First-tier Tribunal (General Regulatory Chamber)

Neutral Citation Number: [2023] UKFTT 298 (GRC)

 

Appeal Number: EA/2022/0264

 

First-Tier Tribunal

(General Regulatory Chamber)

Information Rights

 

Between:

Mr. Jeffery Leeks

Appellant:

And

 

The Information Commissioner

First Respondent:

Financial Ombudsman Service

Second Respondent

 

Date and type of Hearing: - Remote Hearing on the papers.

Panel: Brian Kennedy KC, Suzanne Cosgrave, and Stephen Shaw

Date of Decision:  6 March 2023.

Result: The Tribunal dismiss the Appeal.

 

 

 

 

 

REASONS

                                                                       

 

Introduction:

 

   [1]           This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“the FOIA”). The appeal is against the decision of the Information Commissioner (“the Commissioner”) contained in a Decision Notice (“DN”) dated 30 August 2022 (reference IC-148319-B6Y9), which is a matter of public record.

 

Factual Background to this Appeal:

 

   [2]           Full details of the background to this appeal and the Commissioner’s decision are set out in the DN and not repeated here, other than to state that, in brief, the appeal concerns a complaint made against the Financial Ombudsman Service (“the FOS”). The FOS provided some information, but withheld the remainder and relied upon section 40(2) of FOIA (third party personal data) in order to do so.

 

   [3]           The Commissioner is the regulator of the FOIA. The FOS is the public authority subject to the FOIA. The DN upheld that FOS has correctly relied upon s40(2) FOIA to withhold the number of employees in a team identifying as gay. The Commissioner submitted that the appeal be dismissed for the reasons outlined in the DN.

 

History and Chronology:

 

   [4]     The Commissioner understood that the Appellant has or had a complaint lodged with or against the FOS. The Commissioner was not privy to the details of the complaint.

 

 

   [5]     On 26 August 2021, as part of an email chain, the Appellant wrote to a particular individual at the FOS and requested information in the following terms:

 

“how many people in your team identified on application as gay”.

 

   [6]     On 9 September 2021 the Appellant added to his request asking, “how many people employed in the Financial Ombudsman Service identify as gay.”

 

   [7]     The FOIS responded to both requests on 21 September 2021. The FOS stated it was withholding the information relating to “how many people in your team identified on application as gay” because:

 

a.    The team consists of 6 investigators;

b.    disclosing the information requested would allow them to identified;

c.     personal data of others is withheld under s40(2) FOIA.

 

   [8]     The FOS provided the information requested on 9 September 2021 by providing the Appellant with a link to FOS’ publicly available diversity data, and a screen shot of that data, This included information about sexual orientation of FOS “people” categorised under three headings Heterosexual/straight, Lesbian, gay or bisexual and Other The FOS cautioned that whilst individuals have the opportunity to provide FOS their diversity data upon joining FOS, they are not under any obligation to do so.

 

   [9]     The Appellant requested an internal review on the same day, stating he interpreted FOS’ response a “homophobic response.”

 

[10]           The FOS communicated the internal review outcome on 29 December 2021. It upheld its original position.

 

[11]           On 30 August 2022, the Commissioner issued his decision that the FOS correctly relied upon section 40(2) of the FOIA 2000 to withhold the information requested by the Appellant. The Notice stated (among other things) that:

 

 

                                               i.     First, the Commissioner was satisfied that it would be possible for a motivated intruder to use both information in the public domain and insider knowledge to identify one or more individuals within the team of six people. Having done so, they would then be able to learn how those team members describe their sexuality. The information was therefore personal data.

                                              ii.     Secondly, the Commissioner further observed that information as to a person’s sexual orientation is special category data, and there was no lawful basis for disclosing that data to the world at large.

                                            iii.     Thirdly, the Commissioner concluded that the special category personal data in issue could not manifestly be said to have been made public.

 

[12]           On 20 September 2022, the Appellant issued a notice of appeal.

 

Relevant Law:

 

S1 FOIA General right of access to information held by public authorities.

 

(1)  Any person making a request for information to a public authority is entitled —

 

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

 

 

 

Section 40(2) of the FOIA 2000 provides:

 

Any information to which a request for information relates is also exempt information if:

(a)   It constitutes personal data which does not fall within subsection (1), and:

(b)   Either the first or second condition below is satisfied.

 

The first condition is set out in section 40(3A):

 

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)    would contravene any of the data protection principles, or

(b)    would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

 

The second condition is set out in section 40(3B):

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the UK GDPR (general processing: right to object to processing).

 

The third condition is set out in section 40(4A):

(4A) The third condition is that—

(a)   on a request under Article 15(1) of the [UK GDPR]4 (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b)   on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

 

Pursuant to the effect of sections 1(2), and 2(3)(fa), section 40(2) of the FOIA 2000 confers an absolute exemption from the general right of access to information held by public authorities, so far as the information relates to cases where the first condition referred to in that subsection is satisfied. In this appeal, the first condition applies.

 

As summarized by Cranston J in Department of Health v Information Commissioner [2011] EWHC 1430 (Admin) (at paras 14 and 16), the effect of section 40(2) is as follows:

14…Where the requester is asking for personal data about third parties, Section 40(2) applies. Its effect is that there is an absolute exemption if disclosure of the information to a member of the public otherwise than under FOIA would breach any of the data protection principles.

 

‘Personal data’ is defined by section 3 of the Data Protection Act 2018:

Section 3 of the Data Protection Act 2018 defines personal data:

…

(2)     'Personal data' means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3)     'Identifiable living individual' means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a)   an identifier such as a name, an identification number, location data or an online identifier, or

(b)   one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

 

There are special categories of data which are subject to more rigorous requirements. Those categories of data concern matter which are highly sensitive. Special categories of data include personal data revealing a person’s sexual orientation (Article 9(1) of the UK General Data Protection Regulation (“GDPR”)).

 

Recital 26 to the GDPR is material to the issues in this appeal, and provides as follows:

 

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. (Emphasis added)

 

Statistical data can, therefore, constitute personal data. If it is possible for the recipient of the statistical data to identify an individual, then the information would be personal data (Common Services Agency v Scottish Information Commissioner [2008] UKHL 47, at paras 26 to 27 and 44 per Lord Hope; Department of Health v Information Commissioner [2011] EWHC 1430 (Admin), at paras 51 to 52).

 

Commissioner’s Decision Notice:

[13]     The Commissioner inferred the Appellant’s  s50 complaint to the Commissioner focused on his dissatisfaction with FOS’s refusal to provide the requested information to the 26 August 2021 request of “how many people in your team identified on application as gay” and not the 9 September 2021 request as this was answered in full. The scope of the DN (and this appeal) is regarding the 26 August 2021 request only. The DN upheld that FOS has correctly relied upon s40(2) FOIA to withhold the number of employees in a team identifying as gay. The Commissioner submitted that the appeal be dismissed for the reasons outlined in the DN.

 

[14]           In summation, the Commissioner stated, as there is no lawful basis for the information to be disclosed, disclosure will therefore be unlawful. As the first data protection principle requires all personal data to be processed lawfully, disclosure under FOIA would thus breach one of the data protection principles. As its disclosure would breach one of the data protection principles, it follows that the information is exempt under section 40(2) of FOIA.

 

Appellant’s Grounds of Appeal:

 

[15]           The Appellant’s Grounds of Appeal (‘the Grounds’) are summarised as follows:

1.    The Appellant argued that the FOS made numerous and unacceptable reasons for  why they refused to provide the data requested;

 

2.    The Appellant stated that he asked for generic statistics which would not identify anyone, so the information requested cannot be personal data;

 

3.    The Appellant alleged that the FOS have discriminated against him;

 

 

4.    The Appellant referenced the delay in the FOS supplying its internal review.

 

The Commissioner’s Response:

 

[16]           The Commissioner resisted the appeal and relied on his DN for his findings. However, in response to the Appellant’s Grounds of Appeal, the Commissioner made the following contentions.

 

[17]           In their Response to Ground 1 of the appeal, the Commissioner believed that the FOS were correct in their refusal notice and internal review in explaining why the information was personal data and could not be disclosed under so 40(2) FOIA. The Commissioner could not see anything in their correspondence as being deemed ‘unacceptable reasons’ - the FOS have to comply with FOIA and have provided a valid reason not to disclose the information to the world at large.

[18]           Having identified the information requested as personal data, the Commissioner in the DN went on to explain that information about a person’s sex life or sexual orientation is special category personal data. This is a category of personal data which can only be disclosed if one of a small number of conditions apply. These conditions are that the data subjects had consented to their data being disclosed or if they had manifestly made the information public themselves. The Commissioner explained in the DN that the FOS had not sought the consent of the data subjects (although this was not necessary), and there was no evidence of consent. The Commissioner also decided that there was no evidence that the data subjects manifestly made the information public themselves thus neither condition applied. The Commissioner concluded his DN by stating there was thus no lawful basis on which the FOS could disclose the information under FOIA.

 

[19]           In response to Ground 2 of the appeal, the Commissioner noted the Appellant asked a staff member how many of their team identified as gay. His intention was to identify the sexuality of one or more individuals. Granted, the Appellant may or may not have known the size of the team when making his request, but the DN clearly explains how the personal data of one or more individuals from a small team of 6 could be disclosed if the information was released. The Appellant has not provided any evidence to dislodge this finding. The Commissioner stated ground 2 can be dismissed.

 

[20]           In response to Ground 3 of the appeal, the Commissioner explained the Appellant has outlined his grievance with FOS. However, his issue with the FOS which relates to his complaint with them is outside the scope of the Commissioner and Tribunal’s jurisdiction. Under s58 FOIA the Tribunal can only overturn the Commissioner’s DN if it is decided to be wrong in law. The  DN focuses on the FOS’s response to the Appellant’s request only, not the Appellant’s wider concerns with the FOS. This ground can thus be dismissed, according to the Commissioner.

 

[21]           In response to Ground 4 of the appeal, the Commissioner agreed that the FOS did delay in providing its internal review outcome. However, the Commissioner stated that this is not a ground that would affect the DN. . The Commissioner stated that a delay in responding to an internal review  is not a breach of FOIA, it is simply non-compliance with a non-enforceable Code of Practice. The Commissioner submitted this ground can therefore be dismissed.

 

 

The Second Respondent’s Submissions:

 

[22]           The FOS responded to the appeal on the 25^th November 2022. In response to grounds one and two the FOS argued, the provision of the information requested would, whatever the number is, enable a person who was motivated to identify one or more team members, and moreover, whether the team member identifies as gay or not. The means which are reasonably likely to be used to identify the natural person could include, for example, the use of internet searches, social media and the FOS’ website. The costs and time required for identification would plainly be minimal. Equally, if a person is already familiar with the team, then it would be even more straightforward to identify the team members, and their sexual orientation.

 

[23]           The FOS contended there is no error of law in the Commissioner’s decision. Further, that the Commissioner carefully considered whether the provision of statistical data would identify one or more individuals, and in accordance with the correct legal position, did not assume it would do so. Moreover, the Commissioner also made clear in his decision that the mere fact that the team size is small does not mean, in and of itself, that a team member would be identifiable, but it clearly makes it easier to identify one or more team members.

 

[24]           The FOS averred that the Commissioner’s analysis of the circumstances of the case was also plainly correct. The Commissioner was right to conclude that it would be possible for a motivated intruder to use both information in the public domain and insider knowledge to identify one or more individuals within the team.

 

[25]           In addition, the FOS argued that the Commissioner was correct to conclude that there would be no lawful basis for processing the special category personal data, as there was no consent, nor can  the information manifestly be said to have been made public. The Appellant has not advanced any basis (let alone any tenable basis) for impugning those conclusions. The FOS invited the Tribunal to dismiss these grounds.

 

[26]           In response to Ground 3 of the appeal, the FOS stated this ground makes unfounded allegations of discrimination which are wholly refuted by the FOS. However, and in any event, the allegations do not fall within the Commissioner’s, nor in turn, the Tribunal’s, jurisdiction. The FOS argued Ground 3 should respectfully be dismissed.

 

[27]           In response to Ground 4 of the appeal, the FOS contended that  this ground  is a reiteration of the Appellant’s complaint that the FOS delayed in carrying out its internal review. The Commissioner noted that, although there is no statutory time limit for completing an internal review, it is good practice to carry out an internal review within no more than 40 days. The Commissioner concluded that the three months taken by the FOS was ‘poor practice’. The Commissioner’s conclusion as to the FOS’ internal review process has no bearing at all on whether the FOS was entitled to rely on section 40(2), in refusing to provide the information requested by the Appellant on 26 August 2021. Ground 4 should respectfully be dismissed.

 

The Appellant’s Submissions:

 

[28]           The Appellant lodged a submission via email to the Tribunal on the 11^th December 2022. The Appellant argues that there were clear and notable delays at all stages in the FOS’ handling of the request. The Appellant contended that this data is in the public interest. The Appellant stated that two months had elapsed before his request was acknowledged. Further, that the assessor was obstructive in this instance. The Appellant referred to a parallel case in which he felt that evidence was missed. The Appellant reiterated that he felt the behaviour was obstructive.

Conclusions:

 

[29]           The Appellant makes comments in his Ground 1 of appeal about "numerous and unacceptable reasons for claiming  why they refuse the data requested".

 

[30]           The Tribunal find this is not supported by any evidence. The FOS, and then the Commissioner, in the DN, have each explained carefully, and with the necessary detail, the interaction of the rights of third parties under the DPA and the action of the FOIA. It is well recognised that the FOIA does not enable the provision of third-party personal data by the "back door" i.e., the release of personal information about individuals that would not be in compliance with the DPA. The Tribunal find both the Respondents to be correct in their interpretations, reasoning, and findings in this regard.

 

[31]           The decision by the Commissioner does not involve an exercise of his discretion as s40(2) is an absolute exemption and hence public interest considerations such as those put forward by the Appellant are not relevant.

 

Motivated Intruder:

 

[32]           In the Commissioner’s  Response (para 22, 1 November 2022) and the FOS's Response (para 22, 25 November 2022) both Respondents reference the ability of a motivated intruder to identify the individuals in the Investigator team. This is clearly the case as these individuals are public facing i.e., their names and roles are made available to the members of the public whose complaints they are dealing with. Therefore, the Tribunal accept the premise that the identity of the team members taken in conjunction with the statistics that Mr Leeks has requested could be combined to reveal special category data.

 

[33]           See in support the Recital 26 to the GDPR  (para 12 above)  and as  the authority provided by Common Services Agency v Scottish Information Commissioner [2008] UKHL 47 paras 26 - 27 and 44 in particular that “Statistical data can, therefore constitute personal data. If it is possible for the recipient of the statistical data to identify an individual then the information would be personal data.” (para 12 above).

Issues:

 

[34]           The Tribunal see the essential issue in this appeal being that, whilst the Appellant appears to be focused upon the number of gay people within the team, it is in fact any information in relation to a team member’s  sexual orientation (whether heterosexual/straight, Lesbian/gay or bisexual or Other - using the FOS’ categories) that is to be regarded as special category personal data for which there would need to be a clear lawful basis for it to be disclosed to the world at large.

 

[35]           Given, that in the absence of evidence of consent, or positive action indicating intent of such consent, by any of the team members to any such information being released to the world at large, the presumption must be any such information has been provided in confidence. Therefore, any possibility, however small, that it could be disclosed and/or revealed to the world at large in relation to an individual would need to be treated with utmost caution.

 

[36]           We agree with the Commissioner that with such a small team, any information about sexual orientation of some of the team could make it possible to discover the sexual orientation of other members of the team through putting together a range of sources of information. This is sometimes described as a “Mosaic” effect whereby pieces of information from various sources can be put together to reveal an identity. 

 

[37]           The same principle would apply if the FOS were to seek team member's consent to have their sexual orientation disclosed - any partial disclosure (e.g. which individuals are gay) could reveal by exception the sexual orientation  of others. It would be necessary therefore for the whole team to agree to disclosure. There is also no evidence whatsoever of this.

 

 

[38]           Similarly, we find the Public Interest Test is not relevant as the Exemption relied upon at s40(2) is an absolute exemption and not qualified by a Public Interest test.

 

[39]           The issue of any delay by the Public Authority herein is a matter of procedural non-compliance and not a matter to be considered in determining the substantive issues in this appeal.

 

[40]           Finally in relation to any allegations of obstructive conduct, or discrimination, by the Public Authority involved herein, the Tribunal find no evidence to support such allegations but again these are not substantive issues for our consideration and have no bearing on the outcome.

 

[41]           In all the circumstances as outlined above, and on the evidence before us, we do not find any error of Law in the DN, nor any error of Law in the exercise of any discretion by the Commissioner in the DN. Accordingly we must dismiss the appeal.

 

 

Brian Kennedy KC                                                                                 7 March 2023.

Promulgated: 16 March 2023