Bilgi Edinme Başvurusuna İlişkin İtirazın Reddi

Case Reference: EA/2022/0095
[2022] UKFTT 00394 (GRC)

First-tier Tribunal
General Regulatory Chamber
Information Rights

Heard on by CVP on 6 October 2022

Decision given on 4th November 2022

Before

TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Dave Sivers
TRIBUNAL MEMBER Kate Grimley Evans

Between

MICHAEL GUY SMITH
Appellant
And

INFORMATION COMMISSIONER

Respondent

Decision: The appeal is Dismissed.

Substituted Decision Notice: No substituted decision notice.
Mr Smith represented himself
The Commissioner was represented by Michael White.

REASONS

MODE OF HEARING AND PRELIMINARY MATTERS

1. The proceedings were held via the Cloud Video Platform. All parties joined remotely.
The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

2. The Tribunal considered an agreed open bundle of evidence comprising 603 pages, a
closed bundle written submissions from both parties and a bundle of authorities.

3. The case was listed for half a day although the parties were not aware that this was the
case (we note that the Appellant had replied ‘Unknown, but perhaps half a day’ in the
time estimate section of the appeal form). In the end we did use part of our afternoon
session, the Appellant was able to address us for over two hours in the hearing, and
we had the benefit of his thirty-page skeleton argument.

4. The Appellant also renewed his application to adjourn the hearing, which had been
considered by the registrar and the Judge prior to the hearing. For the reasons set out
in response to those applications, the renewed application to adjourn was not granted.

BACKGROUND

5. The Commissioner is the regulator responsible for ensuring, amongst other things,
that public authorities comply with requests for information made under the Freedom
of Information Act 2000 (“FOIA”).

6. However, the Information Commissioner is also a public authority and is required to
itself comply with FOIA in respect of any requests received.

7. This appeal concerns requests for information made by the Appellant to the
Information Commissioner as a public authority.

8. The Tribunal will follow the approach taken in other documents in this case and refers
to the Information Commissioner as (a) ‘the ICO’ when he is acting in the capacity as
a recipient of FOIA requests; and (b) ‘the Commissioner’ when he is acting in the
capacity of a regulator and as the respondent to this appeal.

9. There is a history to this matter. The Appellant made a number of FOIA requests to
the ICO, in connection with its practice of publishing online the names and addresses
of registered data controllers.

10. The ICO failed to deal with all the requests made and accepted that some were
outstanding only after a decision notice was issued dealing with other aspects of the
requests. The ICO then issued responses to those outstanding requests with which the
Appellant was not satisfied. He sought to bring his complaints about these later
responses into a Tribunal appeal on the other issues but was unsuccessful (see
decisions from the FTT and the Upper Tribunal).

11. The matters were pursued by further complaint to the Commissioner, which led to the
decision notice which is the subject of the current appeal.

12. Essentially, the Appellant challenges the findings of the Commissioner upholding
decisions of the ICO that it does not hold further information in relation to the
requests that had been outstanding, other than some information to which the
exemption under s42 FOIA (legal professional privilege) was applied.

THE DECISION NOTICE

13. The decision notice of 21 March 2022 summarises the position as follows: -

1. The complainant requested the ICO to disclose information relating to the
register of fee payers and the processing and publication of personal data. This
was a 15-part request and has been submitted three times to the ICO. The three
requests are referred to as the Group 1, 2 and 3 requests. The ICO responded
to the Group 1 requests on 25 October 2019, following an earlier decision notice
issued by the Commissioner on 11 September 2019. It responded to all of the
Group 2 requests on 9 January 2022 (it had responded only to parts 10 and 14
previously) and it responded to the Group 3 requests on 8 January 2022.

2. Following receipt of the responses to the Group 1, 2 and 3 requests, the
complainant remained dissatisfied and asked the Commissioner to consider
whether the ICO had now met its obligations under FOIA, whether any further
recorded information was held by the ICO at the time of the requests and to
consider whether there had been any procedural breaches of the legislation.

3. The Commissioner’s decision is that the ICO has now met its obligations
under FOIA, although this is a result of a fresh search conducted in response to
the Commissioner’s section 50 investigation. The ICO located three further
documents. In addition to this the complainant has identified further documents
which the Commissioner considers falls within the scope of the request and
should have been identified by the ICO’s searches. On this basis, the
Commissioner is satisfied that, on the balance of probabilities, no further
recorded information is held (other than that which has now been newly
identified by the ICO and the complainant). The new information identified is
however exempt from disclosure under section 42 and 21 FOIA.

14. However, the Commissioner identified further procedural breaches of the legislation
in addition to those recorded in the Commissioner’s earlier notice of 11 September
2019. The ICO breached section 10 FOIA as it did not respond to the Group 2 and 3
requests within the statutory time for compliance. Furthermore, as the ICO did not
identify all recorded information held falling within the scope of the Group 1, 2 and 3
requests within twenty working days it again failed to comply with section 10 FOIA.
Finally, it breached section 17(1) as it did not identify the exemptions being relied upon
to withhold the newly identified information.

15. A table of all the requests made in the three groups and the responses is contained in
an annex to the decision notice which can be found at

https://ico.org.uk/media/action-weve-taken/decision-notices/2022/4019998/ic-
76861-g6c6.pdf.

16. The Commissioner in his response to this appeal has set out the requests which are at
issue in this appeal, together with the replies. We have set out an edited version of this
as Annex 1 below as perhaps the best way to understand the requests made by the
Appellant which are at issue and the responses of the ICO.

17. It can be seen from the annexes that the response to the majority of the requests is
that the ICO does not hold anything further within the scope of the requests and that
is the main focus of the challenge in this appeal (we will consider later the reliance on
s42 FOIA for some documents later in this decision).

18. In the decision notice the Commissioner has examined the claims by the ICO that no
further information is held and considered the arguments by the Appellant to the
contrary.

19. Thus, at paragraphs 40-43 the Commissioner sets out what is described as the ICO’s
‘original position’. This set out the senior staff and managers consulted over the
requests (see paragraphs 40-41) and that ‘searches would encompass searches of its
records management systems, Sharepoint EDRM, and previously, Meridio as well as
any case management systems that might be considered relevant’ (paragraph 40).

20. The Commissioner also states that: -

A fresh search has however been conducted by the ICO in response to the
Commissioner’s section 50 investigation and the results of this are explained
below under the section ‘The Complainant’s position’. This has located some
further information falling within scope and additionally the complainant has
identified some further information falling within scope. (paragraph 43).

21. At paragraphs 44-48 the Commissioner records the various points made by the
Appellant to the effect that he believed that more information was held. This included
queries as to whether further information would have been generated when emails

were answered (para 45); the likelihood that information would exist in relation to
consultations with the DCMS when there was a ‘transition from the register of
notifications which existed prior to 25th May 2018, to the register of fee payers’
(para48); information relating to an IT project ‘to make the necessary modifications to
the registration process for the register of notifications’ (para 48); and the possibility
that the ICO had ‘deleted some information related to the project to implement the
register of fee payers’.

22. The response of the Commissioner to these points is recorded as follows: -

49. The Commissioner asked the ICO to address these specific points and
confirm whether any further recorded information is held as a result of the
consultations and discussions with DCMS and when this was created to then
work out whether it would have fallen into scope of Group 1, 2 or 3 requests.
The Commissioner also asked the ICO to confirm whether any information was
deleted, if it was deleted, why, and whether the ICO considers this was in
accordance with its records retention policy.

50. With regards to searches, the Commissioner explained that the complainant
is concerned that members of the project team were not consulted and asked to
search – namely [four redacted names]. The Commissioner therefore asked
whether these individuals were consulted and asked to search? If not, the
Commissioner asked whether they could be approached now to see if any further
recorded information is held? If further recorded information is identified the
ICO would need to then determine whether it was held at the time the Group 1
requests were made, or later on when the Group 2 requests were made or,
subsequently the Group 3 requests.

51. The ICO contacted again all those involved in the initial consultations and
the additional individuals the Commissioner had specified and asked them to
conduct further searches in order to confirm whether anything further is held
which falls in scope of the request. With regards to discussions with DCMS, the
ICO informed the
Commissioner that there is no information falling in scope of the request. [name
redacted] has advised that whilst they did consult with DCMS about the new
regulations, she cannot recall that the ICO ever consulted specifically on the
issue of publication of the register and reasonable searches have located nothing
in scope.

23. The Commissioner also ascertained from the ICO that information had been deleted
in line with the ICO’s Retention and Disposal Policy and said that he ‘is therefore

satisfied that any information that was deleted was done in line with the ICO’s
retention and disposal policy’ (para 52).

24. In paragraph 54 the Commissioner sets out the Appellant’s points raised about ‘Article
30’ records requested for the purposes of Request 6. He said that ‘it is sufficiently clear
to establish that the Article 30 records contain nothing about processing for the
purposes of publishing the entries in the register of fee payers’ and referred to emails
where the ICO had provided justifications and explanations which could be described
as purposes. The Commissioner responded as follows: -

55. The Commissioner put it to the ICO that the complainant considers that
these emails are recorded information relevant to request 6 and should have been
disclosed.

56. The ICO argued that if the complainant’s position is that he maintains the
further emails referred to at paragraph 54 above should have been identified and
disclosed, the ICO disagrees. FOIA requires the ICO to perform reasonable
searches to identify all the information held. It consulted with the individuals
who may have held information falling in scope and performed searches of
relevant areas of the ICO’s records management system. The ICO considers that
it performed appropriate and thorough searches of the areas of its record
management system and contacted individuals it would reasonably expect to
hold information in scope if it existed. It does not consider it would have been
reasonable to search every piece of correspondence or enquiry the ICO received
on the off chance any information falling in scope of the complainant’s requests
existed, especially given he is already in receipt of the emails he has referred to
as they are addressed to him. In any event to search all correspondence and
enquiries received would undoubtedly take the request over the cost limit under
section 12. However, the ICO said that should the Commissioner consider these
documents should have been identified through reasonable searches and that the
ICO should have disclosed these emails, then this would engage section 12 of
the FOIA as any attempt to locate information of this nature would undoubtedly
exceed the cost limits. Alternatively, the specific emails referred to by the
complainant would be exempt under section 21 of the FOIA as they are already
reasonably accessible to him.

25. In relation to whether further information is held the Commissioner concluded as
follows: -

59. The Commissioner is satisfied that, on the balance of probabilities, all
recorded information which was held at the time of the Group 1, 2 and 3
requests has now been identified by the ICO. The ICO has explained exactly

what searches it undertook and how these were of all relevant staff and business
areas.

60. This is because the Commissioner asked the ICO to carry out fresh searches
during his section 50 investigation to ensure that it had identified all recorded
information held and therefore complied with its obligations under section 1 of
FOIA.

61. As a result of the fresh searches conducted, two further documents have
been identified as falling within the scope of the Group 1 requests (and would
therefore also fall within scope of the Group 2 and 3 requests). This information
is however being withheld under section 42 FOIA. One further document was
located relevant to the Group 3 requests which has also been withheld under
section 42 FOIA (this was not however held at the time of the Group 1 and 2
requests).

…

63. In this case the Commissioner does not consider it reasonable for the ICO
to search all correspondence and enquiries given it is a large public authority and
records will be spread across various departments and locations. Fresh searches
ensured all original consultees were consulted again and the four individuals
whom the complainant was concerned had not been approached were also
consulted. In addition, a further member of staff was consulted which located
the three further documents being withheld under section 42.

64. However in terms of the emails referred to by the complainant as falling
within the scope of the request and not located by the ICO identified at
paragraph 54, the Commissioner considers it may have been reasonable to
search for this information. The ICO would not have to search all
correspondence and enquiries, only correspondence and enquiries from one
particular individual (the complainant given the ICO’s interaction with him on
this subject matter). On this basis the Commissioner considers it unlikely section
12 FOIA would apply to search for correspondence with one individual however
he would accept that this information would be reasonably accessible to the
complainant and therefore exempt under section 21 FOIA.

26. In relation to section 42 FOIA (which is an exemption relating to legal professional
privilege), the Commissioner explains that: -

…a further staff member was contacted by the ICO. They have advised that
they had been involved in the ICO’s internal compliance project in the run up
to the implementation of GDPR and were aware of some documents generated
as part of this project that might fall in scope of the request. …. they have now
conducted additional searches of the information held in connection with this

project and have managed to locate two documents that would appear to fall in
scope of the complainant’s request, specifically requests 6 and 10. Whilst they
only contain a limited amount of information, these should have been identified
and considered for disclosure at the time of the Group 1 requests (and could
therefore also have been held at the time the Group 2 and 3 requests were made).
However, these documents contain legal advice and are being withheld under
section 42 of the FOIA.

27. The Commissioner concluded that the documents were covered by the s42 FOIA
exemption and that the public interest balance to be applied favoured the non-
disclosure of the documents.

LEGAL FRAMEWORK

28. Section 1 FOIA provides that: -

(1) Any person making a request for information to a public authority is
entitled—
(a) to be informed in writing by the public authority whether it holds information
of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.

…

(5) A public authority is to be taken to have complied with subsection (1)(a) in
relation to any information if it has communicated the information to the
applicant in accordance with subsection (1)(b).

29. The Tribunal in Linda Bromley v the Information Commissioner and the Environment Agency
(EA/2006/0072; 31 August 2007) held that in determining a dispute as to whether
information is ‘held’ at [13]: -

There can seldom be absolute certainty that information relevant to a request
does not remain undiscovered somewhere within a public authority's records.
This is particularly the case with a large national organisation like the
Environment Agency, whose records are inevitably spread across a number of
departments in different locations. The Environment Agency properly conceded
that it could not be certain that it holds no more information. However, it argued
(and was supported in the argument by the Information Commissioner) that the
test to be applied was not certainty but the balance of probabilities. This is the
normal standard of proof and clearly applies to Appeals before this Tribunal in
which the Information Commissioner's findings of fact are reviewed. We think

that its application requires us to consider a number of factors including the
quality of the public authority's initial analysis of the request, the scope of the
search that it decided to make on the basis of that analysis and the rigour and
efficiency with which the search was then conducted. Other matters may affect
our assessment at each stage, including, for example, the discovery of materials
elsewhere whose existence or content point to the existence of further
information within the public authority which had not been brought to light.
Our task is to decide, on the basis of our review of all of these factors, whether
the public authority is likely to be holding relevant information beyond that
which has already been disclosed.

30. Section 42 FOIA states that information in respect of which a claim to legal
professional privilege (LPP) could be maintained in legal proceedings is exempt
information. Section 42(1)(a) FOIA reads, materially, as follows: -

42.— Legal professional privilege.
(1) Information in respect of which a claim to legal professional privilege…
could be maintained in legal proceedings is exempt information.

31. Litigation privilege applies to confidential communications made for the purpose of
providing or obtaining legal advice in relation to proposed or contemplated litigation.
For information to be covered by litigation privilege, it must have been created for the
dominant purpose of giving or obtaining legal advice, or for lawyers to use in preparing
a case for litigation. It covers communications between lawyers and third parties, as
long as they are made for the purposes of the litigation. Litigation privilege applies to
a wide variety of information, including advice, correspondence, notes, evidence or
reports.

32. However, this is a qualified exemption which means that in addition to demonstrating
that the requested information falls within the definition of the exemption, there must
be consideration of the public interest arguments for and against disclosure to
demonstrate in a given case that the public interest rests in maintaining the exemption
or disclosing the information. When applying the public interest test the approach to
be taken is whether in all the circumstances of the case, the public interest in
maintaining the exemption outweighs the public interest in disclosing the information:
s2(2)(b) FOIA.

33. In relation to the application of the public interest test in s42 FOIA cases, in DBERR
v O’Brien v IC [2009] EWHC 164 QB, Wyn Williams J gave the following important
guidance: -

41. … it is for the public authority to demonstrate on the balance of probability
that the scales weigh in favour of the information being withheld. That is as true
of a case in which section 42 is being considered as it is in relation to a case
which involves consideration of any other qualified exemption under FOIA.
Section 42 cases are different simply because the in-built public interest in non-
disclosure itself carries significant weight which will always have to be considered
in the balancing exercise once it is established that legal professional privilege
attaches to the document in question.

53…..The in-built public interest in withholding information to which legal
professional privilege applies is acknowledged to command significant
weight. Accordingly, the proper approach for the Tribunal was to acknowledge
and give effect to the significant weight to be afforded to the exemption in any
event; ascertain whether there were particular or further factors in the instant
case which pointed to non-disclosure and then consider whether the features
supporting disclosure (including the underlying public interests which favoured
disclosure) were of equal weight at the very least.

34. Further, in Corderoy and Ahmed v Information Commissioner, A-G and Cabinet Office [2017]
UKUT 495 (AAC)), the Upper Tribunal noted as follows in emphasising that the s42
FOIA exemption is not a blanket exemption: -

68. The powerful public interest against disclosure … is one side of the equation
and it has to be established by the public authority claiming the exemption that
it outweighs the competing public interest in favour of disclosure if the
exemption is to apply. However strong the public interest against disclosure it
does not convert a qualified exemption into one that is effectively absolute.

35. The development of the doctrine of legal advice privilege, and of the rationale for it,
is traced in detail in the speech of Lord Taylor of Gosforth CJ in R v Derby Magistrates
Court, ex p B, [1996] AC 487, and then summarised by him as follows at 507D:

The principle which runs through all these cases, and the many other cases which
were cited, is that a man must be able to consult his lawyer in confidence, since
otherwise he might hold back half the truth. The client must be sure that what
he tells his lawyer in confidence will never be revealed without his consent. Legal
professional privilege is thus much more than an ordinary rule of evidence,
limited in its application to the facts of a particular case. It is a fundamental
condition on which the administration of justice as a whole rests.

THE APPEAL AND THE HEARING

36. The Appellant’s appeal is dated 19 April 2022. The grounds are listed as follows: -

• Ground 1: The decision notice should have found that the ICO has more recorded
information in the scope of my FOI requests.
• Ground 2: The decision notice should have found that the public interest favoured
disclosure in relation to the information the decision notice found to be covered
by a section 42 FOIA exemption.
• Ground 3: The decision notice incorrectly decides that the ICO has complied with
section 1(1)(a) FOIA for some of my FOI requests.
• Ground 4: The decision notice should have found further breaches by the ICO
of section 16 FOIA
• Ground 5: The decision notice incorrectly finds that the ICO complied with the
earlier decision notice FS50804336 of 11th September 2019.
• Ground 6: The decision notice has incorrectly dated the ICO’s responses to my
Group 3 requests.

37. For the appeal hearing the Appellant’s comprehensive skeleton argument helpfully set
out why he was ‘sceptical of the claim that the ICO has no more information within
the scope of my requests’, for the purposes of Ground 1. He said that these centered
around four lines of enquiry: -

The ICO is under a legal obligation as a data controller relying on the public
task lawful basis to have more records than it says it has.
Enquiries related to how in practice the ICO would likely have transitioned
from the register of notifications, which existed prior to 25th May 2018, to the
register of fee payers, and the ICO’s responsibilities during that transition. In
particular the artefacts and records that would have been likely to have been
generated for this transition.
The evidence that the ICO had some information within the scope of some
of my requests which they deleted.

Whether all the relevant people identified as working on the project to
implement the register of fee payers have been asked to search for any recorded
information.

38. The Appellant’s wholly reasonable approach (as it was before the Commissioner) was
to analyse what information he thought the ICO should hold in relation to its
functions, who should have been asked to search for it, and to question exactly what
information had been deleted prior to the request.

39. The Commissioner’s response is to say that whether more information is held is a
factual question and draws attention to the extensive investigation that the ICO carried
out in response to the requests in issue.

40. In relation to the s42 FOIA exemption (Ground 2) the Appellant does not state a
position as to whether the exemption applies (as he has not seen the withheld material).

41. In terms of the public interest, the Appellant warns (as does the case law) about
elevating s42 FOIA to the status of a blanket exemption. He notes the Commissioner’s
view that availability of the DPIA and Policy means that ‘Disclosure of the small
amount of legally privileged information would add nothing further of value to this
discourse and would not be in the public interest’. The Appellant raises the possibility
that the withheld material is in some way inconsistent or incompatible with the
information disclosed, or that it adds nothing at all of substance to the material
disclosed. In both cases he argues these would be factors to take into account when
balancing the public interest.

42. The Commissioner points to the strong interest in public authorities – in this case, the
ICO – being free and unconstrained in seeking legal advice without fear that such
advice is likely to be disclosed in due course, particularly in circumstances where it is
still relevant to a live issue or policy (as it is here, it is argued, given that the
Commissioner is still publishing the Register and publishing controllers’ addresses
thereon). The Commissioner invites the Tribunal to consider the relevant documents
in the closed bundle and submits that that they do not, for example, go to a matter in
which there has been any journalistic interest, or suggest that the ICO has acted in a
manner that is in any way reprehensible.

43. The Appellant raises some additional matters in his appeal. He argues that ‘the decision
notice incorrectly decides that the ICO has complied with section 1(1)(a) FOIA for
some of my FOI requests’ (Ground 3) as the ICO did not confirm that all the
information provided was in fact responsive to the Appellant’s requests. The
Commissioner says that what the ICO needed to do to comply with its duties under
s1(1) FOIA was simply to provide information it held, and confirmation of holding
the information was implicit in its provision.

44. The Appellant complains that ‘the decision notice should have found further breaches
by the ICO of section 16 FOIA’ (the duty of a public authority to provide advice and
assistance so far as it would be reasonable to expect the authority to do so, to
requesters) (Ground 4). This ground is based on the fact that the ICO did not carry
out internal reviews in relation to some of the requests. The Commissioner says in his
skeleton argument that: -

It is very clear from the extensive correspondence in the bundle that the ICO
has engaged at great length and in good faith with the Appellant in respect of his
requests, and the Commissioner does not consider that internal reviews were
required in order to discharge the ICO’s duties under section 16 FOIA.

45. The Appellant also states that the decision notice overlooks the fact that the ICO’s
compliance with the earlier decision notice FS50804336 was out of time (Ground 5),
and ‘that the decision notice has incorrectly dated the ICO’s responses to my Group
3 requests’ (Ground 6). The Commissioner argues that these points are ‘immaterial to
the outcome of the complaint or decision appealed’.

DISCUSSION

46. The Appellant has introduced detailed arguments in writing and orally. It is not
possible to do justice to every point he makes.

47. However, from the point of view of the Tribunal there are two main questions to be
answered. The first is whether the Commissioner was correct to find that, on the
balance of probabilities, the ICO does not hold any further information within the
scope of the requests made by the Appellant (Ground 1). The second is whether the
Commissioner was correct to find that the public interest in relation to any documents

covered by legal professional privilege favoured the withholding rather than the
disclosure of those documents (Ground 2). We will consider each of those questions
in turn and then refer more briefly to the other Grounds raised by the Appellant.

Holding any further information

48. As the parties agree, it is necessary for the Tribunal to decide on the balance of
probabilities whether the ICO holds any further information within the scope of the
Appellant’s requests.

49. In our view it is appropriate to consider the factors set out in the Bromley judgment as
set out above, and to consider the four headings presented to the Tribunal by the
Appellant in writing and at the hearing (and as set out above).

50. In this case there are clearly failings in relation to the ICO’s initial analysis of the
requests from the Appellant, although in our view the way the requests were presented
did not make the task an easy one for the ICO. However, by the time the Appellant’s
complaint had been investigated by the Commissioner, it is the case that further
searches, at the behest of the Commissioner, had been carried out and responses
provided to the Commissioner.

51. We have set all this out above, and cited extensively from the decision notice, and it is
our view that the result has been a series of thorough, considered, rigorous and
widespread searches covering an appropriate number of relevant people and sources.
It is clear, in particular, that the Commissioner, during the investigation, responded to
points made by the Appellant and asked for further steps and searches to be
undertaken in relation to those points.

52. We take on board the Appellant’s point that where the ICO is under a legal obligation
as a data controller to have more records than it says it holds, then we should approach
the case with some care. We also accept that where there has been a process such as
the transition from the register of notifications, there will often be information
generated as a result. However, our role is not to consider what information should be
held by the ICO. Our role is to consider whether the public authority does, in fact,
hold the requested information. In our view, and on the facts, if the extensive searches

described by the Commissioner and as carried out by the ICO have not revealed any
further information, then it is unlikely that further information is held.

53. In relation to the Appellant’s point that some of the requested information may have
been deleted in line with the ICO’s data deletion policy, it does not appear to us that
this takes things any further. We are considering the position at the time the request
was made. If the information was deleted before the Appellant’s request was made,
then it was not held at the time of the request. The fact that some information was
deleted does not, in our view, imply that further information was held within the scope
of the requests which could or should have been disclosed.

54. Further, in relation to the Appellant’s concern that not all the relevant people at the
ICO were asked to search records, we note that these points were made to the
Commissioner by the Appellant (and further individuals identified). It can be seen
from paragraphs 50-51 of the decision notice that the Commissioner made further
requests to the ICO and the Commissioner records that ‘the ICO contacted again all
those involved in the initial consultations and the additional individuals the
Commissioner had specified and asked them to conduct further searches. In our view,
these further steps insisted on by the Commissioner, and carried out by the ICO,
provide further evidence that sufficient searches were made in this case.

55. The Appellant raised another point that some of the information that has been
disclosed ‘does not meet the description I specified in my requests’. However, we
accept the Commissioner’s response that, if this is the case, it stems from the ICO’s
attempt to disclose as much information requested as it can, rather than any attempt
to mislead or obfuscate the issue as to what information is held. It may be the case that
some information which the Appellant feels is not within the scope of his request has
been disclosed, but that does not lead to a conclusion that the ICO holds further
information that is within the scope of the request.

56. Lastly, during the hearing the Appellant made submissions to the effect that the ICO
was motivated to withhold information within the scope of the requests. We have seen
no evidence of that and, indeed, the decision notice indicates that extensive efforts
have been carried out to find a definitive answer as to whether further information is
held or not.

57. Taking all this into account, it is our view that, on the balance of probabilities, the ICO
does not hold further information in relation to the Appellant’s request. We note that
the Appellant made some arguments about where the burden of proof lay in this case.
For the avoidance of doubt our conclusion is the same whether or not the burden of
proof is on the Commissioner to show that no further information is held, or on the
Appellant to show that further information is held.

Section 42 FOIA

58. The Tribunal has seen the relevant withheld information and, in its view, it
consists of information to which the exemption in s42 FOIA applies.

59. Having reached that conclusion, the approach we have to take is to recognise
that there is a significant in-built public interest in non-disclosure in LPP cases
under s42 FOIA, as the court said in DBERR paragraph 53, ‘in any event’. As
the court indicated in paragraph 51 of that case it is ‘not necessary to
demonstrate any specific prejudice or harm from the specific disclosure of the
documents in question’.

60. It is then necessary to assess whether there are other factors to be taken into
account which support non-disclosure, and then consider whether the public
interest in disclosure is equal to or outweighs those combined factors.

61. No specific additional factors have been raised by the Commissioner which
justified the decision that the public interest favoured non-disclosure.
Conversely, in our view the public interest in favour of disclosure are not
strong. As submitted on behalf of the Commissioner, the Tribunal can confirm
that there is nothing in the documentation which is contradictory to any policy
or guidance issued by the ICO. We also agree with the Commissioner that the
information does not add very much, or anything, to the sum of knowledge
already available to the Appellant.

62. We recognise that there may be cases where the public interest in disclosure
will outweigh the in-built public interest in protecting LPP, and that s42 FOIA

does not provide for a blanket exemption. However, in our view this is not
one of those cases for the reasons set out above. The public interest in
disclosure is not strong in this case and the public interest balance is in favour
of non-disclosure. That is our conclusion regardless of which of the parties has
the burden of proving where the public interest lies.

Other grounds
63. In our view a correct interpretation of s1(5) FOIA is that the provision of information
under s1(1)(b) FOIA amounts to confirmation that information was held for the
purposes of s1(1)(a) FOIA. Section 1(5) FOIA says in terms that a ‘public authority is
to be taken to have complied with subsection (1)(a) in relation to any information if it
has communicated the information to the applicant in accordance with subsection
(1)(b)’. In our view in this case there was nothing further to be done by the ICO to
comply with s1(1)(a) FOIA.

64. Looking at the case in the round, and the extensive efforts which we have found both
the ICO and the Commissioner to have undertaken by the time the Commissioner
issued the decision notice, the Commissioner was correct to find that there was not a
breach of s16 FOIA.

65. In the circumstances of this case, mistakes such as overlooking the fact that a response
to a request was outside the statutory time limit, or wrongly recording a date, do not
in our view amount to anything in the decision notice which is not in accordance with
the law or an exercise of discretion which should have been exercised differently by
the Commissioner such as to provide grounds to allow the appeal.

CONCLUSION

66. On the basis of the above, the Tribunal dismisses the appeal.

Stephen Cragg KC

Judge of the First-tier Tribunal

Date: 1 November 2022

Date Promulgated:

ANNEX 1: Summary of requests in dispute with Appellant’s and ICO’s reponses
(edited from the Commissioner’s skeleton argument for appeal hearing).

Requests 2 and 8

Request 2 …is as follows:-

Is it your contention that the use of a PO Box or ‘alternative address’ is compliant with The Data
Protection (Charges and Information) Regulations 2018?”

This request was later reformulated into Request 8, with the Appellant describing Request
8 as “My further attempt to clarify what I'm asking for now [in Request 2]”.

Request 8 was as follows:

The ICO collects for the register of fee payers the name and address of each registering data controller
provided via paragraph 3(a) of Regulation 2 of The Data Protection (Charges and Information)
Regulations 2018. Paragraph 5(b) of Regulation 2 says that for the purposes of paragraph 3(a),
"the address of a person (other than a registered company) carrying on a business is that of the
person’s principal place of business in the UK."
• Does the ICO have a policy, with regards to enforcement of these regulations, for what it regards
as acceptable as a person's principal place of business in the UK?
• If so please send me a copy of the ICO's policy.
• Does the ICO have a procedure for verifying that the address a person has provided is their
principal place of business in the UK?
• If so please send me a description of the procedure.

The ICO confirmed to the Commissioner that it did not hold any information that was
responsive to Requests 2 and 8: [C407]. This was explained to the Appellant in:-

(a) an email on 25 October 2019, which stated in response to Request 8 that the
ICO did not have the policies or procedures sought: [B149]-[B150];

(b) a letter of 8 January 2021 (misdated 2020), which stated in response to Requests
2 and 8 that:

“The only information that may fall in scope of these requests is held in our DPIA
and Publication of Register of Fee Payers Policy. We have previously provided these
to you, but I have attached the latest versions here. There is nothing further held
beyond what we have advised you in our previous responses”: [B236].

The Appellant took issue with this in correspondence, for example in the email of 27
January 2021 that appears at [B284]-[B285], in which he states inter alia:

“Whilst I think it is clear that these documents are relevant and related to my
requests in some sense that is not the same as saying that they do actually contain
all of the information I seek. I think in a number of cases they do not contain all of
the information I seek. Do you disagree and maintain that they do provide all the
information I seek for all the requests I have asked you to review? Or is it that you
agree that they do not provide all of the information I seek but maintain that the
ICO does not have any further recorded information within the scope of my
requests that I have
asked you to review? If so please clarify which information you believe you have
provided for which requests and which you have not because you maintain that the
ICO has no such recorded information. As written the wording of your letter is
much more vague and equivocal. It seems as if you are avoiding providing a clear
view on whether they contain all of the information I seek with the requests I am
now asking you to review.

The ICO wrote back to the Appellant on 29 January 2021 – [B288] – to confirm, inter alia:-
… we have provided copies of the information that we hold and that fall under the
scope of your requests. If specific information you are seeking is not present in the
disclosed information, please take this as confirmation that it is not held.

Requests 2 and 9

Request 3, at [B125], is as follows:
“When did you start publishing the register again?”

This request was later reformulated into Request 9, with the Appellant stating in an email
on 2 January 2019 “I think, given the context in which this question was asked, it was already
very clear. But, in order to make things even clearer I can further clarify now by expanding
on a more complete set of requests for publishing dates of the register as follows”: [B139]-
[B140]. The Appellant went on to set out Request 9, in the terms set out below.

The ICO responded to this request on 25 October 2019. For ease of reference, its response
has been interpolated below, in unitalicised bold text: [B149]-[B150]:

• On which date did the ICO cease to publish on its website at https://ico.org.uk/ data from the
register of notifications (described at the time on the website as the "Register of data controllers")
that pertained before the data protection law changes which commenced on 25th May 2018.

We do not hold a specific record of this, but we believe we stopped
publishing the public register around 5 May, before the GDPR changes were
made.

• On which date, on or after 25th May 2018, did the ICO start to publish data from
the register of fee payers, set up via the data protection law changes which commenced on 25th May
2018.

21 June 2018

• Please also specify any dates on which the register of fee payers was subsequently taken down from
the website at https://ico.org.uk/ and subsequently put back up on the website. I don't require
any dates when the only reason that the register of fee payers was unavailable was general technical
website operational problems at https://ico.org.uk/ rather than deliberate purposeful actions in
relation to the publication of the register of fee payers.

We do not have any records of us purposefully making the register
unavailable and we do not believe we have intentionally taken the register
down after 21 June 2018

Please answer the above requests in relation to the register of notifications and the register of fee
payers in two ways:
• In relation to a publicly searchable form, such as the current one at
https://ico.org.uk/ESDWebPages/Search.
• In relation to a downloadable file or set of files containing multiple entries from the register such
as currently referred to at https://ico.org.uk/aboutthe-ico/what-we-do/register-of-
feepayers/download-the-register/.

An updated, downloadable version of the public register has not
been made available after 25 May 2018.

Continuing:

• Currently the page at https://ico.org.uk/about-the-ico/whatwe-do/register-of-fee-
payers/download-the-register/ says that the "register of fee payers is currently unavailable to
download". Does the ICO have a policy or plan to make this downloadable version of the register
of fee payers available again?

• If so is there a target date for when this would happen and what is it?

We have plans to make the public register of fee payers downloadable. At
this stage we do not have dates for when it will be available to download from
our website. We are currently exploring some technical issues that need to
be resolved before we can place the information we hold in a downloadable
format on the website, but this work is ongoing. I can confirm that we do
intend to publish one once our website development issues are resolved to
the extent that this is possible.

In the meantime the public register of fee payers is available on our website,
it is searchable, and it is free to use and re-use the data under the terms of
the Open Government Licence (OGL).

• Were there any periods when the register of fee payers' data was unavailable on the ICO's website
at https://ico.org.uk/ , in either of the two ways referenced, when it was instead available at the
UK government web archive of the ICO website at https://webarchive.nationalarchives.gov.uk/ ?
If you do not have this information about the UK government web archive I would be grateful if
you could direct me to who does”

We do not hold information regarding what information is available on the
National Archives website. The National Archives holds archived versions of
the Information Commissioner’s Office website. Therefore historical data in
regard to the fee payers’ register is available via the National Archives
website, please find a link to this below.
https://webarchive.nationalarchives.gov.uk/*/http:/www.ico.org.uk”.

Requests 4 and 10

Request 4 is as follows:-
Turning to the matter of your lawful basis for publishing my personal data. You are maintaining
that it is under the lawful basis of "Public task". But you have failed to adequately address my
points in my original email regarding this. In particular you have not given any specific reference to
a statue law which gives you this publishing right. In your email reply you simply refer to Article
6(1)(e) of the GDPR, but as you know this merely introduces the "Public task" lawful basis. It
is not the specific law needed for this particular case. Recital 41 of the GDPR does say that you
do "not necessarily require a legislative act adopted by a parliament" but your "legal basis or
legislative measure should be clear and precise and its application should be foreseeable to persons
subject to it". You have failed to do this. Moreover your own guidance notes at:
https://ico.org.uk/for-organisations/guide-to-the-general-dataprotection-regulation-gdpr/lawful-
basis-for-processing/public-task/ state "For accountability purposes, you should be able to specify
the relevant task, function or power, and identify its basis in common law or statute. You should
also ensure that you can demonstrate there is no other reasonable and less intrusive means to achieve
your purpose." You simply haven't done this and I invite you to do this again now.

This request was later reformulated into Request 10, with the Appellant stating as
follows, in respect of Request 4, in an email on 2 January 2019: [B138]:-

It is unclear to me whether your refusal of my Freedom of Information requests extends to this
version of my request. Nevertheless my further attempt to clarify what I'm asking for now is:

The ICO have previously said that the publication on the ICO's website of the register of fee payers,
including some personal data of individual data controllers, is done under the public task lawful
basis. The ICO's published guidance on the public task lawful basis at https://ico.org.uk/for-

organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-
gdpr/lawful-basis-for-processing/public-task/ says public authorities relying on the public task
lawful basis should "Document your decision to rely on this basis to help you demonstrate
compliance if required. You should be able to specify the relevant task, function or power, and
identify its statutory or common law basis."

• Does the ICO have documentation regarding the decision to rely on the public task lawful basis
and does any such documentation include a specification of the relevant task, function or power,
and its statutory or common law basis?
• If the ICO does have such documentation then please send me a copy of it.
• If the ICO does not have any such documentation then please send me any records
you have regarding why this documentation was regarded as unnecessary in spite of your own
published guidance and obligations under Recital 41 of GDPR.

The ICO responded to Requests 4 and 10 as follows, on 25 October 2019:-

There is no documented decision, it is stated in our Privacy Notice that we rely on
the public task as the lawful basis. The Privacy Notice contains the purpose and
legal basis for processing, please find a link to this on our website:
https://ico.org.uk/global/privacy-notice/pay-a-data-protection-fee/

There have been two updates to the Privacy Notice since its publication, which I
have detailed below.

17 May 2019 – Updated to include information about fees recovery and our use of
external solicitors.

25 June 2019 - Change of data processor from Barclays to Global Payments.

All other content was present when the updated privacy notice was published prior
to GDPR coming in on 25 May 2018.

As this information is reasonably accessible to you by other means it is exempt from
disclosure under section 21 of the FOIA.

The Commissioner went on to explain, in an email dated 8 January 2021 (misdated
2020) – [B237] – that:-
To the extent we hold information falling in scope of these requests it is held
primarily in our privacy notice (to which you have previously been directed and is
technically exempt under section 21 of the FOIA), our DPIA and Publication of
Register of Fee Payers Policy, the latest versions of which are attached. I have also
attached our response to the regulator following your complaint to the
Commissioner under case reference RFA0804334. Where this contains your
personal data it has been disclosed to you on a discretionary basis as opposed to
‘the world at large’ under the FOIA.

The Commissioner explained further, in the table appended to his email to the
Appellant of 9 January 2022 – [B292]-[B293] – that:-

We consider we hold information in connection with this request and this was
disclosed in our response – namely the DPIA publication of the register of fee
payers and our response to the regulator in response to his complaint. Eg the
following extract from the DPIA: Article 57 of the GDPR lists the tasks required
of the commissioner as the supervisory authority in the UK. Article 57(d) requires
the Commissioner to promote public awareness and understanding of the risks,
rules, safeguards and rights in relation to processing. We consider publication of the
register to be integral to us fulfilling this task.

In the course of correspondence with the Commissioner in respect of the complaint
underpinning this appeal, the ICO discovered, from additional searches, further
information falling within the scope of this request that was subject to legal professional
privilege: see closed bundle, and [B302]-[B305].

Requests 5 and 11

Request 5 is as follows:-
Currently my address on the register is listed as “withheld”. Do you plan to maintain it like this,
including on any re-enabled facility to download the entire register? Will this continue once you’ve
introduced the email address option? I.e. can I continue to have my domestic residential address and
email address withheld from the published register? If so do you plan to offer this facility to others
who object or during the registration process?”

This request was later reformulated into Request 11, with the Appellant stating as
follows, in respect of Request 5, in an email on 2 January 2019: [B140]:-

Part of this request is specific to me, and so not related to a Freedom of Information request. My
further attempt to clarify now the part which I believe is a Freedom of Information request is:
• If an individual data controller complains about the publishing of their domestic residential
address or email address in the published register of fee payers, does the ICO have a policy that
covers whether or not this data will be listed as "withheld" on the published register of fee payers?
• If so please send me a copy of this policy.
• Are there any plans to ask individuals whether they consent to have this information published
as part of the registration process or will it be left to individuals exercising their general right to
object such as under Article 21 of GDPR?

The ICO responded to Requests 5 and 11 as follows, on 25 October 2019 – [B151]:-

We do not hold a policy and as stated in our Privacy Notice […] we rely on the
public task as the lawful basis for processing.

The Commissioner went on to explain, in an email dated 8 February 2021 – [B165]
that:-
As advised previously the lawful basis for processing is the public task and therefore
consent is not required.

The Commissioner explained further, in the table appended to his email to the
Appellant of 9 January 2022 – [B298] – that:-
No specific ‘policy’ is held – however, we hold information about the scenario
described in the first part of the request – in our DPIA and Policy on the publication
of the register. For example, sections 2.2, 3.1 and 4 of the DPIA. Section 2.2 of the
DPIA also covers the second part of Q11.

Requests 6 and 12

Request 6 is as follows:-
What does the ICO think is the purpose, under the new legal framework, of the register of fee
payers?

This request was later reformulated into Request 12, with the Appellant stating as follows,
in respect of Request 6, in an email on 2 January 2019: [B140]:-

“My further attempt to clarify what I'm asking for now is:
Article 30 of GDPR requires the ICO to document the purposes of any processing of the personal
data gathered for the register of fee payers.
• Does the ICO have such documentation and if so please send me a copy of it?
• Do the purposes go further than those specified in the privacy notice at
https://ico.org.uk/global/privacy-notice/pay-a-data-protection-fee/ ?”

The ICO responded to Requests 6 and 12 as follows, on 25 October 2019 – [B151]:-

We can confirm that, pursuant to Article 30 of the General Data Protection
Regulation 2016 (GDPR), the ICO holds a record of processing activity for the
processing of personal data in respect of the register of fee payers.
I have attached a csv file to this response which contain the information you have
requested. This a live document which is currently under review.”

The ICO confirmed in respect of these requests in a further letter on 8 January 2021
(misdated 2020) – B238 – that:-

The only information held beyond what has previously been advised and provided
to you is contained within the latest version of our DPIA/Policy. I have also
attached the relevant section of the latest section [sic] of our Article 30 ROPA.

Requests 7 and 13
Request 7 is as follows:-

Your email solution makes no sense to me whatsoever. It just doesn’t seem like it’s been thought
through properly. You talk about giving data controllers the option, but how? When they register
or renew? I suppose you could do it then, although of course I would argue you have to give people,
who are registering as data controllers as individuals, the option of neither their postal address nor
their email address being published. But given how you’re referring to whether I object I assume
your plan sounds like you intend that it would apply to everyone on the register. But then how
would this be achieved? Do you plan to email everyone on the register and ask them if they want
their email address to be published rather than their postal address, giving them the option of as
you suggest registering a new email address? Or do you just intend to start publishing the existing
email address they’ve provided? My recollection of the fee registration process was that I had to give
an email address in the context of providing contact details and I thought it said that it wouldn’t
be published. Can you confirm this?

This request was later reformulated into Request 13, with the Appellant stating as
follows, in respect of Request 7, in an email on 2 January 2019: [B140]:-
My further attempt to clarify what I'm asking for now is:
In an email to me on 20th August 2018 you referred to an email solution to give individuals the
option of providing an email address giving them the option to provide a way of being contacted
without that identifying where they are based.
• Does the ICO have any specification documents as to how this solution is intended to work and
how it would change the process of registering by data controllers?
• If so please send me a copy of any such specification documents.
• Does the ICO still intend to proceed with this email policy?
• If the ICO does still intend to proceed with this email policy then is there a target date for when
the change would be rolled out and what is it?

The ICO responded to Requests 7 and 13 as follows, on 25 October 2019 – [B151]:-
We do not hold specification documents but individuals are given the option of
providing an email address as an alternative if they raise a concern.

In an email of 8 February 2020, the ICO confirmed:-
In regard to your query about an email solution’ and a policy in regard to this. As
previously advised we do not hold a policy. Therefore we have nothing further to
add.

The ICO confirmed in respect of this request in a further letter on 8 January 2021
(misdated 2020) – B239 – that :-

Nothing further is held beyond what you have been previously advised. The only
information of relevance is held in the DPIA/Policy and our privacy notice.

With a further email to the Appellant on 9 September 2022, the ICO enclosed a table
in which it noted inter alia that:-

We don’t hold a ‘specification document’ as such. However, information about the
‘email solution’ and any changes to the process of registering is held in section 2.2
and 3.1 in the DPIA. No other information is held: [B299].

Request 14
Request 14 is as follows:-
Firstly regarding a Data Protection Impact Assessment:
• Did the ICO carry out a Data Protection Impact Assessment (DPIA) which covered the
processing of data gathered for the register of fee payers?
• If so when was the DPIA carried out?
• If a DPIA was carried out please send me a copy of any DPIA document.
• If the ICO did not carry out a DPIA did you document the reasons why you did not?
• If you did document the reasons why you did not carry out a DPIA then please send me a copy
of this documentation.
• If you did not carry out a DPIA did you rely on a prior Privacy Impact Assessment
(PIA) for the previous register of notifications, perhaps with appropriate updates?

The ICO responded to Request 14 as follows, on 25 October 2019:-
A DPIA was not completed for the register of fee payers when the new regulations
came in last year. There are no documented reasons why we did not carry out a
DPIA. There was not a prior Data Privacy Impact Assessment.

In an email to the Appellant on 8 February 2020, the ICO wrote:-

You also enquired about a Data Protection Impact Assessment (DPIA) for the
register of fee payers. We can advise that a DPIA is in the process of being
completed: [B165].

A DPIA was done subsequently. With a further letter to the Appellant on 8 January 2021
(misdated 2020), the ICO enclosed a copy of the DPIA: [B239]-[B240].

Request 15

Request 15 is as follows:
Concerning the current register of fee payers please provide the following numbers:
• Total number of entries on the register of fee payers, i.e. the total number of data controllers who
are on the register of fee payers including those whose entry rolled over from the register of
notifications. Then amongst this total number:
• The number of entries on the register of fee payers in tier 1 - micro organisations.
• The number of entries on the register of fee payers who specified an organisation type of "Individual
/ Sole trader".
• The number of entries on the register of fee payers who specified an organisation type of "Individual
/ Sole trader" and where the address given of the data controller is a domestic residential address.
If such addresses are not flagged as such on the register then please provide a reasonable estimate if
possible.
When providing these numbers please provide them for the most recent date where it is practicable
to provide them and tell me what that date is.

The ICO responded to Request 15 as follows, on 25 October 2019: -
Please find below the figures for the total register by Tier.
Dec 2018:
Tier 1 – 563,454
Tier 2 – 20,491
Tier 3 – 6,340
Total = 590,285
The current register:
Tier 1 – 563,699
Tier 2 – 40,818
Tier 3 – 6,259
Total = 611,046
We have 172,746 sole traders on the register (we do not have a status for individual).
We do not have anything that differentiates between a residential and non-
residential address so we cannot provide an answer to this.

Bilgi Edinme Başvurusuna İlişkin İtirazın Reddi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni