Neutral citation number: N/A
Appeal Number: EA/2021/0240
First-Tier Tribunal
(General Regulatory Chamber)
Information Rights Tribunal.
Heard: On the papers by consent.
Online remotely.
On 13 April 2022.
Decision: 9 May 2022.
Tribunal Panel
Judge Brian Kennedy QC
Marion Saunders
Emma Yates
Between:
James Leslie McLaren
Appellant:
And
The Information Commissioner
Respondent:
Representation:
For the Appellant: Kevin James Leslie McLaren as a Litigant in person
through written submissions.
For the Respondent: Helen Wrighton, Solicitor through written
submissions.
Decision: The appeal is dismissed.
1
REASONS
Introduction:
[1] This decision relates to an appeal brought under section 57 of the Freedom
of Information Act 2000 (“the FOIA”) The appeal is against the decision of the
Information Commissioner (“the Commissioner”) contained in a Decision Notice
(“DN”) dated 16 July 2021 (reference IC-80918-S7V7) which is a matter of
public record.
[2] The Tribunal Judge and lay members sat to consider this case on 13 April
2022.
Factual Background to this Appeal:
[3] Full details of the background to this appeal, The Appellant’s request for
information and the Commissioner’s decision are set out in the Decision Notice
(“DN”) and not repeated here, other than to state that, in brief, the appeal
concerns redacted information requested from the Public Authority, the Nursing
and Midwifery Council (“the NMC”) which the Commissioner held to be exempt
from disclosure under section 40(2) of the FOIA.
Chronology:
2 June 2020 The Appellant wrote to the NMC and requested the following:
“…I note that the information against the heading “Linked
cases/previous referrals within last 3 years” has been redacted.
Please tell me what is being hidden under the redaction. As the
husband of the deceased, I suggest this is in my interest and in
my continuing pursuit of this matter cannot be kept from me under
the guise of the Freedom of Information Act.”
2
5 October 2020 The Appellant contacted the NMC as a response to the request
was not received.
4 November 2020 The NMC responded and advised that the request was handled
as a Subject Access Request (“SAR”) for the Appellants own
data. Further, that the requested information was third party
personal data and disclosure would be a breach of the General
Data Protection Regulations 2018 (“GDPR”).
18 December 2020 Following an internal review, the NMC wrote to the Appellant,
maintaining its original position.
19 December 2020, The Appellant responded to that refusal saying inter-alia; “ . . . the
redaction points to previous form. It won’t refer a Nurse of the year
if you get my drift. Her history is most relevant but I have sufficient
clout with the witness statements and other investigation reports”
.
Relevant Legislation:
S1 FOIA – General right of access to information held by public authorities
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description
specified in the request, and
(b) if that is the case, to have that information communicated to him.
(2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of
sections 2, 9, 12 and 14.
(3) Where a public authority—
(a) reasonably requires further information in order to identify and locate the information requested, and
(b) has informed the applicant of that requirement,
the authority is not obliged to comply with subsection (1) unless it is supplied with that further
information.
(4) The information—
(a) in respect of which the applicant is to be informed under subsection (1)(a), or
3
(b) which is to be communicated under subsection (1)(b),
is the information in question held at the time when the request is received, except that account may
be taken of any amendment or deletion made between that time and the time when the information is
to be communicated under subsection (1)(b), being an amendment or deletion that would have been
made regardless of the receipt of the request.
(5) A public authority is to be taken to have complied with subsection (1)(a) in relation to any information
if it has communicated the information to the applicant in accordance with subsection (1)(b).
(6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty
to confirm or deny”.
Sections 40 (5A) and 40(5B) provide exemptions from the duty to confirm or deny
whether the requested information is held if it do so would disclose personal data.
Section 3(2) of the Data Protection Act 2018 (“the DPA”) defines personal data as
“…any information relating to an identified or identifiable living individual…”
The data protection principles are set out in Article 5(1) of the UK General Data
Protection Regulations (“GDPR”) (s.40(7) of the Act). The first data protection principle
under Article 5(1)(a) GDPR is that:
“Personal data shall be processed lawfully, fairly and in a transparent manner
in relation to the data subject”.
The requested information can therefore only be processed (i.e. a public authority can
confirm or deny whether the information is held) if to do so would be lawful (i.e. would
meet one of the conditions of law processing listed in Article 6(1) GDPR), fair and
transparent.
Article 6(1) GDPR states that “…Processing shall be lawful only if and to the extent
that at least one of the following [conditions] applies…” The only potentially applicable
condition in this case is condition 6(1)(f) GDPR which states that the processing: -
“…is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the
interests or fundamental rights and freedoms of the data subject which require
protection of personal data…”
4
Commissioners Decision Notice:
[4] The Commissioner determined that NMC is entitled to withhold the
requested information under section 40(2) of the FOIA. Section 40(2) of the
FOIA provides that information is exempt from disclosure if it is the personal
data of an individual other than the requester and where one of the conditions
listed in section 40(3A) (3B) or 40(4A) is satisfied. The Commissioner was
satisfied that the information will relate to the data subjects. The Appellant had,
previous to his FOIA request, been provided with a redacted copy of a report
which relates to a named nurse regarding a specific work incident. This
information therefore falls within the definition of “personal data” in section 3(2)
of the DPA.
[5] The second element of the test is to determine whether disclosure would
contravene any of the DPA principles. In the case of an FOIA request, the
personal data is processed when it is disclosed in response to the request. The
Commissioner reminded herself that the information can only be disclosed if to
do so would be lawful, fair, and transparent.
[6] In considering the application of Article 6(1)(f), it is necessary to consider
the following three-part test: -
I. Legitimate interest test.
II. Necessity test.
III. Balancing test.
[7] The Commissioner used her discretion to apply section 40(2) of the FOIA to
the requested information. The Appellant is clearly seeking access to the
withheld information for a specific reason. The Commissioner considered that
there is a limited legitimate interest in disclosure of this information to the world
at large.
5
[8] In relation to the necessity of disclosure, the Commissioner is satisfied in
this case that there are less intrusive means of achieving the legitimate aims
identified. The Commissioner has not seen any evidence to suggest that the
individual involved would have a reasonable expectation that their personal
data would be disclosed in response to an information request. The
Commissioner considered that disclosure of this information would be
disproportionately intrusive to the data subject as it would reveal information
about third parties which is not otherwise in the public domain. The
Commissioner determined that there is insufficient legitimate interest to
outweigh the data subjects’ fundamental rights and freedoms. The
Commissioner considered that there is no Article 6 basis for processing and so
the disclosure of the information would not be lawful.
Appellants Grounds of Appeal:
[9] The Appellant stated that the decision was made in isolation and did not
take into consideration the entirely of the case. The Appellant stated that the
NMC did not consider the appropriate issue. The Appellant raised that the Data
Subject should have handled the investigation directly. The Appellant averred
that the restriction should be lifted for the Appellant to pursue his action against
the coroner’s inquest verdict on 6th of November 2018.
[10] The Appellant refined the appeal on 14 September 2021 to a redacted line
which fronts a “copious report by one of several parties involved in the matter
culminating in an unexpected death”.
Commissioners Response:
[11] The Commissioner’s position is now that NMC should have relied on
section 40(5B) (a) (i) to neither confirm nor deny that it held the requested
information. The requested information can be said to be the personal data of
a named individual and any substantive response to the request in its entirety
would confirm or deny if a complaint had been made about that named
individual which is also the personal data of that individual.
6
[12] The second issue is whether the processing of that personal data is lawful
under GDPR. Accordingly, the first question is whether there is a legitimate
interest. The Commissioner accepted that there is a legitimate interest and
further accepted that the Appellant has a legitimate interest in any public
confirmation or denial of the existence of a complaint and investigation by NMC.
[13] The next question is whether confirmation or denial is necessary to meet
those legitimate interests. The Commissioner accepted that such processing is
necessary. The final step is the balancing exercise between the legitimate
interests and the rights and freedoms of the relevant data subject i.e., the
named nurse.
[14] The Commissioner held in relation to section 40(2), that the rights and
freedoms of the named Data Subject outweigh the legitimate interests (§§42-
44 of DN). The Commissioner relied upon the First-tier Tribunal in the case of
Joe Naulls v Information Commissioner and NMC (EA/2018/0022, 8 October
2018). The Commissioner is concerned with the correct application of the Act
and continually keeps her position under review. The Commissioner’s amended
position in relation to section 40(5) is consistent with the First-tier Tribunal and
the case of Joe Naulls v Information Commissioner and NMC (EA/2018/0022,
8 October 2018).
[15] The Commissioner contended that the Appellant appears to solely rely on
the argument that disclosure is crucial to an application under section 13 of the
Coroners Act 1988. The Commissioner referred the Appellant to Ian Sadler v
Information Commissioner (EA/2019/0433) where the First-Tier Tribunal
supported the evidencing of a legitimate interest. There appears to be no
evidence that the Attorney General has sought or requires the requested
information to assist in determining whether or not to provide consent in the
circumstances. Further, the Appellant has previously indicated that he already
possesses sufficient information with which to pursue matters (see email of 19
December 2020). The Commissioner argued that disclosure would not be
necessary to this end because the Attorney General could ask the NMC for
7
disclosure of the requested information to a limited audience for a specific
purpose. The Commissioner maintained that section 40(2) is engaged.
Appellants Reply:
[16] The Appellant asserted that the Data Subject was unqualified. The
Appellant contended the NMC believe that disclosure would cause reputational
damage and distress to the Data Subject. The Appellant referred to a report
produced by the NMC and alleged clinical negligence.
The Issues:
[17] The Appellant argues that disclosure under the request is necessary for
justice to be done but does not seem to accept the concept that disclosure to
the world at large under FOI is a different matter. As the request refers to a
named individual in the form of an alleged complaint an important issue is,
would any material or substantive response to the request disclose personal
data of the named individual.
[18] The Commissioners position is set out at Paragraphs [11] to [15] above
and in effect argues that the Public Authority could have and may in fact rely
on the exemption provided by section 40(5)(B)(a)(i). In any event and in all the
circumstances the reliance on the exemption under section 40(2) remains
justified.
Conclusion:
[19] As the request refers to a named individual, the Data Subject, in the form
of an alleged complaint the Tribunal find disclosure of any material or any
substantive response to the request would disclose personal data of the named
individual – the Data Subject. The data protection principles under Article
5(1)(a) and Article 6(1) of the UK GDPR would be engaged and result in a three-
8
part test to be applied under Article 6(1)(f) GDPR in the context of a request for
information under FOIA:
(I) Legitimate interest test: Whether a legitimate interest is being pursued by the
request for information.
(II) Necessity test: Whether disclosure of the information is necessary to meet the
legitimate interest in question.
(III)Balancing test: Whether the above interests override the legitimate interest(s)
or fundamental rights and freedoms of the data subject.
[20] In consideration of the three-part test the Tribunal note and make reference to the
following decisions made by the Upper Tribunal:
Goldsmith International Business School v Information Commissioner and Home
Office [2014] UKUT 563 (AAC) at [35]-[42] (reiterating the Supreme Court’s
approach in South Lanarkshire Council v The Scottish Information Commissioner
at [18]), Glenda Rodriguez-Noza v Information Commissioner and Nursing and
Midwifery Council (GIA/0433/2014), and Information Commissioner v Colleen
[21] The Tribunal accept that the Appellant has a legitimate interest in requesting
the information sought and obtaining confirmation or denial. However, we refer to
Judge Jacobs in Colleen Foster, to note that a disclosure under FOIA is effectively
a disclosure to the world with no restrictions. Thus, the privacy rights of the data
subject should be considered.
[22] In relation to Article 6(1)(f) which states that disclosure must be “necessary”,
the test to be applied is as held in Goldsmith, which states that disclosure must be
“more than desirable but less than indispensable or absolute necessity”. We are
not persuaded disclosure is more than desirable as there are other means for
pursing his quest for Justice, already identified by the Appellant though e.g., the
Attorney General (“the AG”). The Appellant also claims, “clinical negligence” and
maintains he has; “. . . sufficient clout with the witness statements and other
investigation reports . . . “
9
[23] We are of the view that even if it were necessary to provide confirmation or
denial of an alleged complaint against a named individual, or Data Subject, the
Appellant’s legitimate interest is outweighed by the Data Subject’s right to privacy.
With reference to Glenda Rodriguez-Noza and Collen Foster, confirmation or
denial would be unwarranted, given the prejudice likely to be suffered by the Data
Subject because of confirmation or denial, free from any duty of confidence and
available to the world at large. Further, alternative means of addressing the
Appellant’s concerns through the Attorney General (“AG”) should, in our view, not
require the disclosure of the requested information to the world at large. Private
Litigation or action by the AG could and should obtain such relevant information
within the legitimate means available through the appropriate legal channels
without unnecessarily encroaching on the Data Subject’s fundamental rights. We
accept the Commissioners argument that the Appellant has not provided evidence
the AG has a necessity for disclosure under FOIA as sought herein to take any
justified action. The AG could ask the NMC for disclosure of the requested
information to a limited audience for a specific purpose.
[24] The Tribunal accept and adopt the reasoning as set out in paragraphs 33 to
36 of her Response dated 6 October 2021 and further agree to substitute her DN
as sought at Paragraph 37 therein.
[20] If we are wrong in that, we accept and adopt the Commissioner’s’ reasoning
in her Response dated 6 October 2021 at paragraphs 39 to 57.
[21] Accordingly for all the above reasons, we find no error of Law in the
Commissioner’s Decision nor in any error in the exercise of her discretion as
applied herein and we uphold the application of section 40(2) as being justified and
we further accept the Commissioners invitation to substitute her Decision to include
the exemption to which we agree the NMC are entitled, that is to rely on through
section 40~(5)B)(a)(i) FOIA as set out above.
Brian Kennedy QC 7 May 2022.
Promulgated 16 May 2022.
10