First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2021/0273
NCN: [2022] UKFTT 00261 (GRC)
Decided without a hearing
On 1 April & 1 August 2022
Before
JUDGE HAZEL OLIVER
AIMÉE GASSTON
SUSAN WOLF
Between
MARTHA WARDROP
Appellant
and
INFORMATION COMMISSIONER
First Respondent
THE METROPOLITAN POLICE SERVICE
Second Respondent
DECISION
The appeal is dismissed.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 23 August 2021 (IC-111481-Y9T6, the “Decision Notice). The appeal relates to the
application of the Freedom of Information Act 2000 (“FOIA”). It concerns information about
the disciplinary record of a named former police officer requested from the Metropolitan Police
Service (“MPS”).
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it
can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. On 14 August 2020, the appellant wrote to MPS and requested the following information
(the “Request”):
“As a local elected councillor for the Hillhead ward, Glasgow City, I am seeking information
on a former police officer of the Met in the interests of protecting the public. His name is
[name redacted], [job title redacted] at the University of Glasgow. [Name redacted] was a
Detective Constable at [name redacted] Police Office. Information is requested referring to
[name redacted] as the subject of a disciplinary process in 2003 which led to his dismissal
or resignation.”
4. MPS responded on 18 August 2020 and refused to confirm or deny whether it held the
requested information, based on section 40(5) FOIA (personal data).
5. The appellant requested an internal review on 22 December 2020. MPS responded on 26
April 2021 and maintained its position.
6. The appellant complained to the Commissioner on 12 March 2021. The basis of her
complaint was the interests of protecting the public, and reassurance that the officer is suitable
to implement measures to address gender-based violence. The Commissioner decided:
a. Confirmation or denial would constitute disclosure of a third party’s personal data –
the former police officer is specifically named, a reply would reveal whether he was
the subject of any disciplinary procedures or hearings, and this information is not in
the public domain.
b. There is some legitimate interest in confirmation or denial – it would go some way
towards informing the public about the MPS’s accountability in its disciplinary
procedures, public safety issues, and student and staff welfare at the University.
c. Confirmation or denial is reasonably necessary as there are no less intrusive means
of achieving the legitimate aims.
d. The matter was finely balanced, but there is insufficient legitimate interest to
outweigh the named individual’s fundamental rights and freedoms. The named
individual would have no reasonable expectation that MPS would confirm or deny
whether the requested information was held. Revealing under FOIA whether the
MPS carried out disciplinary proceedings in this particular case is not necessary in
order to maintain public confidence, and confirming or denying whether or not
information is held may potentially cause damage and distress to the named former
police officer.
The Appeal and Responses
7. The appellant appealed on 20 September 2021. Her grounds of appeal are:
a. The rights of young women and girls at the University of Glasgow should be
prioritised over the individual rights of a former police officer employed at the
University.
b. As a public servant, a police officer can expect to be held accountable for their
actions whilst on duty, and conduct enquiry records should be publicly available to
protect members of the public and support the highest standards of policing.
c. The only option is for information to be released in the public interest.
8. The Commissioner’s response maintains that the Decision Notice was correct. The
Tribunal notes that the response says that confirmation or denial was not necessary for several
the legitimate interests relied on by the appellant. This appears to be different from the
Commissioner’s decision, which states in paragraph 41 that “there are no less intrusive means
of achieving the legitimate aims identified”. The response states:
a. Confirmation or denial is not necessary to meet the legitimate interest in ensuring
safety, as there are less intrusive means of doing so. The named individual’s place
of work would be responsible for safety checking and it is likely that security and
employment checks would have been carried out.
b. Confirmation or denial is necessary to meet the legitimate interest in whether the
MPS took disciplinary action in a case, although this is reduced as the information is
17 years old.
c. Confirmation or denial is not necessary to safeguard the welfare of girls and young
women. Processing would not be confined to the appellant or a limited audience.
Concerns could be raised directly with the University’s Principal, and the appellant
could ask for reassurance as to the appropriateness of the appointment.
d. Confirmation or denial is not necessary to hold police officers accountable for their
actions and support the highest standards of policing, as they could be addressed
by the disclosure of alternative information relating to police officers in general rather
than one specific incident in relation to one named former police officer.
e. In any event, the balance between the legitimate interests and the rights and
freedoms of the data subject remains in favour of upholding section 40(5).
9. The Tribunal met on 1 April 2021 and decided it was not possible to make a fair decision
without further information from the MPS. Then MPS was joined to the proceedings as the
second respondent, and the Tribunal made directions which asked for various issues about
disciplinary/misconduct outcomes to be covered in its response.
10. MPS’s response maintains its position:
a. They agree that the potentially lawful basis for processing is the legitimate interests
test.
b. The interests identified by the appellant are the rights of women and girls, and
transparency and accountability. Disclosure is not necessary for those purposes.
c. The rights of women and girls can be assisted more effectively by other avenues
such as providing information to the police service or through the individual’s
employer. The passage of time reduces weight of this interest, as does the “right to
be forgotten”.
d. Transparency and accountability is served by some disciplinary outcomes being
published on the MPS website, and the MPS does not accept that making other
police conduct records available would be an appropriate way of implementing
transparency and accountability. The appellant can also discuss any concerns with
the individual’s employer.
e. Any legitimate interests are outweighed in this case. Confirmation or denial would
be likely to result in damage or distress to the named former officer. This is enhanced
by the age of the information and the reasonable expectations of the officer at the
time that such information would remain private, which is lowered further by the
officer’s junior rank. The appellant herself has raised concerns about the risk of harm.
11. Neither the appellant nor the Commissioner provided a reply to the response from the MPS.
Applicable law
12. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
…….
40 Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
…....
(5A) The duty to confirm or deny does not arise in relation to information which is
(or if it were held by the public authority would be) exempt information by virtue
of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or
to the extent that any of the following applies –
(a) Giving a member of the public the confirmation or denial that would have
to be given to comply with section 1(1)(a) –
(i) would (apart from this Act) contravene any of the data protection
principles…
…….
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
13. A “neither confirm nor deny” response can be used to protect personal data, whether or
not a public authority actually holds the requested information. There are situations where
merely confirming or denying whether information is held will reveal personal data about a third
party and breach the data protection principles.
14. The Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA – including disclosing whether or not
information is held.
15. The data protection principles are those set out in Article 5(1) of the General Data
Protection Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle
under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall
be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”. To
be lawful, the processing must meet one of the conditions for lawful processing listed in Article
6(1) GDPR. These include where “processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject which
require protection of personal data, in particular where the data subject is a child.” (Article
6(1)(f)). The GDPR goes on to state that this condition shall not apply to processing carried out
by public authorities in the performance of their tasks, but section 40(8) FOIA omits this
provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of
personal data under FOIA.
16. The Article 6(1)(f) balancing test involves consideration of three questions (as set out by
Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013]
UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
17. As noted by the Commissioner, the GDPR has been replaced by the UK GDPR after the
end of the Brexit transition period. We have considered this case in accordance with the GDPR,
as the Request was received before the end of the transition period. We note that application
of the UK GDPR would involve the same legal analysis.
Application for redaction of names
18. The appellant emailed the Tribunal on 2 and 6 December 2021 asking for names in the
bundle and submissions to be redacted. She provided further information in an email of 15
December 2021, requesting that any names and job titles in the bundle are not made public to
prevent existing and former police officers from being identified. The appellant said that due to
the level of media interest in policing matters, she was concerned that the information could
result in serious harm to identified individuals and they would seek compensation for damage
to their careers of character.
19. Judge McKenna considered this application on 30 December 2021. She made no order,
and directed that the matter should be decided by the Tribunal panel hearing the appeal. She
made some observations, including that the Decision Notice is drafted in terms that do not
reveal the name of the individual about whom the information request is made, and it would be
open to the Tribunal panel to do the same thing. She also noted that the bundle is not published,
and the parties would be consulted before the bundle was released to the public after the
hearing.
20. The appellant replied on 6 January 2022. She said there is a risk that if it is determined
that information from disciplinary proceedings prior to 2015 can be made publicly available,
then this may impact on job prospects, reputation and financial position of some police officers
or former police officers.
21. The Commissioner provided submissions on this point on 28 January 2022. This provides
details of names and job titles in the bundle, and confirms that three existing and former officers
could be identified. The Commissioner submits that the concerns raised by the appellant are
a factor to take into account in determining whether section 40(5) was correctly engaged, but
points out that any decision is only binding on the parties to this appeal and would not mean
the requested information (if it exists) would need to be disclosed or that other police forces
would be required to confirm or deny the existence of similar information.
22. We have considered the application and submissions. We have decided that the appeal
may be decided fairly and justly without publicly revealing the name or job title of the individual
about whom the information request is made, taking into account the fact the appeal is based
on data protection issues. It is also not relevant or necessary to name any other existing or
former police officers in the appeal decision. It is not necessary to redact the bundle at this
stage in the proceedings. If there is a request from a member of the public to view the bundle
after the appeal has been decided, the parties will be given the opportunity to make further
representations about redactions before it is released. Any decision about confirmation or
denial in this case will only relate to this specific Request, and would not mean that similar
information would necessarily need to be confirmed or denied in other cases.
Issues and evidence
23. The overall issue is whether MPS was entitled to rely on section 40(5B)(a)(i) to refuse to
confirm or deny whether it held the requested information, on the grounds it would contravene
the data protection principles. The breaks down into the following issues:
a. Would confirmation or denial constitute disclosure of third-party personal data?
b. If so, would confirmation or denial contravene one of the data protection principles?
In particular, would the processing be lawful under Article 6(1)(f) GDPR?
i. Is there a legitimate interest in disclosure of the personal data?
ii. Is confirmation or denial necessary for the purposes of those interests?
iii. Are such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data?
24. By way of evidence and submissions we had an agreed bundle of open documents, which
we have read and taken into account in making our decision.
25. On behalf of the MPS we had a written witness statement from Mr Damion Baird (Acting
Senior Information Manager within the MPS Data Office), which explains how the MPS
responds to FOIA requests about police employee conduct and discipline. We also had a
written witness statement from Mr Scott Didham (Police Inspector with the responsibility for the
MPS Directorate of Professional Standards Misconduct Hearings Unit), which explains the
history of the publication of information about police misconduct matters.
Discussion and Conclusions
26. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review
any finding of fact on which the notice in question was based. This means that we can review
all of the evidence provided to us and make our own decision.
27. It is a well-established principle that a public authority can issue a “neither confirm nor deny”
response to a request for information, irrespective of whether or not the information is held. It
is important for public authorities to be able to give a consistent response. If a public authority
always revealed when information was not held, a neither confirm nor deny response would
effectively give away the fact that information was held. We do not know in this case whether
the requested information is held or not, and it is not necessary for us to know this in order to
make our decision.
28. We deal in turn with the issues.
29. Would confirmation or denial constitute disclosure of third-party personal data? We
find that it would, and this is not disputed by the respondents. The Request relates to a named
individual, and confirmation or denial would provide information about whether he had been
subject to a disciplinary process which led to dismissal or resignation.
30. If so, would confirmation or denial contravene one of the data protection principles?
In particular, would the processing be lawful under Article 6(1)(f) GDPR? The legitimate
interests test under Article 6(1)(f) appears to be the only relevant lawful processing condition
in this case.
31. Is there a legitimate interest in disclosure of the personal data? A number of
legitimate interests are relevant in this case.
a. The safety of girls and young women at the University – the issue here is ensuring that
the individual is suitable for the role in which he is employed, particularly in the context
of the Sarah Everard case.
b. Accountability of police officers for actions when on duty – the appellant says that
police conduct records should be available to protect vulnerable members of the public.
c. The general interests in transparency of MPS records of disciplinary proceedings.
32. Is confirmation or denial necessary for the purposes of those interests? The test is
whether this is reasonably necessary, and we have considered whether there are less intrusive
ways of furthering these interests.
33. In relation to the safety of girls and young women at the University, the Commissioner says
that there are less intrusive means of achieving this. The named individual’s place of work
would be responsible for safety checking and it is likely that security and employment checks
would have been carried out. The MPS also takes this position. They say that they have invited
the appellant to contact the police about safety concerns. They also say that the issue of the
suitability of the individual for the role could be more effectively pursued via their named
employer, who would be responsible for recruitment and performance. Mr Baird’s statement
refers to voluntary disclosures during the application process, employment-related and
character references, and vetting processes such as a Disclosure and Barring Service (“DBS”)
check.
34. We agree that the individual’s employer is responsible for recruitment and checking
suitability for employment in a particular role. This includes obtaining references, asking the
individual for information, and potentially conducting DBS checks (depending on the role). This
would go some way towards addressing the appellant’s concerns and would be less intrusive.
However, it would only partially meet this legitimate interest. There might be failures with the
employer’s recruitment checks. More importantly, these checks will only reveal partial
information. A DBS will only reveal records of offences (plus some additional information with
enhanced checks), previous employers are under no obligation to provide a reference, and an
individual may not provide complete information. We accept that information about whether an
individual resigned or was dismissed as a result of disciplinary proceedings may be relevant to
their suitability for a role at the University. This would not necessarily be revealed by employer
checks, particularly if the individual resigned during the process. We therefore find that
confirmation or denial is necessary for this purpose.
35. In relation to transparency and the accountability of police officers for actions when on duty,
the current publication scheme operated by the MPS goes some but not all of the way to
meeting this legitimate interest. Not all information about disciplinary matters is published, and
this Request relates to a time before publication happened at all. Mr Didham makes the point
that the current system of publishing misconduct outcome rationales increases accountability
and transparency. However, the current publication system does not further accountability of
police officers from the time before this was implemented. Similarly, general transparency
interests relating to disciplinary records from that time are not furthered by the current approach.
We note the Commissioner’s point that the Request only relates to one named individual.
Nevertheless, we therefore find that confirmation or denial is reasonably necessary for this
purpose.
36. Are such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data? As requested,
MPS has provided information about the information that is published about police misconduct
matters. This is relevant to the balancing exercise and is explained in Mr Didham’s statement.
a. Prior to 2015, all police misconduct matters were private. There was no public access
to misconduct hearings, and they were chaired by a Senior Officer.
b. The position on publication of information changed on 1 May 2015. The Police
Conduct regulations 2012/2632 were amended in various ways, introducing a legally
qualified Chair, publicly accessible hearings, pre-hearing notices, and post-hearing
notices (publishing the result of the public hearing for at least 28 days). These
changes were not retrospective for any matters prior to 2012.
c. In 2017, regulations were introduced which require that details of any police officer
dismissed for gross misconduct are placed on a publicly searchable list.
d. In 2020, the new Police (Conduct) Regulations 2020/4 were introduced. The post-
hearing notice was replaced by publication of the misconduct hearing panel’s full
rationale. It is up to the Chair of the panel as to the content of the document, and the
Chair can decide not to publish at all if appropriate.
37. We have considered the strength of the legitimate interests identified above.
a. In relation to accountability and transparency, we note that the Request only relates
to the disciplinary process for one officer in 2003. Confirmation or denial as to whether
this record exists would further accountability and transparency in a limited way. It
would potentially show what happened with one officer at that time, but would not
provide wider information about police misconduct issues in 2003.
b. In relation to the safety of girls and young women at the University, we recognise that
this is a very important issue. This is particularly so in light of the Sarah Everard case,
and general public concern about the conduct of police officers towards women and
the general safety of women in today’s society. We note, however, the arguments put
forward by the Commissioner and MPS about other steps that could be taken to check
the suitability of an individual for employment at the University. In particular, the
checks that can be carried out by an employer prior to and during employment. These
do not provide a complete answer to the appellant’s concerns, which is why we have
found confirmation or denial is reasonably necessary for this purpose. But, they do
go some way to addressing safety concerns - particularly as these checks are likely to
pick up more serious issues such as criminal offences (through a DBS check) or
dismissals for gross misconduct (through work-related references).
38. We have considered the strength of the named individual’s rights, in particular his privacy
rights.
a. We find that the individual does have a reasonable expectation that any information
relating to police disciplinary proceedings when he worked for MPS will remain private.
The Request relates to information from 2003. As explained by the MPS witnesses,
at this time all police misconduct matters were private. No information was provided
to the public. Publication of some details first happened in 2015. When this individual
worked for MPS, he had a clear reasonable expectation that this information would
remain private. The 2015 changes happened much later. Although it appears they
applied retrospectively to some matters back to 2012, they clearly did not apply to
information from 2003. The changes were neither imminent nor on the horizon at this
time.
b. The MPS has also referred to the individual’s status as a junior officer, and says this
is relevant to reasonable expectations of privacy. Mr Didham’s statement explains
that a junior police officer would not have supervisory, leadership or strategic
responsibilities. He also refers to the Commissioner’s guidance that senior employees
should expect their posts to carry a greater level of accountability. We are not satisfied
that this argument carries much weight in this case. We note that junior police officers
are likely to have extensive contact with the public, meaning that information about
misconduct which may be relevant to public safety is as important as for more senior
officers. We do accept that senior officers may hold more power and so are more
likely to expect that their actions will generally be open to public scrutiny, but this does
not provide a blanket rule that automatically protects junior officers.
c. We have considered the potential for damage or distress to be caused to the individual
by confirmation or denial. This is a request for specific personal data. Confirmation
that the requested information is held would not reveal the nature of any misconduct,
or details about the disciplinary process. However, it would still be very likely to cause
distress to an individual who had no expectation that this information would be made
public. This would be a confirmation to the world at large under FOIA. It would also
be likely to cause speculation about the disciplinary process, damage to the
individual’s reputation, and potentially affect employment prospects. This is
particularly likely due to the high levels of concern about police misconduct allegations
following the Sarah Everard case. Even if no information is held, a denial may still
cause speculation about why the question was asked, and associated damage to
reputation.
39. We have balanced the legitimate interests in confirmation and denial against the named
individual’s rights. We found this to be a finely balanced question. The legitimate interest in
ensuring the safety of girls and young women at a University is very important. However, as
discussed, this can partly be achieved through less intrusive means than public confirmation or
denial under FOIA. The individual’s reasonable expectations of privacy are strong, particularly
considering the age of the information and the gap in time before any details about police
misconduct matters were made public. Distress and damage to the individual is likely, taking
into account the strength of the expectations of privacy here and potential effects of public
confirmation of a disciplinary process (if this information is held). On balance, we therefore find
that the interests in confirmation or denial are overridden by the individual’s privacy rights.
40. This means that confirmation or denial would contravene the data protection principles,
because there is no lawful basis for this processing. MPS was entitled to rely on section
40(5B)(a)(i) to refuse to confirm or deny whether it held the information requested by the
appellant.
41. In relation to the desired outcome from the appeal, the appellant says that the decision by
MPS not to publish information about disciplinary proceedings and the outcome should be
subject to detailed scrutiny and challenged, as it does not provide openness and transparency
relating to conduct inquiries for all police officers. We have considered this in relation to this
particular request as discussed above. We also observe that MPS practice has changed, and
information about misconduct hearings is now publicly available. Although there is limited
transparency about events in 2003, the position is different now. Mr Baird explains in his
statement how FOIA requests for misconduct and disciplinary records are now dealt with.
There is now enhanced openness and transparency, and the outcome in this case may have
been different if the request related to recent disciplinary proceedings.
42. We also note that we are not setting any precedent for future requests. Paragraph 36 of
the Commissioner’s response to the appeal says that once a public authority has denied (or
disclosed) certain information to a particular requester, it must then do the same for anyone
else. It is important to be consistent in confirmation and denial cases in order to avoid
inadvertently revealing information by giving a “neither confirm nor deny” response only when
information is held. However, it is not right to say that the same response must be given to
every request for the same information which involves personal data. Each request must be
treated on its own merits, and the relevant balancing test carried out in all the circumstances
of the case. The legitimate interests in asking for the same information may differ, and may
outweigh individual privacy interests in some cases but not others.
43. We dismiss the appeal for the reasons set out above.
Signed: Hazel Oliver
Judge of the First-tier Tribunal
Date: 15 August 2022
Promulgated: 15 August 2022