Case Reference: EA/2021/0361
First-tier Tribunal
General Regulatory Chamber
Information Rights
Decided without a hearing
On: 7 June 2022
Decision given On: 9 June 2022
Before
TRIBUNAL JUDGE HAZEL OLIVER
TRIBUNAL MEMBER ROSALIND TATAM
TRIBUNAL MEMBER DAVE SIVERS
Between
JON MANNERS
Appellant
and
INFORMATION COMMISSIONER
Respondent
Decision: The appeal is dismissed
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated
8 November 2021 (IC-74025-V0F1, the “Decision Notice). The appeal relates to the application of
the Freedom of Information Act 2000 (“FOIA”). It concerns information about Executive Team
expenses claims requested from the Information Commissioner’s Office (the “ICO”).
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can
properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-
tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. The requester says that until October 2019, the ICO published the actual expenses claims
forms for the Executive Team. These forms give various details relating to the expense, including
the name of the individual, date of trip or expense, category of expense and description of expense.
© CROWN COPYRIGHT 2022
The “description” gives details of the expense, such as the mode of transport used and the location
of travel. In some cases, corporate account statements were published instead.
4. The ICO now publishes more limited information. This began in October 2020. The
information gives the name of the individual, transaction date, expense type, purpose and amount.
The entries under “purpose” are general descriptions such as “Rail Bus Tube Taxi” or “Food / Drink
Whilst Travelling” or “IT Equipment”. For example, the type and class of travel expenses is not
specified.
5. On 5 October 2020, the appellant wrote to the ICO and requested the following information
(the “Request”). This followed on from earlier requests about expenses information and was made
on behalf of the PCS trade union Branch Executive Committee at the ICO.
“Accordingly, we would be grateful if you could now provide us with the Expenses Claim Forms
and/or the Account Statements for the Executive Team expenses claims made since October
2019, and that you could do so within a reasonable timeframe.”
6. The ICO responded on 20 October 2020, “The expenses are published in line with the attached
and available on the website.”
7. On 27 October 2020 the appellant disputed that the requested information was available on
the ICO website and asked for:
• The Expenses Claim Forms and/or the Account Statements for the Executive Team
expenses claims made since October 2019.
• If ET expenses claims are now being presented for authorisation in the new opaque
mode, we also now request the supporting documentation as well (eg receipts).
8. On 23 November 2020 the ICO responded and stated that, “The expenses information and
corporate charge card information are all available and up to date on the ICO website.”
9. On 1 December 2020 the appellant explained that Corporate Charge Cards information stops
in October 2019 and is not therefore available on the website. His position was that all of the
information he had requested was not available on the ICO’s website and he again requested the
same information.
10. The ICO responded on 19 February 2021. It confirmed that the information in the first part of
the request was available on the ICO website and so exempt from disclosure under section 21 FOIA
(information accessible by other means), and provided a link. It refused to disclose the remaining
information under section 40(2) FOIA (personal data). The appellant requested an internal review
on 22 February 2021. The ICO responded on 29 March 2021 and maintained the same position.
11. The appellant complained to the Commissioner, initially in January 2021. The ICO provided
further information to the appellant on 1 October 2021, which set out a full description of information
held. The ICO said that there were 391 instances of expenditure over the time period covered by
the scope of the Request, and explained that no receipt is held for a number of these instances (such
as for London Underground journeys).
12. The Commissioner decided:
2
a. Published information about expenses was exempt from disclosure under section 21
FOIA, as it was reasonably accessible on the relevant spreadsheet.
b. Information in the expenses claim forms and supporting evidence (such as receipts),
which is not published, is exempt from disclosure under section 40(2) FOIA. It is personal
data. Disclosure is reasonably necessary to provide a full picture of expenses claimed,
in order to meet the legitimate interest of transparency relating to expenses claimed by
Executive Team members. However, this is outweighed by the data subjects’ privacy
rights. The withheld information provides little further detail to meet the legitimate
interests, but the individuals would not have a reasonable expectation of disclosure and
it would release intrusive amounts of specific information.
The Appeal and Responses
13. The appellant appealed on 5 December 2021. His grounds of appeal are:
a. The ICO previously published Executive Team expenses claims forms, and these remain
published by month from 2012 to October 2019. The ICO has accepted in the past that
disclosure passes the relevant test, and there is nothing to explain what has changed or
why the historic personal data is still published.
b. The detail in the expenses claims forms and receipts is greater than the restricted
information now published. There is legitimate interest in knowing what class of travel is
being used, or whether taxis are used instead of more economical forms of travel. The
decision to reduce the detail of published expenses thwarts the purposes of transparency
and accountability.
c. The ICO has ordered disclosure by other public authorities of similar expenses claims,
such as in decision notice FS50730692.
14. The Commissioner’s response maintains that the Decision Notice was correct.
a. The appellant has requested information since October 2019, and publication of similar
information in the past is not relevant to the appeal.
b. The legitimate interests are not sufficient to outweigh the data subjects’ rights and
freedoms. Additional information such as taxi details would not show if the journey was
justified. Receipt information about time or location, or details of the product or service
paid for, would add little to the understanding of whether the expense was reasonable.
There are a number of first-class rail receipts, but the ICO confirms that this was within
their travel policy on grounds of safety and security.
c. The data subjects have a reasonable expectation that this information would be withheld,
where it involves disclosure of specific information about their location at a specific time
outside formal engagements. Disclosure of information such as rail receipts would allow
piecing together of routine travel information and other habits which may represent a
safety and security risk to individuals who have public profiles.
3
d. The Commissioner decides each case on its own facts, and has referred to another
decision on expenses where reliance on section 40(2) was upheld (FS50807443).
15. The appellant submitted a reply which makes the following points:
a. The ICO cannot simultaneously believe that the same categories of personal data can
lawfully continue to be published from 2012-2019, while publication of those same
categories from 2019 to date would be unlawful.
b. The ICO’s accounting systems hold significant additional information beyond what is
currently disclosed proactively, and disclosure of this information would be of
considerable value in the accountability and transparency of senior management
expenses.
c. The class of travel, and the type of transportation, is critical to a public understanding
of the expenses information. Facilitating scrutiny of first-class travel based on safety
and security concerns is precisely the function of FOIA disclosures. Disclosure of
receipts or the fact they were not provided is also a relevant scrutiny mechanism.
d. It would seem to stretch credulity to suggest that a senior public servant would suffer
unwarranted damage or distress should their use of taxis, or first-class travel or
accommodation facilities, become public knowledge.
e. Information appears to have been withheld without consideration as to whether it
relates to “formal engagements” or not. It is not within the reasonable expectation of a
senior public servant that expenses information would be withheld – particularly those
categories of information that were routinely published between 2012-2019.
f. If there were a genuine safety and security risk, it would have been appropriate to apply
section 38 FOIA.
Applicable law
16. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the
description specified in the request, and
(b) if that is the case, to have that information communicated to him.
…….
2 Effect of the exemptions in Part II.
…….
(2) In respect of any information which is exempt information by virtue of any provision of
Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring absolute
exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exemption
outweighs the public interest in disclosing the information.
……..
4
40 Personal information.
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act—
(a) would contravene any of the data protection principles….
…….
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance with the
law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been
served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in
question was based.
17. The Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA.
18. The data protection principles are those set out in Article 5(1) of the General Data Protection
Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a)
General Data Protection Regulation (GDPR) is that personal data shall be: “processed lawfully, fairly
and in a transparent manner in relation to the data subject”. To be lawful, the processing must meet
one of the conditions for lawful processing listed in Article 6(1) GDPR. These include where “the
data subject has given consent to the processing of his or her personal data for one or more specific
purposes” (Article 6(1)(a)). It also includes where “processing is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The GDPR
goes on to state that this condition shall not apply to processing carried out by public authorities in
the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article
6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.
19. The Article 6(1)(f) balancing test involves consideration of three questions (as set out by Lady
Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
5
20. The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
Issues and evidence
21. The appellant has confirmed in his response to the ICO’s response that he does not dispute
the application of section 21 FOIA to the information actually published on the ICO’s website. He
disputes the application of section 40 to the remaining requested information.
22. The issues are:
a. Is the withheld information personal data?
b. Is the data controller or third party or parties to whom the data are disclosed pursuing a
legitimate interest or interests?
c. Is the processing involved necessary for the purposes of those interests?
d. Are such interests overridden by the interests or fundamental rights and freedoms of the
data subject which require protection of personal data.
23. By way of evidence and submissions we had the following, all of which we have taken into
account in making our decision:
a. An agreed bundle of open documents.
b. A closed bundle of documents containing the withheld information (although it is not clear
whether this contained all of the information or a sample).
Discussion and Conclusions
24. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review any
finding of fact on which the notice in question was based. This means that we can review all of the
evidence provided to us and make our own decision. We deal in turn with the issues.
25. Is the withheld information personal data? This is not disputed. It is clear that the withheld
information is personal data about individuals, some of which is of a sensitive nature (such as partial
credit card numbers, health and dietary information). Although names are not written on all of the
receipts, it would be possible to match them with individuals based on the expenses information that
is publicly available.
26. Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests? We accept that there are legitimate interests in disclosure of
additional information about expenses claims and associated receipts for senior staff at the ICO. In
particular, interests in openness and transparency relating to the expenses incurred by the
employees of a public body such as the ICO.
27. Is the processing involved necessary for the purposes of those interests? The question
is whether disclosure of the requested information to the world at large under FOIA is reasonably
necessary. Having considered this issue carefully, we find that it is not. Disclosure would provide
more information about the nature of the expenses claimed. However, it would not show whether
6
the expense was reasonable or justified - for example, a taxi receipt would not show why this was
used instead of public transport. We note that the ICO has a published policy on expenses claims
and operates its expenses system in accordance with that policy. The ICO also publishes a summary
of expenses claims as described above, showing the individual’s name, type of expense and amount.
Taken together, these are sufficient to satisfy the legitimate interests in openness and transparency,
and in particular to enable public scrutiny of the ICO’s expenses policy and whether large amounts
are being claimed for travel or subsistence. More granular detail about the mode of transport, for
example, would not provide useful further information for the purposes of public scrutiny because
the ICO’s expenses policy already makes it clear when different types of transport should be used.
28. Are such interests are overridden by the interests or fundamental rights and freedoms
of the data subject which require protection of personal data? The Commissioner had found
that disclosure was reasonably necessary for the purpose of the interests in openness and
transparency, so we have gone on to consider whether these interests are overridden by the rights
and freedoms of the data subjects on the basis that the necessity test is met.
29. Even if disclosure is reasonably necessary for the purpose of the interests in openness and
transparency, the strength of these interests is limited for the reasons explained in paragraph 27
above. The ICO has an expenses policy and claim system, and so has mechanisms for checking
and scrutinising expenses internally. Disclosure of the detail of expenses claims and receipts to the
public would not be particularly useful in checking use of this policy, as it would not show whether
the claims were within the policy or not. Receipts do not show why the expenses claim was
necessary. The information that is currently published is sufficient to show, for example, that one
individual has made a large number of high-value claims. The appellant says that there should be
scrutiny of first-class travel and use of taxis, but the ICO’s policy is clear on when these types of
travel should be used, and further information from expenses claims or receipts would not show why
such methods of transport were used in a particular case. We do not agree with the appellant’s view
that the reduced details of published expenses would thwart the purposes of transparency and
accountability.
30. Publication of this information would clearly affect the individuals’ privacy rights. The receipts
show a variety of specific personal information, including when and where the person travelled, what
food and drink they ordered and from where, what hotels they stayed in, what other services they
used, and details of equipment purchased for use at home. This includes partial credit card details
and diet choices. We find that the affected individuals would not have a reasonable expectation that
this level of personal detail would be published to the world at large under FOIA.
31. The appellant says that these details were previously published until October 2019, on full
expense claim forms. These historic details are still available. He says that this shows the ICO
thought in the past that disclosure was appropriate, and nothing has changed. Disclosure cannot
be unlawful now when it was lawful in the past.
32. We do not agree. As noted by the Commissioner, the Request is for information from October
2019 until 5 October 2020 (the date of the Request). We also note that the appellant has asked for
disclosure of receipts, which contain considerably more personal information than was in the
previously published expense claim forms. We have considered whether the previously published
information alters the individuals’ reasonable expectations about what will be disclosed. We find that
the affected individuals would not have a reasonable expectation that receipts would be published,
as this has never been done before. We also find that their expectations about disclosure of full
expense claim forms will have changed as the ICO’s policy on what is published has changed. We
7
are considering the current Request under the current publications policy. There may be a number
of reasons why the historic information remains accessible. We note that the information had been
made public so removing it now would have little effect, and any safety or security risks will be lower
for old information.
33. The appellant has referred to another decision by the Commissioner where a public authority
was required to disclose similar expense claims. The Commissioner has referred to a different
decision where it was found that expense details could be withheld under section 40(2). Each case
turns on its own facts. The existence of different Commissioner decisions on similar points shows
that the operation of section 40(2) is context-specific. The fact that expenses information was
required to be disclosed in one case does not mean it should be in this case.
34. The appellant has questioned the Commissioner’s position that disclosure of travel details
would enable personal travel information and habits to be pieced together, representing a safety and
security risk to individuals with public profiles. We agree with the appellant that this would not always
be the case, such as where individuals were travelling for public engagements. However, we accept
that some of the information may reveal travel patterns or indications as to the location of someone’s
home, which could present a safety risk to that individual.
35. The appellant has also said that the ICO should be relying on section 38 FOIA (health and
safety) in relation to alleged safety and security risks. We do not agree. Safety and security risks
can form part of the consideration under section 40(1), as they are relevant to assessing the rights
and freedoms of the data subjects that may be affected by disclosure.
36. We therefore find that the interests in disclosure are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data. Even if disclosure
of the requested information is necessary to meet interests in openness and transparency, these
interests are limited – taking into account the expenses information and policy that is already
available, and the limited use of the requested additional information. Disclosure would significantly
affect the privacy interests of the data subjects as the requested information contains personal
details which they would not reasonably expect to be made public, would be unduly intrusive, and in
some cases could create a safety or security risk to that individual. Processing of this personal data
by disclosing it under FOIA would not be lawful. The ICO was entitled to withhold the information
under section 40(2) FOIA.
37. We dismiss the appeal.
Signed Judge Hazel Oliver Date: 9 June 2022
8