First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2021/0248
Before
Judge Stephen Cragg Q.C.
Tribunal Members
Ms Marion Saunders
Ms Suzanne Cosgrave
Heard via the CVP platform on 1 March 2021
BETWEEN:
Joshua Howells Appellant
And
The Information Commissioner Respondent
The Appellant represented himself
The Commissioner was not represented.
DECISION AND REASONS
DECISION
1
1. The appeal is allowed and a decision notice substituted for that issued by the
Commissioner.
MODE OF HEARING
2. The proceedings were held via the Cloud Video Platform. The Appellant joined
remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing
in this way
3. The Tribunal considered an agreed open bundle of evidence comprising 65 pages,
some additional papers from the Appellant, skeleton arguments and a bundle of
authorities.
BACKGROUND AND INITIAL DECISION MAKING
4. On 23 January 2021, the Appellant wrote to the Dyfed Powys Police (DPP) and
requested information in the following terms:
“Please confirm without again making this widespread knowledge.
Is this individual employed by dyfed powys police?
Your early assistance will be appreciated and I trust this request
will be treated with great confidence.
5. We understand that the request was accompanied by a photograph that we have not
seen, and that the request was made at the same time that a police complaint was
submitted (and probably as part of that complaint). The DPP referred the issue to its
FOIA team and responded on 6 April 2021. It stated that it was unable to confirm
nor deny that it held the requested information as the duty in s1(1)(a) of the Freedom
of Information Act 2000 (FOIA) does not apply, by virtue of Section 40(5) FOIA.
Following an internal review by their legal services department, the DPP wrote to
the Appellant on 14 May 2021. It stated that it upheld its original response that it
2
could ‘neither confirm nor deny’ if the requested information was held. The
Appellant contacted the Commissioner on 4 May 2021 to complain about the way
the request for information had been handled.
THE LAW
6. Under section 1(1)(a) FOIA, a public authority is obliged to tell an applicant whether
or not it holds the information requested. This is known as the “duty to confirm or
deny”. There are however exemptions from this duty. Section 40(5B)(a)(i) FOIA
provides that the duty to confirm or deny does not arise if doing so would contravene
any of the principles relating to the processing of personal data set out in Article 5 of
the UK General Data Protection Regulation EU2016/679 (‘GDPR’).
THE DECISION NOTICE
7. The Commissioner has produced a decision notice which explores whether the
DPP’s decision to neither confirm nor deny (NCND) that it hold the information
can be justified by the application of the test in s40(5B)(a)(i) FOIA, as follows.
8. First, the Commissioner had to decide whether the confirmation or denial that the
requested information was held, would constitute, in itself the disclosure of a third
party’s ‘personal data’. Section 3(2) of the Data Protection Act 2018 defines personal
data as: “any information relating to an identified or identifiable living individual”.
The Commissioner said:-
15. Information will relate to a person if it is about them, linked to them, has
biographical significance for them, is used to inform decisions affecting them
or has them as its main focus.
16. The Commissioner is satisfied, from reviewing the request, that if the
DPP were to either confirm or deny it held the information, it would involve
the disclosure of personal data. The first criterion set out is therefore met.
9. Secondly, the Commissioner noted that the fact that confirming or denying whether
the requested information is held would reveal the personal data of a third party does
not automatically prevent the DPP from refusing to confirm whether it holds this
3
information. Thus the next element of the test is to determine whether such a
confirmation or denial would contravene any of the data protection principles. The
Commissioner identified Article 5(1)(a) UK GDPR as containing the relevant
principle and this states that: “Personal data shall be processed lawfully, fairly and in
a transparent manner in relation to the data subject”. The Commissioner explained
that:-
20. In the case of a FOIA request, the personal data is processed when it is
disclosed in response to the request. This means that the information can
only be disclosed – or as in this case, the public authority can only confirm
whether or not it holds the requested information – if to do so would be
lawful (i.e. it would meet one of the conditions of lawful processing listed in
Article 6(1) UK GDPR), be fair and be transparent.
10. Thirdly, then the Commissioner had to decide whether the confirmation that DPP
held the information would amount to lawful processing Commissioner explained:-
21. Article 6(1) of the UK GDPR specifies the requirements for lawful
processing by providing that “processing shall be lawful only if and to the
extent that at least one of the” conditions listed in the Article applies. One of
the conditions in Article 6(1) must therefore be met before disclosure of the
information in response to the request would be considered lawful.
22. The Commissioner considers that the condition most applicable on the
facts of this case would be that contained in Article 6(1)(f) UK GDPR which
provides as follows:
“processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party except where such
interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal
data…
11. Fourth, in applying the test in Article 6(1)(f) GDPR, the Commissioner explained
that there is a three-part-test, intrinsic in Article 6(1)(f) as follows:-
(a) Legitimate interest test: Whether a legitimate interest is being pursued in the
request for information;
(b) Necessity test: Whether confirming or denying that the requested
information is held is necessary to meet the legitimate interest in question;
(c) Balancing test: Whether the above interests override the
4
legitimate interest(s) or fundamental rights and freedoms of the data
subject(s).
12. In relation to the legitimate interests test, the Commissioner said as follows:-
25. In considering any legitimate interests in confirming whether or not the
requested information is held in response to a FOI request, the
Commissioner recognises that such interests can include broad general
principles of accountability and transparency for their own sake as well as
case specific interests.
26. Further, a wide range of interests may be legitimate interests. They can be
the requester’s own interests or the interests of third parties, and commercial
interests as well as wider societal benefits. They may be compelling or trivial,
but trivial interests may be more easily overridden in the balancing test.
27. In this case, it is clear that the complainant is seeking the requested
information to identify if a specific individual is employed by DPP.
28. The Commissioner is satisfied that there may be a wider legitimate
interest, i.e. transparency about the DPP’s employees.
13. In relation to the necessity test, the Commissioner found as follows:-
29. ‘Necessary’ means more than desirable but less than indispensable or
absolute necessity. Accordingly, the test is one of reasonable necessity which
involves the consideration of alternative measures, and so confirming
whether or not the requested information is held would not be necessary if
the legitimate aim could be achieved by something less. Confirmation or
denial under FOIA that the requested information is held must therefore be
the least intrusive means of achieving the legitimate aim in question.
30. The Commissioner is satisfied in this case that there are no less intrusive
means of achieving the legitimate aims identified.
14. In relation to the balancing test, the Commissioner said that:-
31. It is necessary to balance the legitimate interests in confirming whether
or not the requested information is held against the data subject(s)’ interests
or fundamental rights and freedoms. In doing so, it is necessary to consider
the impact of the confirmation or denial. For example, if a data subject would
not reasonably expect the public authority to confirm whether or not it held
the requested information in response to a FOI request, or if such a
5
confirmation or denial would cause unjustified harm, their interests or rights
are likely to override legitimate interests in confirming or denying whether
information is held.
32. Disclosing whether the requested information was held would reveal
whether or not an individual, who could be identified, was or was not an
employee of DPP.
33. Whilst the Commissioner notes the complainant’s request ‘Please confirm
without again making this widespread knowledge’, information released
under the FOIA is to the world at large. As the information relates to a living
person and that person is identifiable, it is considered personal data, and an
individual would expect their personal identifiable information to be treated
as confidential, and not for public disclosure.
34. Based on the above factors, the Commissioner has determined that there
is insufficient legitimate interest to outweigh the data subjects’ fundamental
rights and freedoms, and that confirming whether or not the requested
information is held would not be lawful.
THE APPEAL AND RESPONSE
15. The Appellant’s appeal is dated 9 September 2021. He says:-
I disagree I am asking for personal information. My request is [for]
confirmation [that] a person works for a public body.
The information is needed to possible misconduct in public office.
Within a month of receiving a VRR decision regarding myself being the
victim of crime, I received contact from an individual I believe to be
employed by Dyfed Powys police. If he is his actions are wholly
inappropriate.
I do not require his name of any other information just confirmation he is or
is not employed by the public body.
16. The Appellant added that if he received this conformation, then he wanted a
complaint investigated into the person’s contact with a victim.
17. The Commissioner’s response is dated 13 October 2021. In relation to whether the
information is personal data or not the Commissioner says:-
If the information is held and the Data Subject is employed by Dyfed Powys
Police it will confirm his employment, and that the Appellant is seeking to
make allegations of misconduct against the Data Subject. If the information
is not held it confirms that the Data Subject is not employed by Dyfed Powys
Police. Confirmation or denial will clearly therefore disclose personal data,
6
after all that is the entire purpose of the request given that the Appellant
submitted a photograph as part of the request which was for the purpose of
identifying the individual.
Similarly the entire purpose of the request is to identify the Data Subject,
who can be identified from the photograph that is a part of the request. In
order to determine whether a person is identifiable, account should be taken
of all the means that are reasonably likely to be used by any person to identify
the individual.
…any such confirmation or denial would be free from any duty of confidence
meaning that the Appellant could share the identification (i.e. the personal
data) with any other individual.
18. Importantly, the Commissioner says in her response that she has changed her view
in relation to the ‘necessity test’ (see above). She now says:-
The Commissioner submits that it is not necessary for the requested personal
data which would be disclosed as a result of confirmation or denial to be
disclosed to the world at large. This is on the basis that alternative and less
privacy intrusive methods of resolving the Appellant’s concerns are available
by way of misconduct complaints to the relevant police force if the Data
Subject was indeed employed by a police force. The Appellant’s primary
concern appears to be if the Data Subject was employed by Dyfed Powys
Police then there would be grounds for a misconduct complaint. However
there is no evidence to suggest that any misconduct process has been initiated
with Dyfed Powys Police. In the first instance the Commissioner submits
that there are alternative available means of resolving the Appellant’s
concerns without recourse to disclosure under FOIA, by way of
correspondence with Dyfed Powys Police through complaint mechanisms.
These ought to be pursued in the first instance. The Commissioner notes that
the Appellant is not aware of the Data Subject’s name, or whether he / she
is employed by Dyfed Powys Police. However given that his grounds for
complaint are based on the Data Subject being employed by Dyfed Powys
Police, it stands to reason that any complaint to Dyfed Powys Police
regarding a suspected employee of the force should be investigated and
responded to.
19. Also on 13 October 2021, the Appellant responded to this by email and said:-
The relevant police force refuse to accept complaints and have threatened
me with a contact management strategy.
Initially the request was sent to the legal services department before being
directed to the FOIA team
I did not direct my complaint into the public domain as is being pleaded.
As per evidence attached of email sent on January 23rd.
7
I attempted to resolve this outside of the public domain however was
channelled by the force to the public domain as evidenced.
20. It does not appear that the Commissioner has responded to this additional
information.
THE HEARING
21. The Appellant appeared in person, and the Commissioner was not represented. The
Appellant provided us with some background to this matter.
22. The Appellant told us that he had made a formal police complaint on 23 January
2021 (the same date as his request for information) to DPP about the actions of a
police officer. This followed involvement in a judicial review case (which seems as
though it may now have resolved) about a Victim’s Right to Review (VRR) relating
to another matter. The Appellant told us that he had sent the photograph of the
police officer as part of the complaint. He said the officer in the photograph was
wearing a black tee shirt and you could see his police epaulettes.
23. The Appellant had some paperwork with him and read out part of a response dated
1 April 2021 in which DPP had said that no further action would be taken in relation
to the complaint.
24. The Appellant told us that DPP had written to him again on 9 December 2021 to
say that the complaint would be looked at again. He could not tell us why the police
had changed their mind about investigation.
25. He read to us from a further letter dated 10 January 2022 in which a DC Simon
Reynolds said that at present the complaint ‘lacked clarity or suitable context’. The
Appellant said that he did not want to send DPP the images (he says were sent by
the officer in question) as he was not yet sure he was complaining to the right police
force. He thought it possible that the police officer was from South Wales Police.
DC Reynolds said that he would contact the Appellant again after 1 March 2022 and
8
the Appellant said that the officer knew that the hearing in this case was taking place
on that day.
DISCUSSION
26. From the decision notice it does not appear that the Commissioner has made any
enquiries of either DPP or the Appellant before reaching her view. It does not appear
that the Commissioner sought any clarification from the Appellant before changing
her view on ‘necessity’, and it does not appear that the Commissioner considered or
responded to the clarification when supplied by the Appellant.
27. Doing the best we can from the bundle and the information provided by the
Appellant it appears that the Appellant made a police complaint on 23 January 2021
to DPP and provided a photograph of the officer he wanted to complain about. He
asked whether the person in the photograph was employed by DPP. He did not
intend this to be treated as a FOIA request and indeed requested confidentiality.
DPP, as perhaps it had to, treated the request as a FOIA request.
28. It is unclear exactly what has happened to the complaint but it appears that the
Commissioner’s assertion in the Response that ‘there is no evidence to suggest that
any misconduct process has been initiated with [DPP]’ is wrong. It appears that DPP
have asked for the images and communications which would form the basis of the
complaint but, perhaps understandably, the Appellant is reluctant to disclose these
without confirmation that he complaining to the right police force (or whether he
should be pursuing a complaint to the police at all).
29. That appears to have triggered a reluctance in DPP to investigate the complaint, and
it seems that things have reached a stalemate pending the outcome of this appeal.
30. We agree with the statutory framework and the steps in the analysis adopted by the
Commissioner in the decision notice. We accept that, even though a confirmation
whether the information is held or not would not provide a name to put to the
photograph, confirmation or denial would be the disclosure of personal information
to the extent that the ‘world at large’ would be entitled to told whether or not the
9
person in the photograph is a police officer or not (even though the Appellant says
he does not attend that).
31. We agree with the Commissioner that the Appellant has legitimate interests in the
disclosure of confirmation or denial. However, we would add that the legitimate
interest in identifying whether or not the person in the photograph is a DPP officer
is for the particular reason of knowing whether the Appellant’s complaint is correctly
directed to DPP (or to the police at all). There is also a legitimate interest in ensuring
that police complaints are properly investigated, which we take into account.
32. We agree with the Commissioner’s finding on the ‘necessity’ test in the decision
notice, and do not accept the basis for the Commissioner’s change of mind in the
Response. It appears to us that the Appellant has no other way forward in
progressing his complaint. There is no evidence that DPP are willing to tell him
whether his complaint is, in fact, against one of their officers, and we understand the
Appellant’s reluctance to proceed without this information. The Appellant read from
a letter from DPP which stated that the police would consider the position after 1
March 2022, which was the date of the Tribunal hearing. Having heard from the
Appellant in our view the Commissioner is wrong to say that ‘there are alternative
available means of resolving the Appellant’s concerns without recourse to disclosure
under FOIA’.
33. Lastly, then it is necessary to balance the legitimate interests in confirming whether
or not the requested information is held against the data subject(s)’ interests or
fundamental rights and freedoms. In doing so, it is necessary to consider the impact
of the confirmation or denial. For example, if a data subject would not reasonably
expect the public authority to confirm whether or not it held the requested
information in response to a FOI request, or if such a confirmation or denial would
cause unjustified harm, their interests or rights are likely to override legitimate
interests in confirming or denying whether information is held.
34. If the person in the photograph is identified as a police officer then there is no
particular reason why that person should expect not to be so identified, it seems to
us (or none that has been put forward for us to consider). Police officers are usually
10
publicly identifiable, often because they will be in uniform. If there were particular
reasons why identification (or not) was inappropriate in this case, then DPP could
have explained those reasons in CLOSED submissions, but this has not been done.
If the person is not a police officer then, in our view, although there may be an
expectation that this information is not disclosed, it seems very unlikely that that
would cause unjustified harm or distress. We note that there is no name attached to
the person in the photograph.
35. In any event, it seems us on the particular facts of this case, that the legitimate
interests in this case (ability of the Appellant to pursue a police complaint, and the
general interest in the efficacy of the police complaints system), especially in
circumstances where there appear to be no other means by which those legitimate
interests can be realised, result in a conclusion that they outweigh the particular rights
and freedoms of the individual in this case, in relation to the simple question of DPP
confirming or denying whether the individual in the photograph is or is not a police
officer in the service of DPP.
36. On that basis, this appeal is allowed and we substitute a decision. A copy of this
decision must be sent to DPP.
37. The Tribunal requires the Dyfed and Powys Police to take the following steps to
ensure compliance with the legislation:-
Confirm or deny to the Appellant whether the person pictured in the
photograph submitted by the Appellant is (or was at the time of the request)
a member of the DPP force.
38. DPP must take these steps within 35 calendar days of the date of this decision.
Failure to comply may result in the Tribunal making written certification of this fact
to the Upper Tribunal, in accordance with rule 7A of the First-tier Tribunal (General
Regulatory Chamber) Rules1 and may be dealt with as a contempt of court.
1
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1006547
/consolidated-ftt-grc-rules-21072021.pdf
11
Stephen Cragg QC
Judge of the First-tier Tribunal
Date: 4 March 2022
Promulgation Date: 7 March 2022
12