NCN: [2023] UKFTT 00207 (GRC)
Case Reference: EA/2022/0239
First-tier Tribunal
General Regulatory Chamber
Information Rights
Decided without a hearing
On: 2 February 2023
Decision given on: 24 February 2023
Before
TRIBUNAL JUDGE HAZEL OLIVER
TRIBUNAL MEMBER JO MURPHY
TRIBUNAL MEMBER ROSALIND TATAM
Between
MATTHEW ROBERT ILLSLEY
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The appeal is Dismissed
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated
21 July 2022 (IC-145737-T1N8, the “Decision Notice). The appeal relates to the application of the
Freedom of Information Act 2000 (“FOIA”). It concerns information about the name of an individual
in a document in closed file DEFE-24-1940-1_2 requested from the National Archives (“TNA”).
2. The parties opted for paper determination of the appeal. The Appellant initially requested a
hearing, but opted for a paper determination because the witness he had intended to call at the
hearing was not available to attend. The Commissioner considered that it would be appropriate for
the appeal to be decided on the papers and had consented to a paper hearing. The Tribunal is
satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
© CROWN COPYRIGHT 2022
3. On 28 July 2021, the Appellant wrote to TNA and requested the following information (the
“Request”):
“I wish to be given access to an unredacted copy – electronic and/or physical – of page 35 of
file DEFE-24-1940-1_2. The page itself is a lined, handwritten sheet beginning, ‘UFO Incident:
Saturday 4th August…”
4. The Request relates to a record held by TNA about an alleged UFO incident on 4 August 1990
(the Calvine incident). The redacted document is a handwritten record about an eyewitness account
and photographs taken of a “large diamond shaped UFO”. The document redacts the name of the
witness and of an RAF press officer. The document says that colour photographs were taken by an
eye witness, and were provided to the Scottish Daily Record and the RAF.
5. TNA responded on 3 September 2021 and withheld the information under section 40(2) FOIA,
personal data. The Appellant requested an internal review on 15 September, and clarified that he
was “now only seeking the name of the witness as shown on the handwritten sheet of page 35”.
TNA responded on 12 October 2021 and maintained its position.
6. The Appellant complained to the Commissioner on 13 December 2021. The Commissioner
decided that the requested information was personal data and TNA was entitled to rely on section
40(2) to withhold it:
a. The most applicable lawful basis for disclosure of the information was Article 6(1) GDPR,
the legitimate interest test.
b. There was a legitimate interest in disclosure of the information, and disclosure was
necessary because the name is not in the public domain and the file remains closed until
2076. The appellant also argued that there was a strong public interest in the
accountability of the Ministry of Defence regarding the Calvine incident.
c. The privacy rights of the individual overrode those legitimate interests, based on a
reasonable expectation that the information would not be disclosed and the likelihood
they would be contacted due to the public interest in the paranormal and UFOs.
The Appeal and Responses
7. The Appellant appealed on 17 August 2022. In summary, his grounds of appeal are:
a. The “100 year rule” limiting disclosure of personal information is unwarranted and
contrary to the notion of freedom of information.
b. The data subject would have a reasonable expectation that their name may be disclosed.
The individual had voluntarily contacted staff at the Daily Record, provided photographs,
and consented to be interviewed by its staff and the MoD’s press officer. The 30 year
rule applied at the time. There is no evidence that the individual required the information
to be kept confidential.
c. There is no evidence that others who have made more dramatic claims have been
subject to harassment or intrusion by the press. The Appellant simply wants to send the
individual a polite request to talk to him.
d. There are two individuals who allege the witness was intimidated by two MoD officers
after the incident. The potential value of the requested information to the public manifestly
outweighs the public interest in protecting the witness’s privacy.
2
e. There was an alternative basis for disclosure, Article 6(1)(e) GDPR (processing is
necessary for the performance of a task carried out in the public interest).
8. The Commissioner’s response maintains that the Decision Notice was correct. The
Commissioner notes that he can only apply the law as it stands, and that disclosure under FOIA is
disclosure to the world rather than for a specific purpose. The Commissioner also says that Article
6(1)(e) GDPR does not apply because it is limited to tasks or functions that have a clear basis in
law, and in any event cannot apply because disclosure under FOIA is to the world at large.
9. The Appellant submitted a detailed reply which we address in the discussion below.
Applicable law
10. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the
description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
2 Effect of the exemptions in Part II.
…….
(2) In respect of any information which is exempt information by virtue of any provision of
Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring absolute
exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exemption
outweighs the public interest in disclosing the information.
……..
40 Personal information.
(1) Any information to which a request for information relates is exempt information if it
constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act—
(a) would contravene any of the data protection principles
…….
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that
he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served
by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in
question was based.
3
11. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA.
12. The data protection principles are those set out in Article 5(1) of the UK General Data
Protection Regulation (“UK GDPR”), and section 34(1) DPA. The first data protection principle under
Article 5(1)(a) UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent
manner in relation to the data subject”. To be lawful, the processing must meet one of the conditions
for lawful processing listed in Article 6(1) UK GDPR. These include:
a. Where “the data subject has given consent to the processing of his or her personal data
for one or more specific purposes” (Article 6(1)(a).
b. Where “processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller” (Article 6(1)(e)).
c. Where “processing is necessary for the purposes of the legitimate interests pursued by
the controller or by a third party, except where such interests are overridden by the
interests or fundamental rights and freedoms of the data subject which require protection
of personal data, in particular where the data subject is a child.” (Article 6(1)(f)).
13. The balancing test under Article 6(1)(f) involves consideration of three questions (as set out by
Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by
the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
Issues and evidence
14. The main issue is whether TNA was entitled to withhold the requested information under
section 40(2) FOIA. There is no dispute that the name of the individual is personal data.
15. There is a dispute about whether Article 6(1)(f) UK GDPR applies to allow disclosure of the
information. The issues are:
a. Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
b. Is the processing involved necessary for the purposes of those interests?
c. Are these interests overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data? This is the key issue in
dispute.
16. The Appellant also says that Article 6(1)(e) UK GDPR potentially applies to allow disclosure of
the information.
4
17. By way of evidence we had an agreed bundle of open documents, and two additional
documents from the Appellant (a TNA document “Access to Public Records” from 1999, and minutes
from an Information Rights Tribunal User Group from 17 April 2013).
Discussion and Conclusions
14. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review any
finding of fact on which the notice in question was based. This means that we can review all of the
evidence provided to us and make our own decision.
15. General application of section 40(2) FOIA. The Appellant has made a general point that the
“100 year rule” is incorrect and/or should not be applied as a blanket rule. He has referred to earlier
documents which predate the DPA. These refer to the previous 30 year rule that was used for
release of public records and the need to show risk of damage or distress in order to withhold
personal information. If the Appellant is saying that all public records containing personal data
should not be automatically withheld for 100 years, he is correct. However, that is not how any 100
year rule has been applied in this case. The DPA covers personal data about living individuals.
Where it is not known whether a data subject is still alive, it is assumed that they are still alive until
they would have reached the age of 100. This 100 year calculation is simply used to decide whether
the DPA applies to an individual’s personal data at all. If the DPA does apply because the individual
is presumed to still be alive, it does not mean that the personal data should not be disclosed. It
simply means that the usual DPA tests must be used to ensure that any disclosure of personal
information about an individual is lawful.
16. Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests? The Commissioner found that there are legitimate interests in
disclosure of information (although the reasons for this in the Decision Notice are not particularly
clear). TNA has noted in its correspondence to the Commissioner that there is a distinction between
public curiosity and the public good. However, we accept that there are general public interests in
transparency and accountability, specifically in this case relating to the Ministry of Defence. The
Appellant refers to evidence from two unnamed individuals about alleged intimidation of the witness
by the Ministry of Defence. This adds to the weight of public interest in knowing the identity of the
witness so that there can be more transparency about the truth of these allegations. The Appellant
also has a personal interest in the information as he wishes to speak to the witness (if he is still alive)
as part of his historical research. We therefore find that legitimate interests would be pursued by
disclosure of the information under FOIA.
17. Is the processing involved necessary for the purposes of those interests? This is not
disputed by Commissioner. It appears that the individual’s identity is not easily available elsewhere,
and so disclosure under FOIA is reasonably necessary for the purposes of the legitimate interests.
18. Are these interests overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data? The Appellant challenges the
Commissioner’s decision on this point in a number of ways.
a. The Appellant says that other evidence has been destroyed, and so this is the only way
the matter can be investigated now. It does appear that the individual’s identity is not
available for other means. This does not mean that release of their name under FOIA is
5
the only way that this matter can be investigated, but we accept that it is one possible way
(depending on whether the individual is contactable and/or wishes to assist with an
investigation).
b. The Appellant says that this is non-sensitive data. That is correct. This is not special
category data which has additional safeguards under the DPA. However, it is still personal
data, and so the usual tests for fair and lawful processing apply. We are applying those
tests in this decision.
c. The Appellant says that there is no evidence that the individual wanted anonymity or
provided information to the Ministry of Defence in confidence. He points to TNA having
said there is no evidence of the individual seeking anonymity, serving notice to restrict
access to his personal data, or providing personal data in confidence. He is correct that
we have not seen any positive evidence of this. However, there is also no evidence that
the individual was happy for his name to be released publicly. It is very unclear from the
information we have whether the individual ever contacted the Ministry of Defence himself
or provided any information to them directly. According to the information the Appellant
has cited from the RAF Press Officer, now known to be Mr Craig Lindsay (A56 in the
bundle), Mr Lindsay alleges that he phoned the Daily Record to obtain the data subject’s
details and provided them to the Ministry of Defence. This suggests that the individual
had only contacted the Daily Record and had never provided his details directly to the
Ministry of Defence.
d. The Appellant also says that the individual voluntarily gave information to the press, and
this means he would expect to be contacted. We do not agree. It appears that the
individual provided photographs to the Daily Record, and these together with his contact
details were passed on to the RAF/Ministry of Defence. We do not know whether the
individual was aware of this or gave permission for this to happen. We also do not know
what the individual said to the Daily Record about publication of his identity – it seems his
name has never been published (and the newspaper did not publish his photographs or
any information about the incident), and we have no information about whether he wanted
publicity in the media or had asked for anonymity. We also note that expectations can
change over time. If the allegations about intimidation of the individual are in any way
true, or even if there was simply a discussion about the situation with representatives from
the Ministry of Defence, this would provide a reason for the individual to wish to remain
anonymous. We certainly have no evidence that this individual was expecting his name
to be published to the world at large in connection with the photographs.
e. The Appellant says that the individual would have an expectation of the 30 year rule
applying to his personal data, and that time has now passed. We note that these events
occurred before the latest version of the DPA and UK GDPR. Individuals’ expectations of
personal data privacy are shaped by the current law, which provides additional protection
for personal data under the UK GDPR as compared to the 1990s.
f. The Appellant says that no distress was caused to Mr Lindsay when he was contacted.
However, we find that this person is likely to have very different expectations from the data
subject in this case. He is a former RAF press officer, who would know what he was
dealing with in terms of publicity and was acting in a professional role. He seems to have
chosen to be interviewed and photographed by the press. This is very different from the
individual who took the original photographs.
6
g. The Appellant alleges that the individual was subject to criminal actions – intimidation by
Ministry of Defence officials, and theft of his photographs which were not returned. We
note that there is some evidence in the bundle that the photographs were returned to the
Daily Record (for example, in the redacted document itself at page 45 in the bundle). We
have dealt with the allegations of intimidation in our discussion about legitimate interests.
This adds weight to the legitimate interests in disclosure, but also adds weight to why the
individual may not want his name to be made public.
h. The Appellant says that there is no mention of the paranormal in the matter, and so the
Commissioner was incorrect to refer to this in the Decision Notice. He also says that a
stigma can’t be attached to taking photographs of UFOs. This relates to comments from
TNA which are set out in paragraph 47 of the Decision Notice, that public interest in the
paranormal and UFO’s creates likelihood that the individual would be contacted. We note
that this matter does not necessarily involve the “paranormal”, but it does involve a
photograph of a UFO. There is general public interest in sightings of UFOs, as shown by
the recent media reports in relation to the Calvine incident after Mr Lindsay was
interviewed. This is not a “stigma”, but does suggest there would be interest from the
press and others if this individual’s identity was revealed. It is also likely that this interest
would be enhanced by the allegations made by the unnamed individuals about
intimidation.
i. The Appellant makes the point that this individual is only one of thousands of already
named individuals in relation to UFO sightings. He says there have been no Press
Complaints Commission complaints about harassment following alleged UFO sightings,
or complaints from people whose names had been released. He also says that
withholding this individual’s name is inconsistent with treatment of similar files. Again, it
is important to remember that the rules about protection of personal data have changed
over time. We are applying the current law under the DPA and UK GDPR, which is very
different from the more limited protection of personal data which applied when names were
released in the past. We are making an assessment on the facts of this case. The fact
that names have been released in other cases does not mean that this name should be
released. We also note that the Appellant has described this as a “uniquely documented
and historically important case, centred on the man who took ‘the best UFO photograph
ever’”. This means there is likely to be more press and public interest in this individual
than in other cases.
19. We have considered the reasonable expectations of the individual in this particular case. We
do not know the basis on which he spoke to the Daily Record, whether he wished to remain
anonymous, and whether his wishes changed after speaking with the RAF/Ministry of Defence. We
note that this individual has never identified himself in the press, and has not done so even after the
press reports following the interview with Mr Lindsay. There is no indication that he wished or wishes
his name to be made public. We find it is likely that release of the individual’s name would cause
press and public interest, and lead to attempts to contact the individual. We also find that it is very
likely this would cause distress to an individual who was not expecting his name to be released in
this way. This would be particularly intrusive if combined with attempts to investigate serious
allegations such as alleged intimidation.
20. We have taken into account the legitimate interests in disclosure, as discussed above.
However, we find that these interests are overridden by the privacy rights of the data subject in this
7
case, taking into account his expectations of privacy and the likely consequences if his name were
to be released. We therefore find that disclosure of the redacted name under FOIA would breach
the data protection principles and would not be lawful under the UK GDPR. It is exempt from
disclosure under section 40(2) FOIA.
21. Does Article 6(1)(e) UK GDPR apply to allow disclosure of the information? We find that
Article 6(1)(e) does not apply here. We do not agree with the width of the Appellant’s interpretation
of this provision. More importantly, this provision would not allow disclosure to the world at large
under FOIA. At most it would allow disclosure to a particular person/body for a specific task. The
Appellant has asked for this information under the freedom of information regime. This means that
any disclosure must be to the world at large.
22. Other matters raised by the Appellant.
a. The Appellant has also suggested that we should require TNA to find out if the individual
is still alive and seek consent to disclosure. TNA is not required to do this under FOIA
and/or the DPA, and this Tribunal is not able to require them to do so.
b. The Appellant has also asked whether the Tribunal can make an order for privileged
disclosure just to him. We are unable to do this. As explained above, disclosure under
FOIA is to the world at large. Our role is limited to deciding whether the Commissioner’s
decision in relation to the application of FOIA was in accordance with the law.
c. Similarly, this Tribunal is also unable to send a request to the individual to ask whether he
wishes to speak to the Appellant.
23. We find that the Commissioner’s decision was in accordance with the law and TNA was entitled
to withhold the requested information under section 40(2) FOIA. We dismiss the appeal.
Signed Judge Hazel Oliver Date: 24 February 2023
8