insolvency Service.
46. Thus, the Tribunal requires the Insolvency Service/ DBEIS to take the following
steps to ensure compliance with the legislation:-
14
• Reconsider the Appellant’s requests afresh on the basis that the scope
of the requests includes all information (such as guidance to staff)
which covers the steps carried out to ensure that claims have got merit
including the steps to be taken in relation to contested DROs, not
limited to the information used in relation to the specific DRO with
which the Appellant has been involved.
• The Insolvency Service/DBEIS must take these steps within 35
calendar days of the date of this decision, and inform the Appellant of
the outcome from taking those steps within the same time period.
47. Failure to comply may result in the Tribunal making written certification of this fact
to the Upper Tribunal, in accordance with rule 7A of the First-tier Tribunal (General
Regulatory Chamber) Rules1 and may be dealt with as a contempt of court. Neither
the Insolvency Service nor the DBEIS are parties to this appeal and must be sent a
copy of this decision.
Stephen Cragg QC
Judge of the First-tier Tribunal
Date: 22 April 2022
Promulgated: 25 April 2022
Amended pursuant to rule 40 on 13 May 2022
1
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1006547
/consolidated-ftt-grc-rules-21072021.pdf
15
16