Neutral citation number: N/A
Appeal Number: EA/2021/0351
First-Tier Tribunal
(General Regulatory Chamber)
Information Rights Tribunal.
Heard: On the papers by consent.
On CVP on 13th May 2022.
Tribunal Panel
Judge Brian Kennedy QC
Pieter De Waal
Naomi Matthews
Between:
Norman Ingle
Appellant:
and
The Information Commissioner
First Respondent:
and
Cambridgeshire County Council
Second Respondent
Representation: For the Appellant: Norman Ingle, as litigant in person.
For the First Respondent: Sapna Gangani, Solicitor.
For the 2nd Respondent: Pathfinder Legal Services Ltd.
Decision: The appeal was dismissed on
1
REASONS
Introduction:
[1] This decision relates to an appeal brought under section 57 of the Freedom of
Information Act 2000 (“the FOIA”). The appeal is against the decision of the
Information Commissioner (“the Commissioner”) contained in a Decision Notice
(“DN”) dated 10 November 2021 (reference IC-88694-G3P1), which is a matter of
public record.
Factual Background to this Appeal:
[2] Full details of the background to this appeal, the complainant’s request for
information and the Commissioner’s decision are set out in the DN. The appeal
concerns the decision of Cambridgeshire County Council (“The Council”) to rely on
section 40(1) FOIA to refuse to answer the Appellant’s request, on the basis that
the information sought was the Appellant’s own personal data.
[3] The Commissioner found that the Council breached section 17(1) FOIA as it failed
to issue a valid refusal notice, however, the Commissioner noted that this aspect
of the DN is not under challenge. The Commissioner maintains the position set out
in her DN; namely that the Council correctly relied on section 40(1) FOIA to refuse
to answer the Appellant’s request, on the basis that the information sought was the
Appellant’s own personal data. The Appellant now appeals against the DN. The
Commissioner opposes the appeal and invites the Tribunal to dismiss the appeal.
Both the Appellant and the Commissioner consent to this matter being dealt with
on the papers.
History and Chronology
[4] On 19 August 2020, the Appellant requested the following 5 documents:
“Email Head of Insurance Services to Chief Executive 28 August 2002
Email Head of Legal Services to Chief Executive 23 August 2002
Memo Acting Head of Legal Services to Chief Executive 11 July 2001
2
Memo Head of Legal Services to Lead Member (of what?) 30 September 2003
Memo solicitor to Transport Development Officer 24 April 2001”
[5] By way of context, the Commissioner understood that the documents relate to an
ongoing dispute from 1970 and further that the Appellant requested the documents
in 2015. The Council withheld the information on that occasion on the grounds that
it was legally privileged.
[6] The Council did not deal with the request under the FOIA but treated it as a subject
Access request. The Council responded on the 10th September 2020 and refused
to provide the information as it considered it to fall under legal professional privilege
and hence exempt from the requirement to disclose under the General Data
Protection Regulations (“the GDPR”) as the Council viewed the request as a
subject access request for his own personal data as in 2015.
[7] The Appellant told the Council on the 14th September 2020 that the request “is
based on the Freedom of information legislation”.
[8] During the Commissioner’s investigation, the Council reconsidered its position, and
informed the Commissioner that it was now relying on section 40(1) FOIA to refuse
the request, as the information relates to the personal data of the Appellant.
[9] Legal Framework
S1 FOIA – General right of access to information held by public authorities
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description
specified in the request, and
(b) if that is the case, to have that information communicated to him.
(2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of
sections 2, 9, 12 and 14.
(3) Where a public authority—
(a) reasonably requires further information in order to identify and locate the information requested, and
3
(b) has informed the applicant of that requirement,
the authority is not obliged to comply with subsection (1) unless it is supplied with that further
information.
(4) The information—
(a) in respect of which the applicant is to be informed under subsection (1)(a), or
(b) which is to be communicated under subsection (1)(b),
is the information in question held at the time when the request is received, except that account may
be taken of any amendment or deletion made between that time and the time when the information is
to be communicated under subsection (1)(b), being an amendment or deletion that would have been
made regardless of the receipt of the request.
(5) A public authority is to be taken to have complied with subsection (1)(a) in relation to any information
if it has communicated the information to the applicant in accordance with subsection (1)(b).
(6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty
to confirm or deny”.
Section 40 FOIA provides that:
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection
Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B) The second condition is that the disclosure of the information to a member of the public
otherwise than under this Act would contravene Article 21 of the GDPR (general processing:
right to object to processing).
(4A) The third condition is that—
4
(a) on a request under Article 15(1) of the GDPR (general processing:
right of access by the data subject) for access to personal data, the information would be
withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or
4 to, the Data Protection Act 2018, or
(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access
by the data subject), the information would be withheld in reliance on subsection (4) of that
section.
(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were
held by the public authority would be) exempt information by virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent
that any of the following applies—
(a) giving a member of the public the confirmation or denial that would have to be given to
comply with section 1(1)(a)—
(i) would (apart from this Act) contravene any of the data
protection principles, or
(ii) would do so if the exemptions in section 24(1) of the Data
Protection Act 2018 (manual unstructured data held by public
authorities) were disregarded;
(b) giving a member of the public the confirmation or denial that would
have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article
21 of the GDPR (general processing: right to object to processing);
(c) on a request under Article 15(1) of the GDPR (general processing: right of access by the
data subject) for confirmation of whether personal data is being processed, the information
would be withheld in reliance on a provision listed in subsection (4A)(a);
(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement
processing: right of access by the data subject), the information would be withheld in reliance
on subsection (4) of that section.
(6) Omitted
5
(7) In this section—
“the data protection principles” means the principles set out in—
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018.
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that
Act);
“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part
2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see
section 3(2), (4), (10), (11) and (14) of that Act).
(8) In determining for the purposes of this section whether the lawfulness principle in Article
5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the
GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate
interests gateway in relation to public authorities) were omitted.
(as amended by Schedule 19 of the Data Protection Act 2018)
Section 40(1) FOIA is an absolute exemption by virtue of s.2(3)(f) FOIA and is therefore not
subject to the public interest test under s.2(2)(b) FOIA.
Personal data is defined as “any information relating to an identified or identifiable living
individual.” (s.3(2) Data Protection Act 2018 (“DPA”)), and the ‘processing’ of such information
includes “disclosure by transmission, dissemination or otherwise making available” (s.3(4)(d)
DPA), and therefore includes disclosure under FOIA.
The data protection principles referred to in s.40(3A)(1) FOIA are set out in Article 5(1) of the
General Data Protection Regulations EU2016/679 (‘GDPR’), and s.34(1) DPA18 (the latter with
regards to law enforcement processing) (s.40(7) FOIA). The first data protection principle under
Article 5(1)(a) GDPR is that personal data shall be:
“processed lawfully, fairly and in a transparent manner in relation to the data subject”.
The information can therefore only be disclosed if to do so would be lawful (i.e. would meet one
of the conditions of lawful processing listed in Article 6(1) GDPR), fair, and transparent.
6
Commissioner’s Decision Notice:
[10] The Commissioner investigated the matter and held that section 40(1) FOIA had
been engaged in this instance for the following reasons:
(I) “The Commissioner outlined what s40(1) says and that the definition of
personal data is “any information relating to an identified or identifiable living
individual” (s2(2) DPA 2018). The Commissioner summarised that an
identifiable living individual is one who can be identified, directly or indirectly,
in particular by reference to an identifier such as a name, an identification
number, location data or an online identifier; or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural or
social identity of the individual. Information will relate to a person if it is about
them, linked to them, has biological significance for them, used to inform
decisions affecting them or has them as its main focus. [14-18];
(II) The Council has told the Commissioner that the requested information is
contained within a complaint file relating to the Appellant and the content of
the 5 documents specified in the request relate to the Appellant and his
potential claims for financial settlement. These very same emails were
requested by the Appellant in 2015 as a subject access request made under
the Data Protection Act 1998. That request was refused on the grounds that
the requested materials were subject to legal professional privilege. The
Commissioner considered that refusal at that time and upheld the Council’s
position. The information requested is in relation to a legal claim made by
the Appellant and gives advice on that claim and also advises on how to
respond accordingly to the Appellant. The Commissioner is therefore
satisfied that this information ‘relates’ to the Appellant. As this information is
about the Appellant’s legal claim to the Council, specifically giving advice on
his claim and how to respond to him, the Commissioner is satisfied that the
information would ‘identify’ the Appellant. The requested information is,
therefore, the personal data of the Appellant. As such, the Commissioner
finds that section 40(1) of the FOIA is engaged and the Council was correct
to refuse the Appellant’s information request. [19-23]”
7
Grounds of Appeal:
[11] The Appellant’s Grounds of Appeal detailed that the Council failed to notify the
Appellant of their reliance on section 40 F0IA to refuse to provide the information,
which the Appellant contended is a ‘clear breach of natural justice”. The Appellant
argued that the requested information is not the Appellant’s own personal data.
The Commissioner’s Response:
[12] The Commissioner maintained her position as outlined in the DN and resisted the
appeal. The Commissioner submitted that whilst the Council did not notify the
Appellant that they were relying on section 40 FOIA to refuse to provide the
information, this was noted and the Commissioner found the Council to have
breached section 17 FOIA in not providing a valid refusal notice.
[13] The Commissioner maintained that the requested information is the Appellant’s
personal data and that the financial issue relates to him, it is in his file and therefore
captured by the definition of personal data. The Appellant has failed to provide an
explanation as to why the Commissioner should discharge her findings.
Appellant’s Reply to the Commissioner’s Response:
[14] The Appellant replied to the Commissioner and referred to a previous application
from 2004 in which 600 documents were provided to the Appellant. The Appellant
stated that Mrs Harding on 6th January 2005 emailed the Appellant to say, in part,
that the Appellant’s file is about an issue and not an individual. In addition, the
Appellant argued that a further 300 pages were located in 2006. The Appellant
accepted that there has been correspondence between himself and the Council
since that time, however, the Appellant claimed that he was never informed by the
Council that legal privilege no longer applies as a reason for non-disclosure.
[15] The Appellant argued that the issue is as follows: At a Planning Appeal on 24th
February 1970 did the Cambridgeshire County Council produce a knowingly
incorrect plan showing road accidents in the vicinity of the Appeal site? If they did,
then why? The Appellant refuted the contention that the request is vexatious. The
8
Appellant noted that his recourse is to the First Tier Tribunal given the conduct of
the Commissioner and Council in this case.
[16] The Appellant sought that the Council be joined in the interests of justice. The
Appellant argued that the Iniquity Provision should apply to this case and that he
is entitled to a decision on the facts and as set out in the grounds of appeal by the
Commissioner. The Appellant cited section 42 FOIA and schedule 11, paragraph
9 of the Data Protection Act 2018 for the purposes of arguing that Iniquity Provision
should apply. The Appellant submitted that he had sought the correspondence
between the Council and the Commissioner. The Appellant contended that whilst
his application was refused, he is entitled to the same on the grounds that the
correspondence is about him. The Appellant argued that the Commissioner is
promoting the suppression of documents. The Appellant requested the release of
the correspondence between the Commissioner and the Council.
Second Respondent’s Submissions:
[17] In opposing the appeal, the Council admitted that it did not inform the Appellant
directly at the material time, that they had during the course of the Commissioner’s
investigation, relied on section 40(1) in refusing to provide the requested
information. The Council submitted that this is not a breach of natural justice.
[18] The Council stated that the Appellant was told in the Commissioner’s DN dated 13
March 2007 that the information concerned his personal data. The DN states as
follows:
“In a further letter to the Commissioner dated 18 September 2006, the public
authority confirmed that the complainant had been provided with all information
held about his planning complaint since 1969, with the exception of five items
withheld under the legal professional privilege exemption outlined in Schedule
7(10) of the Data Protection Act 1998. The application of this exemption by the
public authority is currently being considered by the Commissioner’s Data
Protection Casework and Advice Division. However, these items would not be
disclosable under the Freedom of Information Act in any event, being personal data
9
of which the applicant is the data subject and therefore exempt under section 40(1),
an absolute exemption.”
[19] The Appellant was advised of the Council’s position by the Commissioner in the
Notice in any event and the Tribunal will reconsider the same. With reference to
the Council’s internal email dated 6 January 2005, the Council stated that the email
reads as follows:
“Mr Ingle’s file is about an issue, not an individual and therefore his right to see
information comes under FOI.”
[20] The Council argued that the email does not refer or relate to the Request which is
the subject of this appeal but to the Appellant’s request for information relating to
the historical planning dispute. The email does not deal with the specific disclosure
of the five documents requested nor does it explain why the five documents are
not personal data. The Council accepted, adopted and endorsed the
Commissioners reasoning provided in her DN. The Council maintained that the
information falls within the definition of personal data and that the Appellant has
failed to explain how or why the information requested is not his personal data.
Appellant’s Final Submission:
[21] The Appellant stated that on numerous occasions he has tried to settle the matter
with the Council. The Appellant maintained that the 5 documents relate to an issue.
The Appellant argued that the issue concerns a planning appeal held on 24 th
February 1970 and the question as to whether the Council submitted a plan to the
Planning Inspector showing road accidents in the vicinity of the Appeal site. The
Appellant questioned why if 900 pages of documents have been disclosed do only
5 relate to the Appellant.
[22] The Appellant raised the doctrine of estoppel for the purposes of arguing that the
Tribunal are precluded from finding that the documents are personal data on the
grounds that between 2005 and 2020 the Council maintained that the documents
related to an issue.
10
[23] The Appellant submitted that there is a breach of natural justice. The Appellant
reiterated that he did not find out about the Council’s change of position until the
DN was provided to him. The Appellant highlighted his attempts to view the
correspondence between the Commissioner and the Council and his reliance on
the Iniquity Provision. The Appellant questioned the conduct of the both the
Commissioner and the Council in their handling of this case and argues the Council
are effectively Estopped form raising the s40 exemption retrospectively, that there
is a breach of Natural Justice and both Respondents have failed to enter
Alternative Dispute Resolution. His comprehensive compilation of his submissions
dated 16 January 2022 are fully noted.
The Hearing:
[24] The Tribunal sat to hear this appeal on 13th May 2022 and with the consent of the
parties considered the arguments as presented on the papers. The Appellant
misunderstands the purpose of the FOIA and that any resulting disclosure arising
from a request thereunder is disclosure to the world at large. While it was only
raised during the investigation of his complaint to the Commissioner, the Absolute
Exemption provided under Section 40(1) was provided by Parliament to cover a
situation which we find, is properly applied through the impugned DN. As s40(1) is
an absolute exemption there is no Public Interest test. We accept the reasoning
provided by the Commissioner that the late application of the exemption cannot be
said to be a breach of Natural Justice as clearly set out in Para 20 of the DN. The
appeal process itself is the process of natural justice that pertains. This Tribunal
considers the issues de novo. Similarly, we find the law on Estoppel cannot be said
to apply in the circumstances of the application of s40(1) in this case. Either this
absolute exemption under the FOIA applies, or it does not. It is not dependent
upon early recognition or any other related reason for refusal of disclosure. Further
we find. that because the Public Authority failed to raise it at the outset or failed to
describe it as Personal Data (in the sense that it has been identified by the
Commissioner) by describing relevant information as an “issue” is not a ground for
establishing an error of Law on the part of the Commissioner. To categorise
information as part of an issue does not mean that it is not also Personal Data at
11
the same time. The two are not mutually exclusive. Ultimately the Commissioner,
during her investigation has clearly, and properly in our view, identified the withheld
information included in the 5 documents in question as a subject access request
for the Appellants own personal data.
[25] In her DN the Commissioner has, in our view correctly, described the relevant
withheld information thus: “The Commissioner is therefore satisfied that this
information ‘relates’ to the Appellant. As this information is about the Appellant’s
legal claim to the Council, specifically giving advice on his claim and how to
respond to him, the Commissioner is satisfied that the information would ‘identify’
the Appellant. The requested information is, therefore, the personal data of the
Appellant. As such, the Commissioner finds that section 40(1) of the FOIA is
engaged, and the Council was correct to refuse the Appellant’s information
request.” DN [19-23]”
[26] We also accept and adopt the reasoning behind the response provided by the
Second Respondent to the Appellants’ argument and assertions regarding the
“iniquity provision”, and the Appellants’ repeated requests, as set out clearly at
paras 8 to 17 of the Second Respondents Response dated 11 March 2022.
[27] The Tribunal have the advantage of confirming by our own observation the nature
and extent of the Personal Data in question and the context in which it exists and
was recorded in the withheld information in the Closed Bundle provided. The
requested information is contained within a complaint file relating to the Appellant
and the content of the 5 documents specified in the request relate to that file, the
Appellant, and his potential claims for financial settlement.
[28] Accordingly for the reasons above we find that the Appellant has failed to
persuade us that the Commissioner has erred in Law, or in the exercise of her
discretion where applicable, in the impugned DN and we must dismiss this
appeal.
Brian Kennedy QC 21 May 2022.
Promulgation Date: 06 June 2022
12