UKFTT-GRC 2022 529 [2022] UKFTT 529 (GRC) InformationRights 0.26.10 570d2d861883ebabf552a5cddce6b4eb0b06949d9ff17d62cec46089642e2b3e 6.0.2
Neutral citation number: [2022] UKFTT 00529 (GRC)
Case Reference: EA/2023/0207
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard by: remotely by video conference
Heard on: 24 October & 20 December 2023
Decision given orally on: 20 December 2023
Decision given in writing on 21 December 2023
Before
TRIBUNAL JUDGE HAZEL OLIVER
TRIBUNAL MEMBER ANNE CHAFER
TRIBUNAL MEMBER NAOMI MATTHEWS
Between
DILLAN PATRICK EGAN
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Representation :
For the Appellant: In person
For the Respondent: Did not attend on 24 October; Richard Bailey on 20 December
Decision: The appeal is allowed as the Information Commissioner’s decision notice was not in accordance with the law.
Substituted Decision Notice:
1. The Information Commissioner’s decision that Hywel Dda University Health Board (the “Health Board”) was entitled to rely on section 31 of the Freedom of Information Act 2000 (“FOIA”) to withhold information was incorrect, and the Health Board was not entitled to rely on section 31 to withhold any of the requested information.
2. The Health Board is entitled to rely on the following exemptions:
a. Section 40(1) FOIA to withhold the personal data of the Appellant. In doing so, they should take into account the Appellant’s wish that only his name should be withheld.
b. Section 40(2) FOIA to withhold the names of individuals in the requested information (to the extent not already disclosed in the internal review response).
3. The Health Board was not entitled to rely on sections 40(1), 40(2), 41 or 38(1)(a) FOIA to withhold the remainder of the requested information.
4. The Health Board is to disclose the remainder of the requested information (that is not withheld in accordance with paragraph 2 above) within 42 days of the date when this written decision is sent to them.
Failure to comply may result in the Tribunal making written certification of this fact to the Upper Tribunal, in accordance with rule 7A of the First-tier Tribunal (General Regulatory Chamber) Rules, and may be dealt with as a contempt of court.
REASONS
Mode of hearing
1.
The proceedings were held by video (CVP). All parties joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.
Background to Appeal
2.
This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 9 August 2022 (IC-115166-G5T4, the “Decision Notice”). The appeal relates to the application of the Freedom of Information Act 2000 (“FOIA”). It concerns an investigation report requested from Hywel Dda University Health Board (the “Health Board”). The investigation report was produced following concerns raised in relation to physiotherapy practices at Glangwili General Hospital in the context of the COVID-19 pandemic.
3.
Unusually, the Appellant has seen the majority of the withheld information. He raised concerns which led to the investigation report. The full report, with only names redacted, was disclosed to the Appellant separately outside FOIA.
4.
On 30 March 2021, the Appellant wrote to the Health Board and requested the following information (the “Request”):
“May you release copy of the investigation report to myself, as previously requested, such that the meeting may prove productive and fruitful.”
This refers to a copy of an investigation report produced following investigation of concerns raised in relation to physiotherapy practices during the initial stages of COVID-19.
5.
The Health Board responded on 7 May 2021. It provided a redacted copy of the investigation report and relied on the following exemptions to withhold information within the report:
•
Section 38(1)(a) – health and safety.
•
Section 40(1) – personal data of the applicant.
•
Section 40(2) by virtue of 40(3)(a)(i) – third party personal information.
•
Section 41(1)(b) – information provided in confidence.
6.
The Appellant requested an internal review on 8 May 2021. The Health Board responded on 6 August 2021. It disclosed the names of senior staff previously withheld under section 40(2). It also disclosed some of the information previously withheld under section 38.
7.
The Appellant initially complained to the Commissioner on 27 June 2021. The Commissioner decided:
a.
The withheld information was generated internally and so cannot engage section 41.
b.
Not all of the information refused under section 40(2) would fall under the definition of personal information.
c.
After exercising his discretion and considering whether section 31 (prejudice to law enforcement) applied, that the Health Board was entitled to refuse to disclose the withheld information under section 31(1)(g) and 31(2)(j) (prejudice to exercise of functions for the purpose of protecting persons against risk to health and safety arising out of or in connection with the actions of persons at work). The exemption was engaged, and the public interest in maintaining the exemption outweighed the public interest in disclosure.
d.
The Commissioner had separately investigated the Appellant’s allegation about breach of section 77 (the offence of altering records with intent to prevent disclosure) and could find no evidence to substantiate it.
The Appeal and Responses
8.
The Appellant initially attempted to appeal on 4 September 2022. He sent the appeal to the incorrect email address and so it was not received by the Tribunal He resubmitted the appeal to the correct email address on 13 April 2023. The Registrar granted an extension of time and the appeal was accepted.
9.
The Appellant’s grounds of appeal are that he did not accept the Commissioner should have substituted his own decision that the information should have been withheld under section 31. He provided detailed arguments on this point. This is set against the background of serious concerns expressed by the Appellant about how the Health Board handled the investigation after he had acted as a whistleblower in relation to patient safety concerns. He asks for:
a.
The application of the section 31 exemption to be revoked.
b.
The release in full of the requested information.
c.
That the Commissioner be instructed to conduct a criminal investigation into section 77 complaints.
10.
The Commissioner’s response invites the Tribunal to allow the appeal and to substitute his Decision Notice.
11.
The Commissioner has changed his position and now says that section 31 is no longer engaged on the facts of the case.
a.
He accepts the Appellant’s argument that the relevant employees of the Health Board were registered professionals with the Health and Care Professions Council which places a legal obligation upon its registrants in the Standards of Conduct Ethics and Performance 8.1 and 9.6 to cooperate with an investigation conducted by their employer. Paragraph 9.6 of the standards provides, “ You must co-operate with any investigation into your conduct or competence, the conduct or competence of others, or the care, treatment or other services provided to service users ”.
b.
The Commissioner accepts that, although these are only guidance, it is unlikely that the employees would refuse to cooperate with future such investigations if the withheld information were disclosed, even if confidentiality were promised for this particular investigation. He also notes the Appellant’s reference to the duties employees are subject to under the Health and Safety at Work Act 1974 .
c.
The Commissioner now accepts that he erred in concluding that there is a real and significant risk that disclosure would have a negative impact on the voluntary supply and free flow of candid information, and so accepts that disclosure would not be likely to prejudice the Health Board’s function.
12.
The Commissioner says that, if the Tribunal accepts that section 31 is not engaged, it will need to consider the other exemptions relied on by the Health Board – sections 41, 40 and 38. He invites the Tribunal to issue a substituted decision notice finding that s.41(1), s.40(5A) and s.40(2) are engaged on the facts of this case (with accordingly no steps required of the Health Board). The Commissioner submits that:
a.
He now accepts that section 41 (information provided in confidence) is engaged, there would be an actionable breach of confidence at common law, and there would not be a public interest defence to breach of confidence. Section 41 would also apply to the information withheld under section 38(1)(a) FOIA.
b.
Sections 40(2) and 40(5A) are engaged in relation to personal data. The disclosure made of the redacted version of the report to the Appellant is sufficient to meet the legitimate interest in disclosure, and disclosure of the withheld third party personal data is not reasonably necessary. For the same reasons, the Commissioner would maintain that it is not reasonably necessary for the Health Board to confirm or deny holding information constituting the Appellant’s personal data.
c.
In relation to section 77, the Appellant would not have been entitled to disclosure of the withheld information and that therefore no breach of section 77 has occurred on the facts of this case.
13.
The Appellant submitted a detailed reply. In summary:
a.
The Commissioner is in contempt of court and abusing the process by failing to address the exemptions relied on by the Health Board in the initial Decision Notice, and the Tribunal should not consider these exemptions now.
b.
The section 41 exemption does not apply. There is no evidence that any assurance of confidentiality was given to every interviewee, and voluntarily providing a personal opinion on a professional subject matter during an investigation into safety does not entitle or afford that person to confidentiality surrounding either that personal opinion or the statement as a whole.
c.
Section 40 only allows the redaction of the personal names of staff members.
d.
There has been breach of section 77 as information was concealed or defaced, and there was an inexcusable delay in dealing with the internal review.
14.
The Health Board was asked whether they wished to be joined as a party to the proceedings when the appeal was accepted. They did not reply at that stage. Since then, the Tribunal has received the Commissioner’s response to the appeal which changes his position. The Commissioner submitted in his response that it would be appropriate and in accordance with the overriding objective to direct that the Health Board be joined as second respondent to the appeal. The Appellant objected to this in his reply, on the grounds of prejudice caused by delay and because realistically there is nothing to be gained by joining them.
15.
We have considered whether to make a direction adding the Health Board as a party to the proceedings under rule 9. We have decided that in the circumstances this would not be in accordance with the overriding objective. The Health Board was made aware of these proceedings but did not reply to the invitation to be joined as a respondent. The Commissioner has changed his position since then, meaning that the Health Board may not be aware that the Commissioner is no longer relying on section 31. However, the Commissioner is now relying on the exemptions that were used by the Health Board when it refused the original request. The Health Board has set out its position clearly in the response to the Request, review outcome decision, and representations to the Commissioner during the investigation. There has already been considerable delay in this case. The Health Board did not initially wish to be joined as a party, and the Tribunal is satisfied that we have sufficient information in the open bundle about the Health Board’s position in relation to the applicable exemptions. On that basis we find that joining the Health Board at this stage of the proceedings would cause considerable further delay which would prejudice the Appellant (taking into account his health and the stress caused by these proceedings), and this would not be in the interests of justice.
Applicable law
16.
The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1)
Any person making a request for information to a public authority is entitled—
(a)
to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b)
if that is the case, to have that information communicated to him.
……
2
Effect of the exemptions in Part II.
…….
(2)
In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—
(a)
the information is exempt information by virtue of a provision conferring absolute exemption, or
(b)
in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
……..
31
Law enforcement.
(1)
Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice—
…
(g)
the exercise by any public authority of its functions for any of the purposes specified in subsection (2).
…
(2)
The purposes referred to in subsection (1)(g) to (i) are—
…
(j)
the purpose of protecting persons other than persons at work against risk to health or safety arising out of or in connection with the actions of persons at work.
…….
38
Health and safety
(1)
Information is exempt information if its disclosure would or would be likely to -
(a)
endanger the physical or mental health of any individual, or
(b)
endanger the safety of any individual.
……..
40
Personal information.
(1)
Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2)
Any information to which a request for information relates is also exempt information if –
(a)
it constitutes personal data which do not fall within subsection (1), and
(b)
the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act —
(a) would contravene any of the data protection principles…
…….
(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
……..
41
Information provided in confidence
(1)
Information is exempt information if:
(a)
it was obtained by the public authority from any other person (including another public authority), and
(b)
the disclosure of the information to the public (otherwise than under this Act ) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.
…….
58 Determination of appeals
(1)
If on an appeal under section 57 the Tribunal considers—
(a)
that the notice against which the appeal is brought is not in accordance with the law, or
(b)
to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.
(2)
On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.
17.
Health and safety . We have considered the First-Tier Tribunal decision in Lownie v Information Commissioner & The National Archives & The Foreign and Commonwealth Office EA/2017/0087. We agree that the use of the word “endanger” in section 38 rather than “prejudice” is deliberate, meaning that they should not be treated as the same test. Section 38 requires endangerment of physical or mental health, and distress alone should not be equated with mental ill ‐ health.
18.
Personal data . Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” ( s.3(4) (d) DPA), and so includes disclosure under FOIA.
19.
The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation (“UK GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” (Article 6(1)(a)). It also includes where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The UK GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.
20.
The balancing of interests test under section 6(1)(f) involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 ):
(i)
Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?
(ii)
Is the processing involved necessary for the purposes of those interests?
(iii)
Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
21.
Information provided in confidence. In relation to the section 41 exemption (information provided in confidence), the basic requirements for establishing a breach of confidence are as set out in Coco v A N Clark (Engineers) Ltd [1969] RPC 41 :
a.
The information must have the necessary quality of confidence about it. The Commissioner’s guidance on section 41 states that, in order to have the necessary quality of confidence, information must be more than trivial and not otherwise accessible in the public domain.
b.
The information must have been imparted in circumstances conferring an obligation of confidence. This can be explicit, or can be implied from the circumstances in which the information is imparted.
c.
There must be an unauthorised use of that information to the detriment of the person communicating it.
22.
Section 41 is an absolute exemption. However, the public interest must still be taken into account in determining whether disclosure would constitute an actionable breach of confidence. The public interest may constitute a defence to an action at common law for breach of confidence. There is an assumption that the information should be withheld unless the public interest in disclosure outweighs the public interest in upholding the duty of confidence.
Issues and evidence
23.
The issues are:
a.
Is the exemption in section 31 FOIA (law enforcement) engaged in relation to the withheld information and, if so, does the public interest in maintaining the exemption outweigh the public interest in disclosing the information?
b.
If not, is the Tribunal entitled to consider other exemptions relied on by the Health Board?
c.
If so:
i.
Does section 40(1) and 40(5A) FOIA apply to allow the Health Board to withhold and/or refuse to confirm or deny that it holds the Appellant’s personal data?
ii.
Does section 40(2) apply to allow the Health Board to withhold third party personal data?
iii.
Does section 41 FOIA (information provided in confidence) apply to allow the Health Board to withhold the remainder of the withheld information?
iv.
Does section 38(1)(a) (health and safety) apply to allow the Health Board to withhold any of the withheld information?
24.
By way of evidence and submissions we had the following, all of which we have taken into account in making our decision:
a.
An agreed bundle of open documents.
b.
A witness statement from the Appellant (included in the open bundle).
c.
A closed bundle of documents containing the withheld information.
Discussion and Conclusions
25.
In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision. We deal in turn with the issues.
Is the exemption in section 31 FOIA (law enforcement) engaged in relation to the withheld information and, if so, does the public interest in maintaining the exemption outweigh the public interest in disclosing the information?
26.
We agree with the Commissioner’s revised position that section 31 does not apply in these circumstances. In the specific context of work for the Health Board, there is not a real and significant risk that disclosure would have a negative impact on the voluntary supply and free flow of candid information, meaning that disclosure would not be likely to prejudice the Health Board’s function. This means that the Commissioner’s Decision Notice was not in accordance with the law and we allow the appeal on this point.
Is the Tribunal entitled to consider other exemptions relied on by the Health Board?
27.
The Appellant argues that the Commissioner’s decision has been reached, and he should not be having a second bite at the cherry. He says the Commissioner must have originally looked at and ruled out these other exemptions. He argues that this can be distinguished from the decision in Information Commissioner v Malnick & ACOBA [2018] UKUT 72 (AAC) . In that case, the Commissioner considered two exemptions relied on by the public authority, and decided the matter solely on one of the exemptions. In this case, the public authority relied on four exemptions but the Commissioner substituted a completely different exemption. This implies that the Commissioner has considered the other four exemptions and found them to be invalid.
28.
We find that we are entitled to consider the other exemptions that were originally relied on by the Health Board. We note the Appellant’s submissions, but we find that the Commissioner did not make an actual decision that these exemptions did not apply. The Commissioner does make some points about sections 41 and 40(2) in paragraph 12 of the Decision Notice, although not about sections 40(1) and 38. He then goes on to make his actual decision on the basis of section 31. In Malnick the Upper Tribunal confirmed that there is “no limitation” on the issues that this Tribunal can address, and it must " consider everything necessary to answer the core question [of] whether the authority has complied with the law ".
Does section 40(1) and 40(5A) FOIA apply to allow the Health Board to withhold and/or refuse to confirm or deny that it holds the Appellant’s personal data?
29.
The Commissioner agrees that section 40(1) applies. He also says that, given the nature of the information, the Health Board should have relied on section 40(5A) to neither confirm nor deny that it held information that is the Appellant’s personal data. The Appellant’s position is that his own personal data should be treated consistently with that of others, and he argues for his name to be withheld but not other information.
30.
Section 40(1) is an absolute exemption. A requester under FOIA is not entitled to obtain their own personal data under the freedom of information regime. They can obtain it through a data subject access request instead. Section 40(5A) also applies, meaning the public authority could have refused to confirm or deny whether they held the Appellant’s personal information (although they did not choose to do so in this case). This exemption is not subject to a public interest test. We therefore find that the Health Board was entitled to withhold the Appellant’s personal data under section 40(1) FOIA.
31.
Although we have seen the closed bundle and the table of redactions at page D609 in the open bundle, it is not clear exactly which redactions have been made under section 40(1) as opposed to the other exemptions. The Appellant agrees that his name should be redacted. There may be some other items of information that are personal data and would still allow the Appellant to be identified even if his name is redacted. Given the Appellant’s position that he consents to his name only being redacted, the Health Board may wish to take this approach.
Does section 40(2) apply to allow the Health Board to withhold third party personal data?
32.
It appears from the table on page D609 that significant amounts of information have been redacted on this basis, although again it is unclear from the closed bundle exactly where this exemption has been applied as opposed to the other exemptions. The Commissioner’s Decision Notice noted at paragraph 12 that “ not all of the information refused under section 40(2) would fall within the definition of personal information ” (although it does not explain this further).
33.
The Appellant’s position is that the names of individuals should be redacted, as this alone should be sufficient to ensure that individuals cannot reasonably be identified. He says that job titles should not be redacted. He questions whether job titles alone would realistically allow individuals to be identified, and in any case an understanding of the line management structure and who held which position is critical to understanding the issues. The content of statements containing personal opinions is also critical to understanding what happened.
34.
The Commissioner now takes the position that section 40(2) can be relied on to withhold both names and personal opinions contained in the report. The Commissioner says that opinions and inferences are personal data if the individual can be identified from that data, either directly or indirectly, and the information relates to that individual. The Commissioner does not refer to the comment in paragraph 12 of the Decision Notice, or explain why he now takes the view that all information redacted under this exemption is data from which an individual can be identified even if names are removed. The Health Board has also not explained in any of its correspondence why all of the redacted information would be personal data if names are removed.
35.
We agree that all names are clearly personal data. Job titles may also be personal data, as it may well be possible for the individual to be identified from this and other information even where a name is not given. Expressions of opinion may be personal data, both about the person expressing the opinion and any person about whom the opinion is expressed. This is only the case if an individual can be identified, and it remains unclear to us whether all of the redacted information would meet this test. We note that the majority of the redactions for personal data appear to be from notes of interviews with various individuals. The Appellant would be likely to be able to identify these individuals even without names and job titles, as would other people who worked at or were connected with the Health Board. On that basis we have assumed that all of the information redacted under this exemption is personal data about third parties, and have gone on to consider the remainder of the test.
36.
This personal data can only be disclosed under FOIA if that is lawful under the UK GDPR and DPA. The lawful processing condition at Article 6(1)(a) UK GDPR applies and is the condition that was applied by the Health Board and the Commissioner.
37.
Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? The Commissioner accepts that the Appellant has a legitimate interest in disclosure of the report in full, and that there is a wider legitimate interest in transparency and scrutiny in relation to whether the Health Board follows its own procedures. The Health Board considered that the core purpose of disclosure was openness and transparency. But, on the basis it had considered the health and safety matters that had been raised, it cannot see a wider public interest for the content of the report – this is rather of a personal interest to the requestor.
38.
The Appellant spent some time at the hearing explaining the reasons why he says full disclosure of the report is so important. He says that it is not simply a matter of personal interest. His position is that he raised genuine and serious concerns about health and safety, in the context of the early stages of the COVID-19 pandemic. There was then an investigation, which was conducted under the heading of health and safety. However, in reality this was more like a HR investigation into his own conduct, as is shown by the content of the redacted interview records in the report. He says that the conclusion of the report is not something that was reasonably available to the investigating officer. The reason he is pursuing the issue is that he wishes to bring the overall handing of this matter to the attention of the public, in the context of the ongoing public inquiry into the UK’s response to and impact of the COVID-19 pandemic, which includes learning lessons for the future. In essence, he says that there was wrongdoing in the way an investigation into an important issue of patient safety was handled, and this can only be shown by disclosure of the full report.
39.
Having taken into account the Appellant’s explanations, it is clear that he is pursuing legitimate interests. This is not simply a personal interest in how the report affects him, but a genuine and significant public interest in openness and transparency as to how an investigation into important issues of patient safety was handled.
40.
Is the processing involved necessary for the purposes of those interests? The Commissioner says that it is not. This is on the basis that the redacted version of the report contains the concerns raised, the methodology used, and the findings of the report. The Commissioner takes the position that disclosure of the redacted version is sufficient to meet the legitimate interests. The Health Board also says that it is not, having looked at whether or not the context of the report changes when considering the information for disclosure. They say that the majority of the information is personal opinion and names. The disclosure of names does not change the context of the report. The personal opinion may be of personal interest to the requestor, but it is interpreted and relayed in the summary of the report.
41.
Having considered the legitimate interests relied on by the Appellant, we disagree with the Commissioner and the Health Board. We find that disclosure of some of the personal information is reasonably necessary for the purposes of those interests.
42.
We do not find that disclosure of individual names is necessary, as this adds little to the understanding of how the investigation was conducted and whether this matches with the conclusions of the report. However, we find that disclosure of other personal information consisting of job titles and expressions of opinion is reasonably necessary. We do not agree that the redacted version of the report is sufficient, as it does not contain the full version of witness statements. We note that the report says it “ details an investigation into patient safety concerns raised with and pertaining to Physiotherapy management at Glangwill General Hospital during the early stages of the Covid-19 pandemic ”. However, the Health Board’s response to the Commissioner says that “ the basis of the report is in fact a Human Resources investigation into a complaint ”, and goes on to explain, “ the report in the main focuses on the team’s ability to work together with Mr Egan and the manner in which Mr Egan left the organisation. This information is not of interest to the wider public but is of a personal interest to Mr Egan .” There is a clear mismatch between the patient safety stated purpose of the investigation in the released section of the report, and the Health Board’s assertion that it was mainly a HR investigation. The Appellant’s point is that the released part of the report does not match with the way the investigation and witness interviews were conducted. Disclosure of the full report, including the job titles of those interviewed and the personal opinions they expressed in their statements, is reasonably necessary to understanding how the investigation as a whole was handled.
43.
Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? We have considered this carefully. We have already found that disclosure of names is not necessary, so we are considering disclosure of job titles and expressions of opinion to the extent that this consists of personal data.
44.
The Commissioner says that disclosure of third party personal data would not have been within the reasonable expectation of the data subjects, given the content of the withheld information. The Health Board’s position, as explained to the Commissioner, is that the individuals would have expected their contributions to be kept limited to only those who need to know the information for the purposes of the investigation. The Health Board also says that disclosure could encourage him to contact the contributors, causing potential harassment, harm and distress. They refer to correspondence from the Appellant to members of the Freedom of Information team which alleged wrongdoing, undermined their integrity and used inappropriate language.
45.
We agree that the third parties involved in the investigation would not have a reasonable expectation that their names would be disclosed to the world at large under FOIA. They may also have had an expectation that the detail of their contributions would not be disclosed in this way.
46.
We have also considered the point made by the Health Board about possible harassment or distress. We discussed this with the Appellant at the hearing. He believes it refers to page C120 in the bundle, a letter he wrote to the Health Board’s Senior Corporate Information Officer on 10 May 2021 about the response to his Request. This letter does refer to breach of section 77 FOIA as a criminal offence, perverting the course of justice, and the addressee being liable to conviction for these offences. The letter is strongly worded in the way it sets out the Appellant’s understanding of the law. Nevertheless, we do not see this as an indication that the Appellant would have contacted witnesses identifiable from the report and caused them harm or distress. We note that this letter was sent after the Health Board had responded to the Request, so its contents cannot have been used to inform the initial response. We also note that the Appellant has since seen the full report with only names redacted, and there is no indication that he has attempted to contact any of those individuals (who he would have been able to identify himself from context and job titles).
47.
We have balanced the privacy rights of the individuals against the strength of the legitimate interests in disclosure. The prejudice to privacy rights can be limited by withholding names. Although some individuals may still be identifiable from job titles and/or the context of their statements, we find that this is a more limited infringement of privacy rights. The legitimate interests in disclosure are particularly strong in this case, because the report deals with issues of patient safety in the context of the COVID-19 pandemic which are of great public interest. The Appellant has alleged possible wrongdoing. The information we have seen indicates a mismatch between the conclusions of the report which relate to patient safety and the HR focus of the witness interviews. The ongoing public inquiry into the UK’s handling of the pandemic shows the great importance of this issue, and the ongoing relevance of disclosure so that lessons can be learned. We therefore find that infringement of privacy rights involved in disclosure of job titles and expressions of opinion does not override the legitimate interests in disclosure.
48.
We have also considered whether disclosure would contravene the other data protection principles in Article 5(1)(a) GDPR of fairness and transparency. In relation to fairness, the reasonable expectations of the individuals are relevant. As already noted, we accept they would not have had a reasonable expectation that their names would be disclosed under FOIA. It is less clear what their expectations would be in relation to job titles and expressions of opinion. The individuals would have been aware that they were participating in an investigation relating to patient safety. As registered professionals with the Health and Care Professions Council they were under a duty to cooperate with an investigation conducted by their employer (under the Standards of Conduct Ethics and Performance). They would have been aware that they worked for a public authority that was subject to FOIA, and so aware that the information that they provided during such an investigation might be disclosed. We have rejected the Health Board’s argument that disclosure might lead to harm or distress due to harassment by the Appellant. We therefore find that disclosure would not contravene the principle of fairness. Similarly, we find that it would not contravene the principle of transparency. We do not have any direct evidence of what the individuals were told about the purposes of the investigation report, but again they would have been aware that they were under a duty to cooperate with the investigation in the context of a public authority that is subject to FOIA.
49.
We therefore find that the Health Board was entitled to withhold individual names under section 40(2) FOIA, but not job titles and expressions of opinion even if these consist of personal data.
Does section 41 FOIA (information provided in confidence) apply to allow the Health Board to withhold the remainder of the withheld information?
50.
Both the Commissioner’s response and the table provided by the Health Board indicate that this exemption was relied on to withhold the summaries of interviews held with staff members (contained in the main report conclusions) and the full interview statements.
51.
The Commissioner’s Decision Notice suggests that this exemption could not be relied on because the information was generated internally. The Commissioner has now revised that position and says the exemption may cover documents generated by the public authority itself if the recorded information was provided by another person. He has provided examples of other First-tier Tribunal decisions which have found the exemption could apply to information provided by public authority employees during an internal investigation. We agree that the exemption can apply to personal judgments or opinions provided by employees during an investigation. The exemption would not apply to employees who disclose information in the course of their employment while acting in their capacity as an employee. On the facts of this case, it appears that the individuals who were interviewed were not providing information while acting solely in the course of their employment. They were providing personal statements including opinions as part of an investigation into patient safety, in accordance with their obligations as registered health professionals. We therefore find that section 41 is engaged by the information relating to interviews with staff members. We have gone on to consider the three elements of the test for breach of confidence.
52.
Does the information have the necessary quality of confidence? The Commissioner says that information will possess the necessary quality of confidence if it is more than trivial and not otherwise accessible. We are satisfied that the information in the staff interviews was not disclosed publicly at the time and there was no intention that it would be. The information is not trivial, as it relates to both patient safety and HR issues involving the Appellant. It is the type of information that the employer would normally treat as confidential.
53.
Was the information imparted in circumstances importing an obligation of confidence? The Appellant says the Health Board has failed to provide any evidence that staff were told the information they provided would be kept confidential. The Health Board relied on the introduction to each interview, which stated, “ IO reminded employee that the process was confidential and therefore should not be disclosed without authority ”. They have not provided any further evidence about what was said to the staff. The Commissioner says that this created an express obligation of confidence, based on this assurance given at the start of each interview. He also says that there was an implied obligation of confidence, given the importance of staff speaking candidly in the context of such an investigation.
54.
It is not clear that the interview statement provided would import an obligation of confidence on the Health Board to not disclose the information that was provided to the relevant staff. The statement is essentially a warning to the staff that they should keep the “process” confidential, not an assurance from the Health Board that they will keep the contents of the interview confidential. There is no clear statement that the staff members are giving their own interview in confidence. The Appellant has also made the point that the staff had an obligation to cooperate with the investigation, but we do not agree that this necessarily means the content of their statements cannot be confidential. We have looked at this in the context of the investigation as a whole. We find that this is a borderline issue. Looking at the context of interviews on sensitive issues of patient safety and HR matters, combined with the warning to staff that the process was confidential, we accept on balance that the information in the staff interviews was imparted in circumstances importing an obligation of confidence. We have therefore gone on to consider the final part of the test.
55.
Would disclosure under FOIA be an unauthorised use of that information to the detriment of the person communicating it? We agree with the Commissioner that disclosure of the confidential information would be to the detriment of the affected staff. Taking into account privacy rights under Article 8 of the European Convention on Human Rights (ECHR) and Human Rights Act 1998 , disclosure without consent would cause a loss of privacy. This would make disclosure an actionable breach of confidence at common law.
56.
The public interest in disclosure may constitute a defence to an action at common law for breach of confidence. We have therefore considered whether the public interest in disclosure outweighs the public interest in upholding the duty of confidence. We have considered the caselaw referred to by the Commissioner, and in particular the decision in HRH the Prince of Wales v Associated Newspapers Ltd [2006] Ch 57 . The test is “ whether, in all the circumstances, it is in the public interest that the duty of confidence should be breached .” This is a test of proportionality. It involves balancing Article 8 rights to privacy and the other interests inherent in the maintenance of confidentiality, against the public interest in disclosure.
57.
As submitted by the Commissioner, there is inherent weight in the public interest in maintaining confidences. In this particular case, there is public interest in maintaining confidentiality in whistleblowing interviews so that interviewees are able to speak frankly. Breach of confidence may cause others to speak less frankly in the future, although we note that in the context of this employer the staff were under a separate duty to cooperate with the investigation.
58.
The Commissioner says that the public interest in disclosure has been met by the disclosure of the findings of the report. He also says that there is no evidence of misconduct that would support a public interest defence to breach of confidence. The Health Board also maintained that the interviewed staff would succeed with legal action for breach of confidence. We disagree. For the reasons set out above, there is a very strong public interest in disclosure in this case. The focus and findings of the report do not appear to match with the focus and content of the witness interviews. This means that disclosure of the content of the witness interviews is critical to understanding the investigation as a whole. This is not a case where the information is simply of interest to the public. It is clearly in the public interest to have the best information possible about what was happening during the early stages of the COVID-19 pandemic, put in the context of patient safety, the public inquiry and the need to learn lessons for the future. We are not finding that there was any actual misconduct or wrongdoing by the Health Board. However, the mismatch between the report and the interviews means there is a strong public interest in disclosure of the full investigation. In all the circumstances, we find that the public interest in disclosure of the information in the witness interviews is sufficiently strong to provide a defence to an action for breach of confidence.
59.
We therefore find that disclosure under FOIA would not be an unauthorised use of the information. The Health Board was not entitled to rely on section 41 to withhold the information in the witness interviews.
Does section 38(1)(a) (health and safety) apply to allow the Health Board to withhold any of the withheld information?
60.
The Commissioner did not engage with the exemption as he took the view that all relevant information could be withheld under section 41. The Health Board’s position is that it withheld personal notes recorded by physiotherapy staff which reflect upon the Appellant and his behaviour. They say this was “ to protect both Mr Egan and its employees by prioritising their welfare, and not disclosing information which could result in impulsive decision making and behaviours that could cause harm to an individual’s mental or physical health ”. They say that the contents may be “upsetting” for the Appellant to read, and the contributors may feel “anxiety” surrounding the disclosure or any following action. The original response to the Appellant refers to causing all parties “distress” and impeding trust. The review outcome does not explain how disclosure would cause actual harm to health as opposed to distress.
61.
We do not find that these concerns meet the threshold of “would be likely to” endanger the physical or mental health of any individual. This requires actual endangerment to health, and distress is not to be equated with mental ill health. The Health Board may have been concerned about the Appellant’s reaction to seeing this information, but we find that this falls short of concern about actual endangerment to health. We therefore find that the Health Board was not entitled to rely on section 38(1)(a) to withhold any of the information.
Section 77 FOIA
62.
The Appellant complains that the Health Board has committed the offence under section 77 of altering, defacing, blocking, erasing, destroying or concealing information held by them, with the intention of preventing disclosure. He asks that the Commissioner be instructed to conduct a criminal investigation into this matter.
63.
The short answer is that this Tribunal does not have jurisdiction to deal with section 77 and/or instruct the Commissioner to conduct an investigation. Our role is limited to deciding whether the Decision Notice was in accordance with the law. Decision notices are decisions issued under Part IV of FOIA in relation to whether a public authority has dealt with a request for information in accordance with the requirements of Part I of FOIA (the general right of access). This does not include issues relating to a criminal offence under section 77. We also note that the fact that a public authority’s reliance on particular exemptions has not been upheld does not mean that this offence has been committed.
64.
We uphold the appeal and issue the Substitute Decision Notice set out at the start of this decision.
Hand-down hearing
65.
I held a short oral hearing with the Appellant and the Commissioner on 20 December 2023 instead of simply sending the decision in writing. This was to explain what would happen next. It was also due to comments made by the Appellant in his appeal document which had caused some concern about the effect of the decision on him. Further detail is contained in the closed annex to this decision which is not to be provided to the public.
Signed Judge Hazel Oliver Date: 20 December 2023
Correction
Pursuant to rule 40 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009/1976, on 11 January 2024 the Tribunal corrected an error in paragraph 3 of the reasons. An incorrect reference to how the Appellant had obtained the withheld information was removed.