First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

Appeal Reference:  EA/2022/0267

NCN: [2024] UKFTT 1005 (GRC)

Heard by CVP on 20 March 2024

 

Before

 

Judge ANTHONY SNELSON

TRIBUNAL MEMBER ANNE CHAFER

TRIBUNAL MEMBER PIETER DE WAAL

 

Between

 

JANNA linde

Appellant

and

 

THE INFORMATION COMMISSIONER

First Respondent

and

GOVERNING BODY OF THE UNIVERSITY OF EAST LONDON

Second Respondent

 

Decision

 

On hearing the Appellant in person and Ms M Mitchison, General Counsel, on behalf of the Second Respondent;

And on considering the written representations of the First Respondent and the other documents tabled by the parties;

 

The Tribunal unanimously allows the appeal in part and substitutes a Decision Notice in the following terms:

 

(1)                The Second Respondent was entitled to rely on FOIA, s40(2) (personal information) in relation to the Appellant's requests numbered [1] B4 and B7 but not otherwise.

(2)                Accordingly, not later than 28 days after the date of promulgation of this Decision Notice, the Second Respondent shall disclose to the Appellant the information sought by her requests numbered A5 and B5.

Reasons

 

Introduction

 

1.                  Among many others, the Second Respondent ('the University') offers courses in social work.

 

2.                  The Appellant, Ms Janna Linde, who describes herself as being of Eastern European descent, has experience of working with the University's social work students as a 'Practice Educator' ('PE'). First-year and final year students undertake placements with Placement Providers ('PPs') lasting 70 and 100 days respectively. During their placements they are each allocated to a PE, who may be 'on-site' at the PP or 'off-site'.  PE's may be assigned more than one student at a time. 

 

3.                  Ms Linde approached the University with a view to undertaking PE work in the academic year beginning in October 2021, but no offer was forthcoming. It appears that she suspected that discrimination based on her racial or national origins was in play.

 

4.                  On 20 October 2021 Ms Linde sent a request to the University for certain information pursuant to the Freedom of Information Act 2000 ('FOIA'). As already mentioned, the request was broken down into Part A (five elements) and Part B (seven elements).  Part A was concerned with selection of PPs and Part B with selection of PEs.

 

5.                  The University responded on 24 November 2021, providing some of the information requested but declining the remainder, citing FOIA, s40(2) (personal information).

 

6.                  Following an internal review, the University notified Ms Linde on 30 December 2021 that it maintained its position.

 

7.                  On 4 January 2022 Ms Linde complained to the First Respondent ('the Commissioner') about the way in which her request had been dealt with.  An investigation followed.

 

8.                  By a Decision Notice dated 14 September 2022 the Commissioner determined that the University had properly applied FOIA s40(2) to the disputed information.

 

9.                  By her undated Notice of Appeal Ms Linde challenged the Commissioner's decision on a number of grounds. Her central contention was that the information requested did not constitute third party personal data.

 

10.              An inordinate delay followed, apparently resulting from some insurmountable difficulty in delivering the notice of appeal to the Commissioner.

 

11.              By an exceedingly brief Response dated 8 April 2024 the Commissioner resisted the appeal on the ground that it brought no new point or issue to the proceedings.

 

12.              By an Order of Judge Hazel Oliver dated 10 August 2024 the University was joined as Second Respondent. The University resisted the appeal, although we do not appear to have been shown a formal response.

 

13.              The  appeal came before us in the form of a final hearing, held by CVP. Ms Linde attended, as did Ms Mitchison, the University's General Counsel. The Commissioner did not attend, preferring to rely on his written case.

 

The applicable law

 

The freedom of information legislation

 

14.              FOIA, s1 includes:

 

(1)       Any person making a request for information to a public authority is entitled–

 

(a)           to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b)          if that is the case, to have that information communicated to him.  

 

'Information' means information recorded in any form (s84).

 

15.              The general right under s1 is subject to a number of exemptions. By s40 it is provided, so far as material, as follows:  

 

(1)        Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

 

(2)           Any information to which a request for information relates is also exempt information if—

(a)           it constitutes personal data which  does not fall within subsection (1), and

(b)            the first, second or third  condition below is satisfied.

 

(3A)        The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)           would contravene any of the data protection principles ...

 

The language and concepts of the data protection legislation are translated into the section (subsection (7)). The exemptions under s40 are unqualified under FOIA and the familiar public interest balancing test has no application.  Rather, the reach of the exemptions is, in some circumstances, limited by the data protection regime.

 

The data protection legislation

 

16.              The data protection regime under the Data Protection Act 2018 ('DPA 2018') and GDPR applies to this case.      

 

17.              DPA 2018, s3 includes:

 

(2)        "Personal data" means any information relating to an identified or identifiable living individual ...

 

(3)        "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to —

(a)        an identifier such as a name, an identification number, location data or an online identifier ...

            

(4)        "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as —

...        

(d)        disclosure by transmission, dissemination or otherwise making available ...

 

(5)        "Data subject" means the identified or identifiable living individual to whom personal data relates.

 

18.              GDPR, Article 5 sets out the data protection principles. It includes:  

 

Personal data shall be:

1.                   processed lawfully, fairly and in a transparent manner in relation to the data subject ...

19.              Article 6, so far as material, provides:

 

1.                   Processing shall be lawful only if and to the extent that at least one of the following applies:

 

...

(f)             processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

 

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

 

The Tribunal's powers

 

20.              The appeal is brought pursuant to the FOIA, s57.  The Tribunal's powers in determining the appeal are delineated in s58 as follows: 

 

(1)    If on an appeal under section 57 the Tribunal consider -

                               

(a)           that the notice against which the appeal is brought is not in accordance with the law; or

(b)          to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

 

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.

 

(2)           On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

 

Case-law

 

21.              Unlike the general run of information rights cases, the starting-point for the purposes of s40 is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded.  At para 7 he commented:

 

In my opinion there is no presumption in favour of release of personal data under the general obligation that FOISA [2] lays out. The references which that Act makes to provisions of [the Data Protection Act] 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data ... 

 

22.              It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, 'necessary' means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be 'necessary' there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, 'necessity' is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing exercise, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.

 

23.              It is legitimate to consider at the outset the first part of (what is now) the Article 6 test (lawful processing), before addressing (if need be) the further elements of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20).

 

The Commissioner's Guidance

 

24.              In current Guidance on Requests for Personal Data about Public Authority Employees [3], the Commissioner states (p13):

 

The data protection exercise of balancing the rights and freedoms of the employees against the legitimate interest in disclosure is different to the public interest test that is required for the qualified exemptions listed in section 2(3) of FOIA.

 

In the FOI public interest test, there is an assumption in favour of disclosure because you must disclose the information unless the public interest in maintaining the exemption outweighs the public interest in disclosure.

 

In the case of section 40(2), the interaction with the DPA means the assumption is reversed and a justification is needed for disclosure.

 

Analysis and conclusions

 

25.              When the hearing began, the areas of contention were restricted to Requests A5 and B4, B5 and B7. However, following a useful exchange with the Tribunal, Ms Mitchison, rightly in our view, withdrew her resistance to the appeal in so far as it related to Requests A5 and B5. We agree with Ms Linde that there was no basis for the Commissioner's finding that disclosure of this information was liable to result in any individual's identity (or other personal data) being revealed. Accordingly, without objection from Ms Mitchison, we allow the appeal in relation to Requests A5 and B5, holding that the exemption under FOIA, s40(2) is not engaged. 

 

26.              As to Requests B4 and B7, we see the matter quite differently. B4 asks for the number of off-site PEs offering to take students in the year commencing October 2021 and the ethnicities of the students taken. B7 seeks the number of students allocated per off-site PE and the ethnicities of the PEs. Ms Linde's simple argument that neither request asks for the identities of the individuals concerned misses the point. It is common ground that the numbers are small. In our judgment it is very clear that disclosure of this disputed information  would enable the relevant  students and PEs to be identified and would thus  involve disclosure of their personal data. Accordingly, s40(2)(a) is satisfied.    

 

27.              Turning to s40(2)(b), it was not in question that the applicable data protection principle was that contained in GDPR, Article 5, para 1, read with Article 6, para 1(f). As we have noted, the duty of 'lawful' processing imports the requirement of 'necessity'. In our judgment, there is no question of the processing of the personal data of third parties being 'necessary' in relation to the B4 and B7 Requests. We have two main reasons for our view. In the first place, Ms Linde has (as she told us) already come into possession of all the information which she has sought, some through material supplied pursuant to her request, some through disclosure in Employment Tribunal ('ET') proceedings brought by her against the University. In the circumstances, we are satisfied that her legitimate interest in access to all information sought by her Requests for the purpose of inquiring into and testing the University's adherence to sound equality and diversity practices [4] has already been fully met notwithstanding the fact that she is constrained as to the use which she is free to make of the ET disclosure documents. The simple point is that the information has all been disclosed to her, one way or another. Secondly and in any event, we are satisfied that it could not possibly be said that any residual legitimate interest not yet satisfied could only be met by processing the personal data of third parties (see the Halpin case cited above). There is no need (meaning reasonable need) for any request in pursuit of Ms Linde's legitimate interest to trespass upon the privacy rights of third parties. Rightly, she did not so argue.   

 

28.              The statutory bias favouring privacy rights over information rights makes this a very clear case in relation to the B4 and B7 Requests. The processing of personal data for which the Appellant contends would plainly be unlawful. Accordingly, these requests are for information which is exempt and the Commissioner was right to dismiss the complaint in respect of them.

 

Disposal

 

29.              It follows that the appeal must be allowed to the extent stated, but otherwise dismissed. 

 

 

 

(Signed)        Anthony Snelson

 

Judge of the First-tier Tribunal

 

Dated: 1 November 2024

 

Promulgated: 6 November 2024