Appeal Number: EA/2021/0025
First-Tier Tribunal
(General Regulatory Chamber)
Information Rights
Heard on the papers
On: 23rd June 2022.
Panel: Brian Kennedy QC, Susan Wolf and Jo Murphy.
Between:
Raymond Lawton
Appellant:
and
The Information Commissioner
First Respondent:
and
The University of Central Lancashire
Second Respondent:
Representation:
For the Appellant: Raymond Lawton, as a litigant in person.
For the 1st Respondent: Sapna Gangani, Solicitor through the Commissioner’s
written Response dated 08/03/2022.
For the 2nd Respondent: Written response from Information Governance Manager
& Data Protection Officer, Legal and Governance, University of Central Lancashire,
Preston, PR1 2HE
Decision: The Tribunal dimiss the appeal.
1
REASONS
Introduction:
[1] This decision relates to an appeal brought under section 57 of the Freedom of
Information Act 2000 (“the FOIA”). The appeal is against the decision of the
Information Commissioner (“the Commissioner”) contained in a Decision Notice
(“DN”) dated 17 November 2021 (reference IC-76644-F7P8), which is a matter of
public record.
Factual Background to this Appeal:
[2] Full details of the background to this appeal, the complainant’s request for
information and the Commissioner’s decision are set out in the DN. The appeal
concerns the decision of the Council of the University of Central Lancashire (“The
University”) to apply section 40(2) FOIA to some of the requested information, on
the basis that it contained personal data of third parties.
[3] The Commissioner maintains the position set out in her DN; namely that the
Council correctly applied section 40(2) FOIA to some of the requested information,
on the basis that it contained personal data of third parties. However, as the
Appellant’s request was for the whole brochure, section 40(2) FOIA is not
applicable to all parts and therefore the University should disclose the remainder
of the information. The Appellant now appeals against the DN. The Commissioner
opposes the appeal and invites the Tribunal to dismiss the appeal. The Parties
consent to this matter being dealt with on the papers.
History and Chronology:
[4] On 1 June 2020, the Appellant requested the following:
“I request copies of graduation brochures, in particular list of graduates for
engineering disciplines for 1997 and 1998.”
2
[5] The University responded on 26 June 2020. It stated that it held information in
relation to the request. However, it cited section 40(2) of the FOIA – personal
information.
[6] Following an internal review, the University wrote to the complainant on 4
November 2020. It stated that it upheld its original position.
[7] The complainant contacted the Commissioner on 10 December 2020 to complain
about the way their request for information had been handled.
[8] The Commissioner considers the scope of her investigation is to establish whether
the public authority is entitled to withhold the names of those who graduated, along
with any other named individuals under section 40(2) of the FOIA.
[9] Legal Framework:
S1 FOIA – General right of access to information held by public authorities
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the
description specified in the request, and
(b) if that is the case, to have that information communicated to him.
(2) Subsection (1) has effect subject to the following provisions of this section and to
the provisions of sections 2, 9, 12 and 14.
(3) Where a public authority—
(a) reasonably requires further information in order to identify and locate the
information requested, and
(b) has informed the applicant of that requirement,
the authority is not obliged to comply with subsection (1) unless it is supplied with that
further information.
(4) The information—
(a) in respect of which the applicant is to be informed under subsection (1)(a), or
3
(b) which is to be communicated under subsection (1)(b),
is the information in question held at the time when the request is received, except
that account may be taken of any amendment or deletion made between that time and
the time when the information is to be communicated under subsection (1)(b), being
an amendment or deletion that would have been made regardless of the receipt of the
request.
(5) A public authority is to be taken to have complied with subsection (1)(a) in relation
to any information if it has communicated the information to the applicant in
accordance with subsection (1)(b).
(6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred
to as “the duty to confirm or deny”.
Section 40 FOIA provides that:
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
(2) Any information to which a request for information relates is also exempt
information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of
the public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection
Act 2018 (manual unstructured data held by public authorities) were
disregarded.
4
(3B) The second condition is that the disclosure of the information to a member
of the public otherwise than under this Act would contravene Article 21 of the
GDPR (general processing: right to object to processing).
(4A) The third condition is that—
(a) on a request under Article 15(1) of the GDPR (general processing:
right of access by the data subject) for access to personal data, the information
would be withheld in reliance on provision made by or under section 15, 16 or
26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b) on a request under section 45(1)(b) of that Act (law enforcement
processing: right of access by the data subject), the information would be
withheld in reliance on subsection (4) of that section.
(5A) The duty to confirm or deny does not arise in relation to information which
is (or if it were held by the public authority would be) exempt information by
virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information
if or to the extent that any of the following applies—
(a) giving a member of the public the confirmation or denial that would have to
be given to comply with section 1(1)(a)—
(i) would (apart from this Act) contravene any of the data
protection principles, or
(ii) would do so if the exemptions in section 24(1) of the Data
Protection Act 2018 (manual unstructured data held by public
authorities) were disregarded;
(b) giving a member of the public the confirmation or denial that would
5
have to be given to comply with section 1(1)(a) would (apart from this Act)
contravene Article 21 of the GDPR (general processing: right to object to
processing);
(c) on a request under Article 15(1) of the GDPR (general processing: right of
access by the data subject) for confirmation of whether personal data is being
processed, the information would be withheld in reliance on a provision listed
in subsection (4A)(a);
(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law
enforcement processing: right of access by the data subject), the information
would be withheld in reliance on subsection (4) of that section.
(6) Omitted
(7) In this section—
“the data protection principles” means the principles set out in—
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see
section 3 of that Act);
“the GDPR”, “personal data”, “processing” and references to a provision of
Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning
as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that
Act).
(8) In determining for the purposes of this section whether the lawfulness
principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure
of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the
second sub-paragraph (disapplying the legitimate interests gateway in relation
to public authorities) were omitted.
(as amended by Schedule 19 of the Data Protection Act 2018)
6
Section 40(1) FOIA is an absolute exemption by virtue of s.2(3)(f) FOIA, and is
therefore not subject to the public interest test under s.2(2)(b) FOIA.
Personal data is defined as “any information relating to an identified or
identifiable living individual.” (s.3(2) Data Protection Act 2018 (“DPA”)), and the
‘processing’ of such information includes “disclosure by transmission,
dissemination or otherwise making available” (s.3(4)(d) DPA), and therefore
includes disclosure under FOIA.
The data protection principles referred to in s.40(3A)(1) FOIA are set out in
Article 5(1) of the General Data Protection Regulations EU2016/679 (‘GDPR’),
and s.34(1) DPA18 (the latter with regards to law enforcement processing)
(s.40(7) FOIA). The first data protection principle under Article 5(1)(a) GDPR is
that personal data shall be:
“processed lawfully, fairly and in a transparent manner in relation to the
data subject”.
The information can therefore only be disclosed if to do so would be lawful (i.e.
would meet one of the conditions of lawful processing listed in Article 6(1)
GDPR), fair, and transparent.
In considering the application of Article 6(1)(f) of the GDPR in the context of a
request for information under the FOIA, it is necessary to consider the following
three-part test:-
i) Legitimate interest test: Whether a legitimate interest is being pursued
in the request for information;
ii) Necessity test: Whether disclosure of the information is necessary to
meet the legitimate interest in question;
iii) Balancing test: Whether the above interests override the legitimate
interest(s) or fundamental rights and freedoms of the data subject.
7
Commissioner’s Decision Notice:
[10] The Commissioner investigated the matter and held that part of the brochures were
exempt from disclosure under section 40(2) FOIA.
[11] In the circumstances of this case, having considered the withheld information, the
Commissioner was satisfied that the information relates to the data subjects. The
names of individuals, alongside their graduate qualification, quite obviously is
information that both relates to and identifies those concerned. This information
therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA.
[12] The fact that information constitutes the personal data of an identifiable living
individual does not automatically exclude it from disclosure under the FOIA. The
second element of the test is to determine whether disclosure would contravene
any of the DP principles.
[13] The Commissioner referred to Article 5(1)(a) of the GDPR and Article 6(1) in
respect of the lawfulness. Further, the Commissioner considered the three-part test
to be applied under Article 6(1)(f), which is as follows:
i) Legitimate interest test: Whether a legitimate interest is being pursued
in the request for information;
ii) Necessity test: Whether disclosure of the information is necessary to
meet the legitimate interest in question;
iii) Balancing test: Whether the above interests override the legitimate
interest(s) or fundamental rights and freedoms of the data subject.
[14] The Commissioner give due consideration to each element of the test and decided
that disclosure would cause unwarranted damage or distress to those named in
the brochures, nor would these individuals have a reasonable expectation that their
personal data would be disclosed in response to an information request. Further,
that it would be disproportionate to obtain consent from each graduate.
8
Grounds of Appeal:
[15] The Appellant’s Grounds of Appeal does not question that section 40(2) applies to
the withheld information and that the information does constitute personal data.
The Appellant focuses on the balance of legitimate interests. The Grounds of
Appeal can be summarised as follows:
“(a) with regard to the decision, I object on the following grounds: Point 46) The
information was also posted on the University website at the time. Point 47) The
graduates concerned would have had a reasonable expectation of such disclosure,
since website publishing was widely used by them. Disclosure to the “world at
large” has already happened long ago. There can be no objection based on this
point”.
The Commissioner’s Response:
[16] The Commissioner maintained her position as outlined in the DN and resisted the
appeal. The Commissioner accepted that, if the names of the data subjects/the
graduation brochures were published on the internet back in 1997-1998 then this
may have some bearing on the balancing exercise.
[17] The Commissioner received confirmation from the University that they did not
publish the names of the data subjects online at the time. The Commissioner
denied that disclosure to the world at large had already happened. The
Commissioner maintained the balancing exercise was correct and that the
legitimate interest of the Appellant in seeking the withheld information did not
outweigh the reasonable expectation of the graduates that their names and grades
would not be disclosed to the world at large. Further, the Appellant has failed to
produce any compelling reason to overturn the balancing test in favour of
disclosure. The Commissioner invited the Tribunal to dismiss the appeal.
Second Respondent’s Submissions:
[18] The Second Respondent provided a response to the Appellant’s specific grounds
of appeal. In response to the contention that the information was also posted on
the University website at the time, the Second Respondent confirmed that there
9
were two graduation ceremonies which occurred in 1997 and 1998, and stated that
this information was not published on the University website.
[19] In relation to the argument that disclosure to the world at large had already
happened long ago, the Second Respondent argued that graduates would not
have had a reasonable expectation of such disclosure of this nature since
disclosures of this nature did not take place at the time. The Second Respondent
opposed the Appellant’s Grounds of Appeal on the basis that they are not factually
accurate, as the information was not published on the University’s website in 1997
and 1998 and further because the individuals in question would not have had a
reasonable expectation that this information would be disclosed either in 1997 or
1998, or the present day. The Second Respondent confirmed that redacted copies
of brochures were provided to the Appellant. The Second Respondent invited the
Tribunal to dismiss the appeal.
The Hearing on the papers:
[20] The Tribunal is satisfied that the names of graduands and their degrees and
classifications is personal data as defined Section 3(2) of the DPA. This defines
personal data as: “any information relating to an identified or identifiable living
individual”.
[21] Personal data must be processed in accordance with the data protection principles
set out in Article 5 of the GDPR. The Tribunal agrees with the Commissioner that
the most relevant principle in this case is Article 5(1)(a) personal data shall be
processed lawfully, fairly and in a transparent manner.
[22] The Tribunal considered the lawful basis for processing under the GDPR and
agreed with the Commissioner that Article 6(1)(f) (legitimate interests) was the
most applicable. The Tribunal considers that to obtain consent from the data
subjects would involve disproportionate effort by the data controller due to the
numbers involved and the passage of time and is unlikely to lead to a meaningful
disclosure.
10
[23] In considering the application of Article 6(1)(f) the Tribunal considered the three-
stage test:
a) The legitimate interest test: Whether a legitimate interest is being pursued in the
request for information;
b) The Necessity test: Whether disclosure of the information is necessary to meet
the legitimate interest in question; and
c) The Balancing test: Whether the above interests override the legitimate
interest(s) or fundamental rights and freedoms of the data subject.
[24] The Tribunal accepts and adopts the Commissioners’ considered assertion that
the legitimate interest is only that of the complainant’s own interest and as such
there is limited legitimate interest. The Appellant may have a sentimental interest
but the appellant has failed to offer any wider legitimate interest in the information
other than sentimental purposes.
[25] In relation to the necessity test, the Tribunal is required to consider whether
disclosure is necessary to meet the legitimate interest in question. Necessary
means more than desirable but less than indispensable or absolute necessity.
Accordingly, the test is one of reasonable necessity and involves consideration of
alternative measures which may make disclosure of the requested information
unnecessary. Disclosure under the FOIA must therefore be the least intrusive
means of achieving the legitimate aim in question. The Tribunal accepts and
adopts the Commissioners view, and is satisfied in this case that there are no less
intrusive means of achieving the legitimate aims identified.
[26] On the balancing test the Tribunal has to consider whether the requestor’s
legitimate interests override the fundamental rights and freedoms of the data
subjects, in this case the graduands referred to in the Graduation Ceremony
Brochures. The Tribunal accepts and adopts the Commissioners assessment that
a key issue is whether the individuals (the graduands) concerned would have a
reasonable expectation that their information will not be disclosed. The Tribunal
agree that these expectations can be shaped by factors such as an individual’s
general expectation of privacy, whether the information relates to an employee in
their professional role or to them as individuals, and the purpose for which they
11
provided their personal data. There is no evidence before us that the graduands
understood, or would have expected, that their information would be exposed to
the world at large.
[27] The Appellant argues that the data subjects would have had a reasonable
expectation that information would be disclosed because he argues that the
information was made public in the brochure and he asserts that it would have
been published, at the time, on the University Web Site.
[28] The University states that the brochures were only made available to those
attending graduation ceremonies. The University states that this information would
not have been published on its web site in 1997/98. The University has provided
an archived version of its web site from 1998 which can be publicly viewed at this
link:
https://web.archive.org/web/19980124144412/http://www.uclan.ac.uk/althom3.htm
[29] This does not include or contain any information about the graduands or graduation
brochures. The Tribunal therefore accepts the University’s assertion that in 1998
this information was not made publicly available other than to those attending the
ceremonies. Therefore, the Tribunal concludes that graduands of 1997 and 1998
would not have any expectation that information about their graduation and degree
award would be made public now, some 25 years later, to the world at large.
Conclusion:
[30] The Tribunal concludes that the requestor's legitimate interests, which are entirely
personal, are insufficient to outweigh the fundamental rights and freedoms of the
data subjects.
[31] For the above reasons we find the Appellant has failed to identify any error of Law
in the DN and accordingly we must dismiss this appeal.
Brian Kennedy QC. 23 June 2022.
Promulagtion date 30th June 2022
12