Case Reference: EA/2021/0380
NCN: [2022] UKFTT 256 (GRC)
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard: on the papers
Heard on: 1 July 2022
Decision given on: 07 July 2022
Before
TRIBUNAL JUDGE BUCKLEY
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER DAVE SIVERS
Between
MARTINA HOGG
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The appeal is allowed.
Substituted Decision Notice:
Original Decision Notice: IC-82968-F7M6 of 7 December 2021
Organisation: Pendle Borough Council
1
Complainant: Martina Hogg
The substitute decision:
1. The appeal is allowed.
2. For the reasons set out below and in the closed annex to this decision:
a. The public authority was not allowed to withhold the information
specified in part A of the closed annex pursuant to s40(2) of the Freedom
of Information Act 2000.
b. The public authority was entitled to withhold the information specified
in part B of the closed annex pursuant to s40(2) of the Freedom of
Information Act 2000.
3. The public authority must disclose to the appellant the information specified in
part A of the closed annex within 35 days of the date of promulgation of this
decision.
4. Any failure to abide by the terms of the tribunal’s substituted decision notice
may amount to contempt which may, on application, be certified to the Upper
Tribunal.
REASONS
Introduction
1. The parties and the Tribunal agreed that this matter was suitable for determination
on the papers in accordance with rule 32 Chamber’s Procedure Rules.
2. This is an appeal against the Commissioner’s decision notice IC-82968-F7M6 of 7
December 2021 which held that the Pendle Borough Council (‘the Council’) was
entitled to rely on s 40(2) of the Freedom of Information Act 2000 (FOIA) to
withhold some of the requested information and that the Council did not hold some
of the information requested.
3. The Commissioner found that the Council was not entitled to withhold some of the
information and ordered the Council to disclose some information that had
previously been redacted.
4. We have provided a closed annex to this decision containing those aspects of our
reasoning which refer to closed material. If the respondent does not appeal against
our decision, or if any appeal is unsuccessful, then some of that reasoning (part A)
need not remain confidential.
5. The time limit in the information rights jurisdiction for making an application for
permission to appeal to the Upper Tribunal is normally 28 days from the date that
the tribunal’s written reasons are issued: see Tribunal Procedure (First-tier
Tribunal)(General Regulatory Chamber) Rules 2009, rule 42(2).
2
6. We therefore direct that part A of the closed annex will remain confidential until at
least 28 days after the date this decision is issued to the parties (or such later date
as is required by rule 42 or final disposal of an application for permission to appeal
and subsequent appeal.
7. The effect of this decision is that, in normal circumstances, the confidentiality will
be removed from part A 28 days after this decision is issued, unless within that time
a party makes an application for permission to appeal to the Upper Tribunal. In that
event, and subject to any contrary order of the Upper Tribunal, the confidentiality
order will continue until disposal of the permission application and any ensuing
appeal but will then be discharged. If the confidentiality order is discharged, part
A of the closed annex will then be added to the publicly available decision and
copied to Ms Hogg. Part B of the closed annex contains reference to the information
we have determined can be withheld and will remain closed.
Procedural background to the appeal
8. By order dated 9 March 2022 the Council were invited to state whether they
intended to become a party to the proceedings. The Council confirmed by email
dated 23 March 2022 that they did not intend to become a party to the appeal.
Factual background to the appeal
9. The appeal relates to an independent review into the handling of an animal
licensing application made to the Council by Douglas Hall Kennels. The remaining
disputed information is redacted from the review report.
10. The review report is a peer review of the application. The scope of the review was
an assessment of how the Council administered and regulated the new licence
application and of the renewal in relation to the kennel’s activities. The review
report states that its purpose is to highlight whether the owner(s) of the kennels met
the legal requirements and conditions under the Animal Welfare (Licensing of
Activities Involving Animals) (England) Regulations 2018 and whether the Council
has ensured that the operator has a licence for activities that were being undertaken
at the time of the inspection.
11. The disputed information is the redaction of the name(s) of the business owner(s)
from para 11.9 of the review report. Para 11.9 forms part of the ‘recommendations’
section of the report and reads are follows:
The legal entities of the applicants should be questioned further with the licensee to
seek clarification. [redacted] This will ensure that the licences are in the correct legal
name.
Request, decision notice and appeal
The request
3
12. This appeal concerns the following request made on 2 December 2020 in relation to
an independent review into the handling of the licensing application submitted by
Douglas Hall Kennels. The request is for:
1. The name(s) of the person(s) who conducted the review
2. Confirmation of how the person(s) was appointed. From an existing panel? Via
tender?
3. A copy of the letter of instruction or other document(s) setting out the terms of
reference /remit of the review
4. A copy of the review report
13. Ms Hogg made a further request on 7 December 2020 which was dealt with in the
same decision notice, but which is not the subject of any appeal to the tribunal.
The response
14. The Council responded on 9 December 2020 and provided some information. It
redacted some information from the letter of instruction and the review report.
15. Ms Hogg requested an internal review in relation to the redactions to the review
report.
16. Ms Hogg referred the matter to the Commissioner on 18 January 2021, complaining
about (i) the redactions made under s 40(2) and (ii) the ‘not held’ response to her
request of 7 December 2020.
17. The Council carried out an internal review and on 25 February 2021 upheld the
decision to withhold the redacted information under s 40(2). The internal review
also deals with the request on 7 December 2020 which is not the subject of this
appeal.
18. During the course of the Commissioner’s investigation the Council reconsidered
the review report and decided that three words should not have been redacted.
The Decision Notice
19. In a decision notice dated 7 December 2021 the Commissioner decided that:
19.1. In relation to the request of 7 December 2020 the information was, on the
balance of probabilities, not held.
19.2. The Council was entitled to withhold some of the redacted information
under s 40(2).
19.3. The Council was not entitled to withhold some of the redacted information
under s 40(2).
20. It is not necessary for the purposes of this appeal to set out the Commissioner’s
reasoning in relation to 16.1 above.
4
21. The remaining disputed information was the redaction in para 11.9 of the review
report of the name(s) of the business owner(s). The Commissioner accepted that the
information identified the business owner(s) and related to them. The
Commissioner found that the withheld information fell within the definition of
personal data in s 3(2) of the Data Protection Act 2018 (‘DPA’).
22. The Commissioner concluded the appellant’s legitimate interest was that disclosure
would add to the accountability and transparency of the Council in relation to the
licence and help to address any concerns about animal welfare.
23. The Commissioner considered that the review report sufficiently met the legitimate
interests without the need to disclosure the name(s) of the business owner(s). He
did not need to go on the conduct the balancing test under article 6(1)(f) GDPR.
Notice of Appeal
24. The two grounds of appeal are:
24.1. The Council should have had regard to the Council’s conduct, in initially
withholding other information which was clearly not personal data, when
deciding whether or not it was entitled to withhold the information redacted
from para 11.9.
24.2. The Commissioner erred in concluding that it was not reasonably necessary
to disclosure the name(s) for the purposes of the legitimate interest.
25. In relation to ground two, Ms Hogg argues that it is clear, in context, that the
redacted sentence relates to potential shortcomings as regards licences being issued
in the correct name. There is a legitimate public interest in disclosure of information
relating to who the licensee is, and whether or not any third party has been involved
in the business without being appropriately licenced. There is also a public interest
in establishing whether or not the Council’s own procedures correctly identified
and licensed the right entity and/or that all entities involved in the regulated
activities of dog breeding and pet selling are licenced.
The ICO’s response
26. The Commissioner now considers that the report with one remaining redaction
does not sufficiently meet the legitimate interest in the Council’s licencing function
because one of the outcomes from the report was that further consideration is
required in relation to the legal name(s) on the licence.
27. The Commissioner concedes the appeal to the extent the Commissioner should
have concluded that disclosure of the information is necessary to meet the
legitimate interest. If the tribunal agrees the Commissioner was wrong to conclude
that the disclosure was not necessary to meet the legitimate interest then the
Commissioner invites the tribunal to perform the balancing test and to reach a
5
decision on disclosure. The tribunal may consider it would need further
information to enable it to perform this exercise. The Commissioner invited the
tribunal to join the Council to the appeal.
Evidence
28. We read and took account of an open and a closed bundle. The closed bundle
consisted of (i) the disputed information and (ii) two items of correspondence
between the Commissioner and the Council which refer to the content of the
disputed information. These documents have to be closed, otherwise the purpose
of the proceedings would be defeated.
Legal framework
Personal data
29. The relevant parts of s 40 of FOIA provide:
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information
if –
(a) It constitutes personal data which does not fall within subsection (1), and
(b) either the first, second or the third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act -
(a) would contravene any of the data protection principles, or..
30. Personal data is defined in s 3 of the Data Protection Act 2018 (DPA):
(2) ‘Personal data’ means any information relating to an identified or identifiable living
individual (subject to subsection (14)(c)).
(3) ‘Identifiable living individual’ means a living individual who can be identified, directly or
indirectly, in particular by reference to—
(a) an identifier such as a name, an identification number, location data or an online identifier,
or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic,
cultural or social identity of the individual.
31. This is in line with the definitions in the General Data Protection Regulation (EU)
2016/679. Recital 26 to the Regulation is relevant, because it refers to identifiability
and to the means that should be taken into account:
(26) The principles of data protection should apply to any information concerning an identified
or identifiable natural person. Personal data which have undergone pseudonymisation, which
6
could be attributed to a natural person by the use of additional information should be considered
to be information on an identifiable natural person. To determine whether a natural person is
identifiable, account should be taken of all the means reasonably likely to be used, such as
singling out, either by the controller or by another person to identify the natural person directly
or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural
person, account should be taken of all objective factors, such as the costs of and the amount of
time required for identification, taking into consideration the available technology at the time of
the processing and technological developments. The principles of data protection should
therefore not apply to anonymous information, namely information which does not relate to an
identified or identifiable natural person or to personal data rendered anonymous in such a
manner that the data subject is not or no longer identifiable. This Regulation does not therefore
concern the processing of such anonymous information, including for statistical or research
purposes.
32. The definition of "personal data" consists of two limbs:
i) Whether the data in question "relate to" a living individual and
ii) Whether the individual is identified or identifiable, directly or indirectly, from those
data.
33. The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v
Cheyne Gardens Ltd [2017] EWCA Civ 121; Durant v FSA [2003] EWCA Civ 1746
and Edem v Information Commissioner [2014] EWCA Civ 92. Although these
relate to the previous iteration of the DPA, we conclude the following principles are
still of assistance.
34. In Durant, Auld LJ, giving the leading judgment said at [28]:
Mere mention of the data subject in a document held by a data controller does not necessarily
amount to his personal data. Whether it does so in any particular instance depends on where it
falls in a continuum of relevance or proximity to the data subject as distinct, say, from
transactions or matters in which he may have been involved to a greater or lesser degree. It
seems to me that there are two notions that may be of assistance. The first is whether the
information is biographical in a significant sense, that is, going beyond the recording of the
putative data subject's involvement in a matter or an event that has no personal connotations, a
life event in respect of which his privacy could not be said to be compromised. The second is
one of focus. The information should have the putative data subject as its focus rather than some
other person with whom he may have been involved or some transaction or event in which he
may have figured or have had an interest, for example, as in this case, an investigation into some
other person's or body's conduct that he may have instigated.
35. In Edem Moses LJ held that it was not necessary to apply the notions of biographical
significance where the information was plainly concerned with or obviously about
the individual, approving the following statement in the Information
Commissioner's Guidance:
It is important to remember that it is not always necessary to consider 'biographical significance'
to determine whether data is personal data. In many cases data may be personal data simply
because its content is such that it is 'obviously about' an individual. Alternatively, data may be
personal data because it is clearly 'linked to' an individual because it is about his activities and
is processed for the purpose of determining or influencing the way in which that person is
7
treated. You need to consider 'biographical significance' only where information is not
'obviously about' an individual or clearly 'linked to' him.
36. The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals
Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging
the Durant test, that a Court should also consider:
(2) Does the data "relate" to an individual in the sense that it is "about" that individual
because of its:
(i) "Content" in referring to the identity, characteristics or behaviour of the individual?
(ii) "Purpose" in being used to determine or influence the way in which the individual
is treated or evaluated?
(iii) "Result" in being likely to have an impact on the individual's rights and interests,
taking into account all the circumstances surrounding the precise case (the WPO test)?
(3) Are any of the 8 questions provided by the TGN are applicable?
These questions are as follows:
(i) Can a living individual be identified from the data or from the data and other
information in the possession of, or likely to come into the possession of, the data
controller?
(ii) Does the data 'relate to' the identifiable living individual, whether in personal or
family life, or business or profession?
(iii) Is the data 'obviously about' a particular individual?
(iv) Is the data 'linked to' an individual so that it provides particular information about
that individual?
(v) Is the data used, or is it to be used, to inform or influence actions or decisions
affecting an identifiable individual?
(vi) Does the data have any biographical significance in relation to the individual?
(vii) Does the data focus or concentrate on the individual as its central theme rather
than on some other person, or some object, transaction or event?
(viii) Does the date impact or have potential impact on an individual, whether in a
personal or family or business or professional capacity (the TGN test)?
(4) Does the data "relate" to the individual including whether it includes an expression
of opinion about the individual and/or an indication of the intention of the data
controller or any other person in respect of that individual. (the DPA section 1(1) test)?
37. The data protection principles are set out Article 5(1) of the GDPR and s 34(1) DPA.
Article 5(1)(a) GDPR provides: that personal data shall be processed lawfully, fairly
and in a transparent manner in relation to the data subject. Article 6(1) GDPR
provides that processing shall be lawful only if and to the extent that at least one of
the lawful bases for processing listed in the Article applies.
38. The only potentially relevant basis here is article 6(1)(f):
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by
a third party, except where such interests are overridden by the interests or fundamental rights
and freedoms of the data subject which requires protection of personal data, in particular where
the data subject is a child.
8
39. The case law on article 6(1)(f)’s predecessor established that it required three
questions to be answered, which we consider are still appropriate if reworded as
follows
1. Is the data controller or a third party pursuing a legitimate interest or interests?
2. Is the processing involved necessary for the purposes of those interests?
3. Are the above interests overridden by the interests or fundamental rights and
freedoms of the data subject?
40. Lady Hale said the following in South Lanarkshire Council v Scottish Information
Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded
predecessor:
27. ... It is well established in community law that, at least in the context of
justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than
absolutely or strictly necessary .... The proposition advanced by Advocate General
Poiares Maduro in Huber is uncontroversial: necessity is well established in
community law as part of the proportionality test. A measure which interferes with
a right protected by community law must be the least restrictive for the
achievement of a legitimate aim. Indeed, in ordinary language we would
understand that a measure would not be necessary if the legitimate aim could be
achieved by something less. ...
41. S 40(3A) is an absolute exemption and therefore the separate public interest
balancing test under FOIA does not apply.
The role of the tribunal
42. The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider
whether the decision made by the Commissioner is in accordance with the law or,
where the Commissioner’s decision involved exercising discretion, whether he
should have exercised it differently. The Tribunal may receive evidence that was
not before the Commissioner, and may make different findings of fact from the
Commissioner.
Issues
43. In relation to the remaining disputed information redacted from para 11.9 of the
review report the issues for the tribunal to determine are:
43.1. Does the information relate to an identified or identifiable living individual?
43.2. Is the data controller or a third party pursuing a legitimate interest or interests?
43.3. Is the processing involved necessary for the purposes of those interests?
43.4. Are the above interests overridden by the interests or fundamental rights and
freedoms of the data subject?
Discussion and conclusions
9
Personal data
44. The question for us to determine is whether the withheld information is the
personal data of an identifiable living individual. We find that the sentence
redacted from para 11.9 relates to an identifiable individual or individuals. It is
clearly about the individual(s) and the individual(s) is/are named.
Legitimate interest
45. We accept that the appellant is pursuing a legitimate interest, namely that
disclosure would add to the accountability and transparency of the Council in
relation to the licence and help to address any concerns about animal welfare.
Reasonable necessity
46. We have considered whether the disclosure of the requested information is
reasonably necessary for the purposes of the identified legitimate interests.
Disclosure must be more than desirable, but less than indispensable or an absolute
necessity. Disclosure must be the least restrictive means of achieving the legitimate
aim in question, because it would not be necessary if it could be achieved by
anything less. We must consider whether the legitimate aim could be achieved by
means that interfere less with the privacy of the data subjects.
47. On balance, we agree with the Commissioner that disclosure of the information
specified in part A of the closed annex is reasonably necessary for the purposes of
the legitimate interests. The legitimate interest relates to transparency around the
Council’s licencing function. The purpose of the peer review report was to assess
how the Council had administered and regulated the new licence application and
renewal for Douglas Hall Kennels Ltd. One of the recommendations of the report
was that ‘the legal entities of the licensee should be questioned further with the
licensee to seek clarification’.
48. Without the information specified in part A, it is more difficult to understand why
this recommendation was made. In order to serve the legitimate interest in
transparency we conclude that it was reasonably necessary to see the redacted
information specified in part A, which provides context and assists in
understanding the recommendation.
49. In relation to the information specified in part B of the closed annex, namely the
final four words of the redacted sentence, we do not agree that disclosure is
reasonably necessary for the purposes of the legitimate interests. The information
does not add to the understanding of the review report or why this
recommendation was made, nor is it relevant to the Council’s licencing function.
On this basis we do not need to consider the balance of interests in relation to the
information specified in part B and we find that the Council was entitled to
withhold this information under s 40(2).
10
Are the above interests overridden by the interests or fundamental rights and freedoms of the
data subject?
50. The reasoning in this section relates to the information specified in part A of the
closed annex only.
51. Given the limited information that has been withheld, we find that it contributes to
transparency only to a moderate extent.
52. We then consider whether those interests identified above are outweighed by the
interests of the individual(s).
53. The seriousness of the consequences of disclosure will be affected by the extent to
which the withheld information is already in the public domain. Our reasoning and
conclusions on the extent to which the withheld information is in the public domain
and the effect of this on the interests of individual(s) is in the closed annex, on the
basis that it would defeat the purposes of the appeal if included in the open decision.
In summary we have concluded there will be no or no significant impact on the
individual or individuals involved by the release of the information.
54. We have considered the extent to which disclosure would be within the reasonable
expectations of the individual(s). Our reasoning and conclusions on this are in the
closed annex, on the basis that it would defeat the purposes of the appeal if included
in the open decision. In summary we have concluded that the individual or
individuals would reasonably expect this information to be public and therefore
would reasonably expect it to be disclosed. In these circumstances we conclude that
the individual(s) would have had a reasonable or legitimate expectation that his or
her identity or identities would be disclosed.
55. We accept that there is no evidence of consent, but given the nature of the
information and our conclusions in the closed annex in relation to what information,
if any, was already in the public domain, we find that there is no potential harm or
distress.
56. Taking all the above into account, we conclude that although there is only a
moderate interest in disclosure of this small amount of information, it is not
outweighed by the legitimate interests of the individual(s) involved. In those
circumstances we find that the Council was not entitled to withhold the information
in part A of the closed annex under s 40(2) FOIA.
Signed Sophie Buckley Date: 6 July 2022
11
Judge of the First-tier Tribunal
12