Case Reference: EA/2021/0376
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard: on the papers
Heard on: 6 June 2022
Decision given on: 22 June 2022
Before
TRIBUNAL JUDGE BUCKLEY
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER NAOMI MATTHEWS
Between
GABRIEL KANTER-WEBBER
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The appeal is Dismissed.
REASONS
Introduction
1
1. The parties and the Tribunal agreed that this matter was suitable for determination
on the papers in accordance with rule 32 Chamber’s Procedure Rules.
2. This is an appeal against the Commissioner’s decision notice IC-86525-W2N9 of 16
December 2021 which held that the Chief Constable of Cambridgeshire
Constabulary (‘the Police’) was entitled to rely on s 40(2) of the Freedom of
Information Act 2000 (FOIA). The Commissioner concluded that the Police were in
breach of s 17 FOIA.
3. The Commissioner did not require the Police to take any steps.
Factual background to the appeal
4. The appeal relates to a request for an audio recording of police disciplinary
proceedings held in public in November 2020.
Requests, decision notice and appeal
The request
5. This appeal concerns the following request made on 2 December 2020:
Hi, please can you provide a PDF of the outcome of this hearing
https://cambs.police.uk/assets/PDFs/About/Misconduct/AboutUs-Misconduct-
PC2683. pdf and also of the transcript (if no transcript is available then the audio
recording.
The response
6. The Police provided a substantive response on 6 January 2021 stating that they did
not hold the requested information except the audio recording which they withheld
under s 40 (personal data).
7. The Police carried out an internal review and overturned the original decision. They
provided a link to the PDF of the outcome of the hearing. They stated that there was
no transcript. The Police stated that the audio recording was exempt under s 40.
The Decision Notice
8. In a decision notice dated 16 December 2021 the Commissioner decided that the
Police were entitled to withhold the information under s 40(2).
9. The Commissioner was satisfied that the information relates to and identifies the
individuals concerned and fell within the definition of personal data in s 3(2) of the
Data Protection Act 2018 (‘DPA’).
2
10. The Commissioner concluded that the appellant’s legitimate interest was the
transparency of police misconduct proceedings. She was satisfied that there were
no less intrusive means of achieving the legitimate aims than to disclose the
requested information.
11. The Commissioner concluded that there was insufficient legitimate interest to
outweigh the data subject’s fundamental rights and freedoms. Accordingly she
concluded that there was no basis for processing under Article 6 of the UK GDRP
and disclosure would not be lawful. The Police were entitled to withhold the
information under s 40(2) FOIA.
Notice of Appeal
12. The two grounds of appeal are:
12.1. Not all of the recording is personal data.
12.2. The Commissioner was wrong to conclude that there is a reasonable
expectation of privacy in relation to proceedings in open court.
The ICO’s response
Personal data
13. Having listened to the audio recording the Commissioner is satisfied that all of the
recording would constitute the data subject’s personal data. The recording relates
to a disciplinary hearing which names the data subjects. As such the entirety of the
information on the audio recording identifies and relates to the data subjects who
are the subject of the hearing. Accordingly, the audio recording could not be
redacted.
Expectation of privacy in open court
14. Khuja v Times Newspapers [2017] UKSC 49 concerned the press reporting of
information in real time relating to ongoing court proceedings. If the press had
wished to report on the disciplinary hearing, the data subjects would not have had,
at that time, a reasonable expectation of privacy in relation to what had been said
in open court. This is to be contrasted with a FOIA request some time after for
information which had been heard in open court. The question is then to what
extent is the information realistically accessible to the public at the time of the
response to the request.
15. The Commissioner maintains that if the information is not in the public domain at
the time of the response to the request the data subjects referred to in the audio
recording would have a reasonable expectation that the recording would not be
disclosed to the public as a whole at that time in response to a FOIA request. The
Commissioner concluded on the facts of this particular case the audio recording
was not realistically accessible to a member of the public at the time of the response
to the request and therefore not in the public domain at that time.
3
The appellant’s reply
16. The Commissioner was wrong to distinguish Khuja. It was not confined to
contemporaneous reporting. The Commissioner was wrong to apply a test of
whether the information was realistically accessible to the public at the time of the
response to the request. The misconduct proceedings in this case were widely
reported.
17. It is untenable to argue that all of the audio recording constitutes personal data.
The appellant’s final submissions
18. The integrity of the Commissioner’s investigation is called into question because he
had not listened to the audio recording.
19. The background of the Police (Conduct) Regulations 2020 militate against their
being any expectations of privacy on the part of participants. The disputed
information does not engage the factors in favour of a private hearing. Every
member of public who gave evidence at this hearing had an opportunity to request
a private hearing and an opportunity to back out.
Evidence
20. We read and took account of an open bundle. We also listened to the closed
recording of the disciplinary hearing. This was the disputed information and it has
to be closed, otherwise the purpose of the proceedings would be defeated.
Legal framework
Personal data
21. The relevant parts of s 40 of FOIA provide:
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information
if –
(a) It constitutes personal data which does not fall within subsection (1), and
(b) either the first, second or the third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act -
(a) would contravene any of the data protection principles, or..
22. Personal data is defined in s 3 of the Data Protection Act 2018 (DPA):
4
(2) ‘Personal data’ means any information relating to an identified or identifiable living
individual (subject to subsection (14)(c)).
(3) ‘Identifiable living individual’ means a living individual who can be identified, directly or
indirectly, in particular by reference to—
(a) an identifier such as a name, an identification number, location data or an online identifier,
or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic,
cultural or social identity of the individual.
23. This is in line with the definitions in the General Data Protection Regulation (EU)
2016/679. Recital 26 to the Regulation is relevant, because it refers to identifiability
and to the means that should be taken into account:
(26) The principles of data protection should apply to any information concerning an identified
or identifiable natural person. Personal data which have undergone pseudonymisation, which
could be attributed to a natural person by the use of additional information should be considered
to be information on an identifiable natural person. To determine whether a natural person is
identifiable, account should be taken of all the means reasonably likely to be used, such as
singling out, either by the controller or by another person to identify the natural person directly
or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural
person, account should be taken of all objective factors, such as the costs of and the amount of
time required for identification, taking into consideration the available technology at the time of
the processing and technological developments. The principles of data protection should
therefore not apply to anonymous information, namely information which does not relate to an
identified or identifiable natural person or to personal data rendered anonymous in such a
manner that the data subject is not or no longer identifiable. This Regulation does not therefore
concern the processing of such anonymous information, including for statistical or research
purposes.
24. The definition of "personal data" consists of two limbs:
i) Whether the data in question "relate to" a living individual and
ii) Whether the individual is identified or identifiable, directly or indirectly, from those
data.
25. The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v
Cheyne Gardens Ltd [2017] EWCA Civ 121; Durant v FSA [2003] EWCA Civ 1746
and Edem v Information Commissioner [2014] EWCA Civ 92. Although these
relate to the previous iteration of the DPA, we conclude the following principles are
still of assistance.
26. In Durant, Auld LJ, giving the leading judgment said at [28]:
Mere mention of the data subject in a document held by a data controller does not necessarily
amount to his personal data. Whether it does so in any particular instance depends on where it
falls in a continuum of relevance or proximity to the data subject as distinct, say, from
transactions or matters in which he may have been involved to a greater or lesser degree. It
seems to me that there are two notions that may be of assistance. The first is whether the
5
information is biographical in a significant sense, that is, going beyond the recording of the
putative data subject's involvement in a matter or an event that has no personal connotations, a
life event in respect of which his privacy could not be said to be compromised. The second is
one of focus. The information should have the putative data subject as its focus rather than some
other person with whom he may have been involved or some transaction or event in which he
may have figured or have had an interest, for example, as in this case, an investigation into some
other person's or body's conduct that he may have instigated.
27. In Edem Moses LJ held that it was not necessary to apply the notions of biographical
significance where the information was plainly concerned with or obviously about
the individual, approving the following statement in the Information
Commissioner's Guidance:
It is important to remember that it is not always necessary to consider 'biographical significance'
to determine whether data is personal data. In many cases data may be personal data simply
because its content is such that it is 'obviously about' an individual. Alternatively, data may be
personal data because it is clearly 'linked to' an individual because it is about his activities and
is processed for the purpose of determining or influencing the way in which that person is
treated. You need to consider 'biographical significance' only where information is not
'obviously about' an individual or clearly 'linked to' him.
28. The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals
Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging
the Durant test, that a Court should also consider:
(2) Does the data "relate" to an individual in the sense that it is "about" that individual
because of its:
(i) "Content" in referring to the identity, characteristics or behaviour of the individual?
(ii) "Purpose" in being used to determine or influence the way in which the individual
is treated or evaluated?
(iii) "Result" in being likely to have an impact on the individual's rights and interests,
taking into account all the circumstances surrounding the precise case (the WPO test)?
(3) Are any of the 8 questions provided by the TGN are applicable?
These questions are as follows:
(i) Can a living individual be identified from the data or from the data and other
information in the possession of, or likely to come into the possession of, the data
controller?
(ii) Does the data 'relate to' the identifiable living individual, whether in personal or
family life, or business or profession?
(iii) Is the data 'obviously about' a particular individual?
(iv) Is the data 'linked to' an individual so that it provides particular information about
that individual?
(v) Is the data used, or is it to be used, to inform or influence actions or decisions
affecting an identifiable individual?
(vi) Does the data have any biographical significance in relation to the individual?
(vii) Does the data focus or concentrate on the individual as its central theme rather
than on some other person, or some object, transaction or event?
(viii) Does the date impact or have potential impact on an individual, whether in a
personal or family or business or professional capacity (the TGN test)?
6
(4) Does the data "relate" to the individual including whether it includes an expression
of opinion about the individual and/or an indication of the intention of the data
controller or any other person in respect of that individual. (the DPA section 1(1) test)?
29. The data protection principles are set out Article 5(1) of the GDPR and s 34(1) DPA.
Article 5(1)(a) GDPR provides: that personal data shall be processed lawfully, fairly
and in a transparent manner in relation to the data subject. Article 6(1) GDPR
provides that processing shall be lawful only if and to the extent that at least one of
the lawful bases for processing listed in the Article applies.
30. The only potentially relevant basis here is article 6(1)(f):
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by
a third party, except where such interests are overridden by the interests or fundamental rights
and freedoms of the data subject which requires protection of personal data, in particular where
the data subject is a child.
31. The case law on article 6(1)(f)’s predecessor established that it required three
questions to be answered, which we consider are still appropriate if reworded as
follows
1. Is the data controller or a third party pursuing a legitimate interest or interests?
2. Is the processing involved necessary for the purposes of those interests?
3. Are the above interests overridden by the interests or fundamental rights and
freedoms of the data subject?
32. Lady Hale said the following in South Lanarkshire Council v Scottish Information
Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded
predecessor:
27. ... It is well established in community law that, at least in the context of
justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than
absolutely or strictly necessary .... The proposition advanced by Advocate General
Poiares Maduro in Huber is uncontroversial: necessity is well established in
community law as part of the proportionality test. A measure which interferes with
a right protected by community law must be the least restrictive for the
achievement of a legitimate aim. Indeed, in ordinary language we would
understand that a measure would not be necessary if the legitimate aim could be
achieved by something less. ...
33. S 40(3A) is an absolute exemption and therefore the separate public interest
balancing test under FOIA does not apply.
The role of the tribunal
34. The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider
whether the decision made by the Commissioner is in accordance with the law or,
where the Commissioner’s decision involved exercising discretion, whether she
7
should have exercised it differently. The Tribunal may receive evidence that was
not before the Commissioner, and may make different findings of fact from the
Commissioner.
Issues
35. The issues for the tribunal to determine are:
35.1. Does the information relate to an identified or identifiable living individual?
35.2. Is the data controller or a third party pursuing a legitimate interest or interests?
35.3. Is the processing involved necessary for the purposes of those interests?
35.4. Are the above interests overridden by the interests or fundamental rights and
freedoms of the data subject?
Discussion and conclusions
Integrity of the Commissioner’s investigation
36. As this is a full merits review, the tribunal looks at the matter afresh. Accordingly
we do not need to consider the issue raised by the appellant about whether the
Commissioner reached a decision without listening to the audio recording. We
have listened to it.
Personal data
37. The question for us to determine is whether the audio recording of the disciplinary
hearing is the personal data of an identifiable living individual.
38. We have determined that the individual is identifiable, even if it were possible to
‘redact’ his name. The proceedings were widely reported in the press at the time
and, in particular because of the facts of the case, it would be possible for a
motivated individual to identify the individual even if his name were redacted.
39. The disciplinary proceedings are ‘obviously about’ the individual. That individual
is the focus of the disciplinary proceedings. The information is biographical in a
significant sense. It is about his activities. The entire proceedings took place in order
to determine the way which that individual should be treated. The result of those
proceedings would affect the individual’s rights and interests. The proceedings
have an impact on him in both a personal and professional capacity.
40. In our view the audio recording of these disciplinary proceedings as a whole clearly
falls within the definition of personal data of the individual who is the subject of
those disciplinary proceedings.
41. The appellant, in effect, urges us to consider the content of the recordings ‘line by
line’ and consider whether all of it constitutes personal data, on the basis that it is
8
clear from the press reporting of the proceedings that some of the matters discussed,
taken in isolation, are not the personal data of the individual concerned.
42. We do not accept that this is the appropriate approach. Our conclusions, set out
above, relate to the entire disciplinary proceedings. It may be the case that we could
identify a paragraph or a sentence that did not, considered in isolation, look like
that individual’s personal data. It is not right to consider the information in isolation.
Looked at in context and in the light of the rest of the disciplinary hearing, we find
that information in the course of the proceedings which does not, at first glance,
look like personal information, is the individual’s personal data for the reasons set
out in para 38 above.
Legitimate interest
43. We accept that the appellant is pursuing a legitimate interest, namely transparency
in police disciplinary proceedings and the principle of open justice.
Reasonable necessity
44. We have considered whether the disclosure of the requested information is
reasonably necessary for the purposes of the identified legitimate interests.
Disclosure must be more than desirable, but less than indispensable or an absolute
necessity. Disclosure must be the least restrictive means of achieving the legitimate
aim in question, because it would not be necessary if it could be achieved by
anything less. We must consider whether the legitimate aim could be achieved by
means that interfere less with the privacy of the data subjects.
45. We recognise that the Commissioner accepted that disclosure was necessary for the
purposes of the legitimate interests. The tribunal caries out a full merits review, and
we find that disclosure of the audio recording under FOIA was not reasonably
necessary for the purposes of open justice and transparency in police disciplinary
proceedings.
46. The proceedings were held in public. Any member of the public or journalist could
have attended the hearing at the time and heard every word which is on the audio
recording. If it was not convenient to attend the hearing, a member of the public
could have read one of the numerous press reports of the hearing. The outcome of
the hearing was published on the Police website. We find that the legitimate aim of
transparency and open justice is achieved by these means. It is not necessary, for
those purposes, to also disclose the entire audio recording to the world via FOIA.
47. On this basis, we agree with the Commissioners conclusion that the Police were
entitled to rely on s 40(2) to withhold the audio recording.
48. Much of the appellant’s arguments related to the question of whether or not the
individual concerned had a legitimate expectation of privacy. The question of
whether or not the individual had a legitimate expectation of privacy is not relevant
9
at the stage of considering whether or not disclosure is reasonably necessary for the
purposes of the legitimate interests. We do not therefore need to decide that
question.
49. Upper Tribunal Judge Jacobs explained this point in Kol v Innformation
Commissioner and Reigate and Banstead Borough Council [2022]UKUT 74 (AAC),
where the first tier tribunal and the Commissioner had, like this tribunal has,
decided that disclosure was not necessary for the purpose of the legitimate interests:
The starting point for data protection law is this: a person’s data is protected from
disclosure except in accordance with the legislation. There is no precondition that it is
protected if, and only if, disclosure would have some particular effect on the data
subject…. To reduce it to its simplest: personal data is protected just because it is
personal data. That is what the first preamble to GDPR says. Just to be clear, I am not
saying that the effect of disclosure on the data subject is irrelevant. It is relevant, but
only if it is necessary to resolve a conflict between the interests of the person who
requested the information and the person to whom it relates. In this case, the
Commissioner and the tribunal did not reach that stage.
50. We also have not reached the stage where it is necessary to resolve a conflict
between the interests of the person who requested the information and the person
to whom it relates. Accordingly, we do not need to consider whether or not the data
subjects had a reasonable expectation of privacy.
51. Having concluded that it is not reasonably necessary to disclose the requested
information it is not necessary for us to consider whether the legitimate interests
are overridden by the interests of the data subjects. We find that the Police were
entitled to rely on the exemption in s 40(2) FOIA.
Signed Sophie Buckley Date: 21 June 2022
Judge of the First-tier Tribunal
10