UKFTT-GRC 2025 393 [2025] UKFTT 393 (GRC) InformationRights 1.8.0 bcb9656767ed4dc6e6ffb4c9956c10488eed6b1813894e259933ff7f627b9ae0 7.4.0
Neutral citation number: [2025] UKFTT 00393 (GRC)
Case Reference: EA/2023/0380
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard by CVP
Heard on: 20 March 2025
Decision given on: 15 May 2026
Before
TRIBUNAL JUDGE LIZ ORD
TRIBUNAL MEMBER MIRIAM SCOTT
TRIBUNAL MEMBER DR PHEBE MANN
Between
ALASTAIR LOGAN
Appellant
and
(1) THE INFORMATION COMMISSIONER
(2) THE HOME OFFICE
Respondents
Representation :
For the Appellant: Kate O’Raghallaigh (counsel)
For the Respondents: No attendance
Decision: The appeal is allowed in part.
Substituted Decision Notice :
1- The Home Office (HO) is not entitled to rely on section 31(1)(a)-(c) of the Freedom of Information Act 2000 (FOIA). In the alternative, the public interest in maintaining the exemption does not outweigh the public interest in disclosing the information.
2- The HO is not entitled to rely on section 40(2) or section 38(1) of FOIA save to the limited extent that it applies to personal data contained in the closed table submitted by the Home Office (HO) and identified by grey and green colour coding in a closed annex to our decision. (Four colours have been used in the table: red = “ordinary” disclosable data; yellow = special category disclosable data; grey = “ordinary” non-disclosable data; green = special category non-disclosable data.)
3- The HO is to provide a fresh response to the appellant’s request, not relying on section 31(1)(a)-(c) of FOIA and only relying on section 40(2) and section 38(1) to the limited extent set out in paragraph 2- above.
REASONS
Introduction
1.
References to sections within our reasons are to FOIA, unless otherwise stated.
2.
This is the continuation of the hearing held on 1 March 2024, which went part heard and determined that the Information Commissioner (IC) was incorrect to decide that section 31(1)(a)-(c) was engaged. The tribunal decided that section 31(1)(a)-(c) was not engaged and the public interest favoured disclosure.
3.
Apart from two documents, which are not considered here, the IC only dealt with the exemption under section 31(1), and did not go on to consider the exemptions under section 40(2) or section 38(1). This is because the HO confirmed to the IC that, apart from the two aforementioned documents, it was only relying on section 31(1). Nonetheless, in a table setting out the withheld information, it made reference to sections 40 and 38.
4.
At the tribunal hearing on 1 March 2024, the IC raised further concerns regarding these sections. The tribunal therefore allowed the parties time to make full submissions on sections 40(2) and 38(1), and also joined the HO as a party.
5.
The HO provided closed submissions accompanied by a table. However, unhelpfully they did not state the page numbers of the files where the data was to be found. Therefore, it was difficult for the tribunal to assess the data in context, although we were able to locate much of it using search facilities.
6.
The HO did not state which people are still alive and which are deceased, They did say that all, apart from one, are less than 100 years old. We have applied the lifespan assumption set down by The National Archives Guide to Archiving Personal Data, which recommends assuming a lifespan of 100 years for individuals when determining closure periods for personal data. Therefore, we have proceeded on the basis that any data subject under the age of 100 years is alive.
7.
The background to this matter is contained in the tribunal’s first decision sent to the parties on 11 June 2024 and will not be repeated here. However, as a reminder, we note that the requested files are:
BS 27/365 – Documents supplied by the Metropolitan Police: the Habershon Report (1975) on Provisional IRA campaign of bombings and shootings in London and the Home Counties, October 1974 – February 1975.
BS 27/366 – Documents supplied by the Metropolitan Police: the Habershon Report (1975) on Provisional IRA campaign of bombings and shootings in London and the Home Counties, October 1974 – February 1975; reports and appendices, documents 1-12.
BS 27/367 - Documents supplied by the Metropolitan Police: the Habershon Report (1975) on Provisional IRA campaign of bombings and shootings in London and the Home Counties, October 1974 – February 1975; appendices 8, 17, 18.
The Law
Section 40(2)
8.
Section 40(2) concerns personal data, which is defined under section 3(2) Data Protection Act 2018 (DPA) as “any information relating to an identified living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” ( section 3(4) (d) DPA), and therefore includes disclosure under FOIA.
9.
Under section 40(2), information is exempt if it is not the personal data of the requestor, and “the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles”(sub section (3 A)(a)). This is an absolute exemption under section 2(3)(fa).
10.
The data protection principles are set out in Articles to the GDPR.
11.
Article 5(1)(a) GDPR states that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”.
12.
Article 6(1) GDPR provides a list of conditions setting out what constitutes lawful processing. The condition most applicable to disclosure under FOIA is Article 6(1)(f) GDPR which provides:
“processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
13.
This requires a balancing exercise to which any public interest in the information will be relevant.
14.
Article 9(1) GDPR defines special category data and provides:
“Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited”.
15.
Special category data can only be processed if one of the conditions in Article 9(2) GDPR is met.
16.
The condition in Article 9(2)(e) is that “processing relates to personal data which are manifestly made public by the data subject”.
Section 38(1)
17.
Section 38(1) provides, so far as is relevant:
“Information is exempt information if its disclosure under this Act would, or would be likely to –
…
(b)
endanger the safety of any individual.”
Issues
With respect to section 40(2)
18.
The IC is clearly of the opinion that most of the withheld information is personal information. We agree, although there is a small amount of information, which may not be.
19.
With respect to the conditions in Article 9(2) GDPR, the IC is of the opinion that none of the conditions to enable disclosure are met. Whilst we agree that this is the case for most of the information, in our view, it does not apply to the confessions made by members of the Balcombe Street Active Service Unit (ASU), for which Article 9(2)(e) should be considered. In our judgment, this is the only condition which could apply and, even then, is restricted to the Balcombe Street ASU members who confessed.
20.
With respect to Article 6(1)(f) GDPR, the IC considers that the appellant has a legitimate interest and that disclosure is necessary to meet the legitimate interest in question. We agree and therefore, this is not an issue.
21.
Therefore, the issues for the tribunal are:
a.
Whether there is any information that is not personal information;
b.
Whether any information is Article 9(1) special category personal data;
c.
(i) Whilst the members of the Balcombe Street ASU, who confessed to the bombings, come under Article 9(1), the condition in Article 9(2)(e) may apply. Therefore, the issue is whether they manifestly made the information in their confession public?
If they did, it may be disclosable, subject to the issue at d. below.
If they did not, it will not be disclosable.
(ii)
For the rest of the personal information,
If it is Article 9(1) special category information, it will not be disclosable.
If it is not, the issue at d. below will be considered.
d.
Whether disclosure would be lawful in that the legitimate interests of the appellant in disclosing the information override the legitimate interest or fundamental rights and freedoms of the data subject (Article 6(1)(f).
With respect to section 38(1)
22.
Whilst the HO has relied on the higher threshold of “would”, we have also considered the lower test of “would be likely”.
23.
Therefore, the issue for the tribunal is:
a.
Whether disclosure of the information would, or would be likely to endanger the safety of any individual.
b.
If so, whether, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
Submissions
HO
24.
These were provided as a closed document.
IC
Section 40(2)
25.
For the reasons given by the HO in closed submissions, the IC accepts that the legitimate interest in disclosure is overridden by the interests of fundamental rights and freedoms of the data subjects.
Section 38(1)(b)
26.
For the reasons given by the HO in closed submissions, the IC agrees with the application of section 38(1)(b) to the information withheld under that section.
27.
The IC further agrees, for the reasons given by the HO in closed submissions, that the public interest in maintaining the exemption outweighs the public interest in disclosure of the information.
Appellant
28.
It comes down to a narrow issue of redaction.
29.
From a reading of the HO’s submission to the IC on 12 July 2022 (Open Bundle D359), it refers to some scattered information (D366), and to section 38(1) applying to some of the requested information (D367). It seems that the exemptions apply to limited material.
30.
The personal data was published in September 1975 nearly 50 years ago.
31.
The names of Police Officers were not anonymised at the time. For those who gave evidence in public, what they said could have been in the public domain. It is only in rare circumstance that the names of expert witnesses are anonymised in any proceedings. Informants may have been anonymised. As for lay witnesses, if they were not anonymised or in closed session, whilst their names may not prominently be in the public domain, they may not be controversial. Would their names engage the high predictive test of section 38 of putting them in danger?
32.
The exemptions do not extend to the convicted members of the Balcombe Street ASU who publicly confessed to the Woolwich and/or Guildford bombings.
33.
There is a legitimate interest in the disclosure of their names, as it will place the Habershon report in its full and proper context and permit the appellant to understand the extent of the links and between the activity of the Balcombe Street ASU and the phase 1 bombings. In the circumstances, disclosure of these names is necessary, and the public interest falls in favour of disclosure.
Discussion and conclusions
34.
We make reference in these conclusions to the closed table of data submitted by the HO, which should not be disclosed. We have considered the data in categories and colour coded them on the table.
Data for which s.40(2) is relied upon
35.
The names and aliases of Provisional IRA members or suspected members constitute special category personal data covered by Article 9(1) GDPR. Apart from the Balcombe Street ASU members who confessed to the bombings, they do not come under a condition for disclosure. Therefore, s40(2) is engaged and their names will not be disclosed. Colour code green.
36.
With respect to the Balcombe Street ASU members, their confession was manifestly public (evidence of confessions in open bundle A198). Therefore, the condition in Article 9(2)(e) applies and their names may be disclosed subject to whether it is lawful under Article 6(1)(f). In our judgment, the legitimate interests of the appellant outweigh those of the ASU members, thereby satisfying Article 6(1)(f). Therefore, section 40(2) is not engaged because none of the data protection principles are contravened. Accordingly, the names of the Balcombe Street ASU members and their aliases, will be disclosed. Colour code yellow.
37.
We turn to personal data concerning witnesses, workmen, hostages, victims of kidnapping/attempted murder, safe house occupants/tenants, people referenced in connection to a school, a special branch officer, vehicle registration/index numbers, a vehicle owner, a suspect. In our judgment, considering the balance in Article 6(1)(f), the legitimate interests of the data subjects in protecting their personal data override the legitimate interests of the appellant. Therefore, section 40(2) is engaged as disclosure would contravene a data principle. The personal data will not be disclosed. Colour code grey.
38.
As regards the owner of identified hotels, we were able to find some context within the closed bundle, which suggests he was 50 years of age at the time of the Habershon report in 1975. This would make him 100 years old now. Therefore, the presumption is that he is no longer living. Consequently, section 40(2) does not apply. His name and that of his hotels will be disclosed. Colour code red.
39.
Similarly, section 40(2) does not apply to the brigadier, for whom there was an obituary, and who will therefore be deceased. The fact that the family home was targeted does not detract from that. His name will be disclosed. Colour code red.
40.
With respect to the police constable, who was a victim of a shooting, we take the view that these details are highly likely to already be in the public domain. Therefore, undertaking the Article 6(1)(f) balancing exercise, the rights of the data subject in protecting his personal data do not override those of the appellant. Section 40(2) is not engaged. His name will be disclosed. Colour code red.
41.
We considered carefully the reference to handwritten names. The names we could find seemed to be first names only and did not appear as identifiable personal data. We were not assisted by the HO’s vague reference in the table. As we are not convinced that the notes contain identifiable personal data, we conclude that section 40(2) does not apply. The information will be released. Colour code red.
42.
On the other hand, we found information which matched the reference to handwritten notes and did contain personal identifiable information. Applying Article 6(1)(f). We concluded that the rights of the data subjects in protecting their personal data overrode those of the appellant. Therefore, section 40(2) is engaged. The personal data will not be disclosed. Colour code grey.
43.
The HO has identified a person over 100 years old and has conceded that this information is releasable. We agree. This information will be released. Colour code red.
44.
Fingerprint and medical evidence constitute special category personal data covered by Article 9(1) GDPR. It is non-disclosable. Colour code green.
Data for which s.38(1) is relied upon
45.
Section 38(1)(b) is relied upon for some of the personal data which we have concluded is covered by section 40(2) above and is not disclosable. We find that section 38(1)(b) applies to this data as disclosure would be likely to endanger the data subjects. Furthermore, the public interest in maintaining the exemption outweighs the public interest in disclosure of the information. For this additional reason the information is not to be disclosed.
46.
There is no information for which section 38(1) is relied upon without also relying upon section 40(2).
Signed Judge Liz Ord Date: 26 March 2025