England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM UPPER TRIBUNAL
(Administrative Appeals Chamber)
Upper Tribunal Judge Edward Jacobs
[2012] UKUT 464 (AAC)

		Royal Courts of Justice Strand, London, WC2A 2LL
		7th February 2014

Lord Justice Moses:

1. By a Decision Notice dated 26 May 2011 the Information Commissioner declined to order the disclosure of the names of three members of the staff of the Financial Services Authority in response to an information request by the appellant, Mr Edem. The First-Tier Tribunal decided that the names of the officials did not constitute personal data and ordered that they be disclosed. The Upper Tribunal (Administrative Appeals Chamber) reversed that decision on appeal. Mr Edem now appeals, in person, following the permission of the single judge.
2. The background to this appeal lies in Mr Edem's request on 30 December 2009 of the Financial Services Authority for a copy of all information that the Authority held about him and "my complaint that the FSA had failed to correctly regulate Egg PLC". The FSA refused to provide some information on the ground that it was Mr Edem's own data which he could access under the Data Protection Act 1998. Although Mr Edem still seemed concerned as to that application it was not the subject matter of this appeal. This appeal is concerned with the Financial Services Authority's refusal to provide information on the ground that it was the personal data of its junior employees.
3. Mr Edem complained to the Information Commissioner. Part of that complaint was upheld by the Commissioner in his notice of 26 May 2011. The Commissioner accepted that the complainant had a legitimate interest in information about the grade of staff who had handled his complaint. But the Commissioner continued:-

"[21] The Commissioner notes that while the staff in question worked on the complainant's complaint, they did not correspond with him about it. He also notes that the public authority has confirmed that they were not in public-facing roles and that these individuals were of a grade below that of manager. It is the Commissioner's view that these members of staff would have had no expectation that their names would be released into the public domain.

The Commissioner is also satisfied that disclosure of their names would not add anything further to the way in which the complainant's complaint had been dealt with. Therefore any legitimate interest in the disclosure of the names of these individuals is outweighed by the prejudice disclosure would cause to the rights and freedoms of the individuals concerned."

4. The issue in this appeal is whether disclosure of the names of three junior officials could be withheld on the grounds that it was personal data and that disclosure of that information would contravene the first principle of the Data Protection Act 1998. I should record that the name of a fourth official involved in the same way as the three others had been disclosed by mistake.
5. The legislative scheme is as follows. Section 40(2) of the Freedom of Information Act 2000 provides:-

"(2) Any information to which a request for information relates is also exempt information if –

(a) it constitutes personal data which do not fall within sub-section (1), and

(b) either the first or the second condition below is satisfied.

(3) The first condition is

(a) in a case where the information falls within any of paragraphs (a)-(d) of the definition of 'data' in s.1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of a public otherwise and under this Act would contravene –

(i) any of the data protection principles, or…"

6. The relevant principle is set out as the first data protection principle in Schedule 1 of the Data Protection Act 1998:-

"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –

(a) at least one of the three conditions in Schedule 2 is met…"

7. The only potentially relevant condition in Schedule 2 is Condition 6(1):

"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject."

8. Although Mr Edem contended that he required the names for the purpose of a legitimate interest he was pursuing, the essential question in this appeal was whether the names of the three employees were personal data. Section 1 of the Data Protection Act 1998 defines personal data as:-

"'Personal Data' means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

9. There is no dispute but that disclosure of the names would be "processing" within s.1 of the Data Protection Act 1998. Nor was there any dispute but that the names were data. Mr Edem had suggested that there was no evidence that the three individuals were living but the judge in the Upper Tribunal, Judge Jacobs, recorded that they were and there was no evidence to the contrary nor any foundation for appealing on that basis. Judge Jacobs concluded:-

"I've seen the name of officials and their names are not unique. But they can be identified from their names taken together with the contextual information of their grades and dates of employment. No one argued otherwise."

10. In this appeal Mr Edem challenged that finding, although he appeared not to have done so before Judge Jacobs. Mr Edem contended that it was not possible to identify the names of the officials from the e-mails relevant to the Financial Services Authority's enquiry in which their names appeared. It is unnecessary to set out all the e-mails which were enclosed in the open bundle in the appeal to the Upper Tribunal. I can give a flavour of them by reference to three:-

"From: [C]

Sent 25 June 2004 13-01

To: Paul Morris (Company Secretariat)

Subject: Egg

Paul

You left a message on my voicemail re Egg. Just to let you know that I have contacted Julian Adams and [D] who are responsible for Egg (I no longer look after it) to ask them to ring you.

Regards

[C]"

"From: Paul Morris (Company Secretariat)

Sent 09 July 2004 15:18

To: Ian Mason

Subject: New Stage 1 Complaint: Mr E Edem

Ian

This e-mail is to request whether [A] or Daniel Thornton will be available to act as an independent investigator for a new stage 1 complaint. The scope of the complaint does not include any allegation against Enforcement. This may not be a straightforward investigation…"

11. In an open witness statement dated 10 January 2012 to the First-Tier Tribunal Rosalind Leaphard of the Financial Services Authority says that an associate was the most junior level or grade of professional in the FSA. She said that associates in the supervision division, B, C and D, would not have had responsibility for making significant decisions in relation to the regulation of the firms assigned to their division. She said they would not have had an "outward-facing" role or acted as spokesperson for the FSA other than with the firms they were supervising and would not have responsibility for making decisions on FSA expenditure.
12. It seems to me beyond question that those living individuals could be identified from a combination of their names and the documents emanating from the Financial Services Authority which show that they were working there in the capacity described by Rosalind Leaphard.
13. There is ample authority in the Court of the Justice of the European Union that a person's name, in conjunction with job-related information, is their personal data. In Criminal Proceedings against Lindqvist (C-101/01, [2003] ECR 1-12971) the court stated:-

"The term personal data used in Article 3.1 of Directive 95/46 covers, according to the definition in Article 2(a) thereof, any information relating to an identified or identifiable natural person. The term undoubtedly covers the name of a person in conjunction with his telephone co-ordinates or information about his working condition or hobbies."

In Commission v Bavarian Lager (C-28/08 [2010] ECR 1-6055,) the Court states:-

"[68]. It should be noted that in paragraph 104 the judgment under appeal, the General Court, in examining Article 2(a) Regulation No. 45/2001, that is to say the definition of the concept of single 'personal data', correctly held that surnames and forenames may be regarded as personal data."

14. Mr Edem argued that since the employees were no longer working at the Financial Services Authority, which no longer existed, it would be impossible to find them, even if their names were disclosed. It would not be possible to identify them from names which were not unique merely because of the historic fact that they had worked for the Financial Services Authority in the past. This argument misunderstands the concept of an identifiable natural person. If a person might be identified by a combination of the name and the context in which it is used it is nothing to the point that it may be difficult to contact them. Personal data is data which relates to a living individual "who can be identified". That is a different concept from whether the person can in fact be contacted or traced. I reject Mr Edem's argument. To disclose the names of these three individuals would be to disclose their personal data.
15. It is, however, necessary to understand how any difficulty, in what appears to be so straightforward as case, arose. The difficulty emerged from the First-Tier Tribunal's deployment of what they seem to have regarded as principles to be derived from an earlier decision of this court in Durant v FSA [2003] EWCA Civ 1746, [2011] 1 Info LR 1. Auld LJ said:-

"[28] It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity. A recent example is that considered by the European Court in Criminal proceedings against Lindqvist, Case C-101/01 (6^th November 2003), in which the Court held, at para. 27, that "personal data" covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies."

Buxton LJ agreed with everything which "had fallen from my Lord" but added that:-

"The notions suggested by my Lord in his para. 28 will, with respect, provide a clear guide in borderline cases." [79]

16. The "two notions" to which Auld LJ referred were deployed by the First-Tier Tribunal. It stated:-

"[33] We have considered the 'two notions' put forward by Auld LJ. In our view, the Disputed Information is not biographical in any significant sense. The information does not go beyond the recording of the data subject's involvement in a matter that has no personal connotations. It simply concerns a transactional matter in which the individuals in question were involved. Those individuals are in no way the focus of the information. The focus is an investigation into the handling of the appellant's complaint to the FSA."

The First-Tier Tribunal continued:-

"[35] We do not suggest that information about where an individual worked at some point in the past, together with some indication of his role, can never be personal data. There are a number of organisations, the nature of whose activities are such that information that a particular individual was employed by them, might well amount to personal data. If, for example, an individual were employed by an organisation licensed to conduct experiments on animals, that fact may well amount to personal data. It may disclose something about his likely opinion on the often contentious subject of animal rights, and could lead to harassment by so-called animal rights activists. In such a case, a compelling argument could well be made that the information is biographical and does affect the privacy of the individual concerned. That, however, is not the position in the present case."

17. The First-Tier Tribunal were wrong to apply Auld LJ's "notions" in this case. There is no reason to do so. The information in this case was plainly concerned with those three individuals. Neither of Auld LJ's notions had any application and to seek to apply them runs contrary to the Statute, the Directive, and the jurisprudence of the Court of Justice, to which I have already referred. It is important not to misunderstand the context in which Auld LJ referred to those "notions".
18. Mr Durant, the appellant, had been unsuccessful in litigation against his former bank. The Financial Services Authority had subsequently investigated his complaint against the bank. Pursuant to s.7 of the Data Protection Act 1998, Mr Durant requested disclosure of his personal data held by the bank. The financial Services Authority disclosed some copies of documents relating to the appellant but had redacted those documents so as to remove information which it said did not amount to his personal data and so as to remove the names of another individual. The appeal turned on the meaning of "data which relate to a living individual who can be identified". There was no dispute that Mr Durant's name could be found in the documents but Mr Durant was seeking disclosure of the documents in which he was mentioned on the ground that those documents related to his name. The submission made on Mr Durant's behalf by his counsel is recorded:-

"The question is the meaning of the words 'relate to' in the opening words of the definition, and in particular to what extent, if any, the information should have the data subject as its focus, or main focus. Ms Haughton, on behalf of Mr Durant, pitched Mr Durant's entitlement to information under s.7 in very broad terms, relying on what she described as the extremely wide and inclusive definition of 'personal data' in section 1(1). She suggested that it covered any information retrieved as a result of a search under his name, anything on file which had his name on it, or from which he could be identified, or from which it was possible to discern a connection with him. On that basis, she submitted that Mr Durant's letters of complaint to the FSA and the documentation they generated were his personal data because he was the source of the material."

19. The Court of Appeal rejected that contention. It held that the further information sought was not Mr Durant's personal data…:-

"[31] It is information about his complaints and the objects of them, Barclays Bank and the FSA respectively. His claim is a misguided attempt to use the machinery of the Act as a proxy for third party discovery with a view to litigation or further investigation, an exercise, moreover, seemingly unrestricted by considerations of relevance."

20. It can immediately be seen that the 'notions' were Auld LJ's explanation as to why the information and documents in which Mr Durant's name appeared were not personal data relating to him. In a case such as the instant appeal, questions of whether the information is biographical or sufficiently focussed upon a particular named individual are of no relevance whatever. They have nothing to do with the question whether disclosure of a person's name is disclosure of personal data. A name is personal data unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure.
21. The Information Commissioner's Office Data Protection Technical Guidance to assist in determining "what is personal data" accurately sets out the effects of the statutory scheme:-

"6. It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him."

22. In this case the three names referred to in the e-mails were obviously about those three individuals and no further enquiry was needed. Judge Jacobs was right to reject the approach of the First-Tier Tribunal which was wrong as a matter of law.
23. The Technical Guidance (paragraphs 58-62) sets out guidance on the circumstances in which personal data about public authority employees should or should not be disclosed. The refusal of the Financial Services Authority to disclose the names in this case properly followed that guidance.
24. For those reasons I reject Mr Edem's submissions that the Upper Tier Tribunal was in error. Both Judge Jacobs and the Information Commissioner were correct in declining to order disclosure of those names. The only other issue Mr Edem raised was whether he had some legitimate interest in disclosure of those names for the purposes of Condition 6. Judge Jacobs said:-

"[43] He has not, despite my clear advice at the hearing, made a case that processing is necessary in pursuit of a legitimate interest under Condition 6. I can see no argument that it is necessary in the circumstances of the case."

Mr Edem had been given further time to advance some legitimate interest to Judge Jacobs. He had failed to do so. He has not advanced any reason as to why Judge Jacobs was wrong. In those circumstances, there is no further issue to be determined in this appeal. I would uphold the decision of the Upper Tribunal for the reasons given by Judge Jacobs.

Lord Justice Beatson:

25. I agree.

Lord Justice Underhill:

26. I also agree.