First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

NCN: [2022] UKFTT 434 (GRC)

Appeal Reference:  EA/2022/0131

 

Decided without a hearing

On 17 November 2022

 

 

 

Before

 

Judge ANTHONY SNELSON

MRS ROSALIND TATHAM

MR STEVE SHAW

 

 

 

Between

 

SHAMIR ahmed ALI

Appellant

and

 

THE INFORMATION COMMISSIONER

Respondent

 

 

Decision

 

 

On considering the written representations of the parties and other documents tabled, the Tribunal unanimously dismisses the appeal.

 

 

Reasons

 

Introduction

 

1.                  On 25 April 2021 the Appellant was arrested by West Midlands Police (‘WMP’) as a result of an incident which occurred on that date. Criminal proceedings followed, which ultimately resulted in his acquittal.

 

2.                  On 13 February 2022, through ‘WhatDoTheyKnow?’ (‘WDTK’), an organisation which advises and supports individuals who wish to make freedom of information requests, the Appellant requested information from WMP pursuant to the Freedom of Information Act 2000 (‘FOIA’), in the following terms (‘the request’):

 

I would like a copy of the phone recording of the time I was unlawfully arrested during 25th April 2021. When they called the police why did they say I was the one who assaulted the paramedics'? The public servant in question who arrested was [redacted] who carried out no initial investigation.

 

3.                  WMP responded on 17 February 2022, citing FOIA, s40(5), declining to confirm or deny whether it held the requested information and adding:

 

… any information released as a result of a Freedom of Information request, in effect, is being released into the public domain. Therefore, it could subsequently be published or would have to be made available to any member of the public if it were requested…. The information that you have requested pertains to your own personal data, and that of third parties, and therefore it is exempt from disclosure… The Subject Access provisions of GDPR and the Data Protection Act give an individual the right to request a copy of any personal data held on them. However, to access this you will need to contact the West Midlands Police Civil Disclosure Unit at the following address: …

 

4.                  The Appellant challenged that response, but on 8 March 2022, following an internal review, WMP maintained its stance. 

 

5.                  The Appellant then complained to the Information Commissioner (‘the Commissioner’). An investigation followed.

 

6.                  By a decision notice dated 26 May 2022 the Commissioner determined that the WMP had been entitled to refuse to confirm or deny holding the information sought, for the reason it had given. The nub of the Commissioner’s reasoning is conveyed in the following paragraphs of the decision notice:

 

21. Given the wording of the request, and the context provided by the complainant, the Commissioner is satisfied that the requested information, if held, relates to the individual who was the subject of the call. He is further satisfied that the individual is identifiable from that information. The information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA.

 

…

 

24. In this case, the Commissioner is satisfied that disclosure, by way of confirmation or denial, would reveal whether or not the requester was the subject of a phone call in the context described in the request.

 

25. There is no right of access to an individual’s own personal data under FOIA. The information, if it were held, would be exempt from disclosure under section 40(1) and therefore, under section 40(5A), the public authority is not required to confirm or deny that they hold it.

 

7.                  By a notice of appeal dated 26 May 2022, the Appellant challenged the Commissioner’s adjudication.  His grounds are largely devoted to factual points about the incident of 25 April 2021 and related events which followed it, and his sense of grievance about what, he believes, the maker of the telephone call communicated to WMP. The grounds also include the suggestion that the Commissioner’s determination may have been in some way influenced by discrimination based on his identity as an “Asian Bangladeshi Muslim male.” Briefly addressing the legal basis for the decision notice, he added:

 

8. Furthermore I am not asking for personal data, where did I state in my initial request or any future comments that I require the full name of this person ?[1]

 

8.                  The appeal was resisted in a full and carefully reasoned response dated 11 August 2022 prepared by Ms Louisa Lansell, a solicitor and member of the Commissioner’s legal team.    

 

9.                  The matter came before us for consideration on paper, the parties being content for it to be determined without a hearing. We were satisfied that it was just and in keeping with the overriding objective[2] to proceed in that manner. 

 

The applicable law

 

The freedom of information legislation

 

10.              FOIA, s1 includes:

 

(1)       Any person making a request for information to a public authority is entitled–

 

(a)           to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b)          if that is the case, to have that information communicated to him.  

 

“Information” means information recorded in any form (s84).

 

11.              The general right under s1 is subject to a number of exemptions. By s40, it is provided, so far as material, as follows:

 

(1)       Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.  

 

…

 

(5A)    The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).

 

By s40(7), the definitions of “personal data” and “data subject” contained in the Data Protection Act 2018 (‘DPA 2018’) apply (see below).

 

12.              The exemption under s40(1) is unqualified and absolute (see s2(2) and (3)(f)), and the public interest test has no application. Where the subsection is engaged, Parliament has enacted that, for the purposes of any request under FOIA, the public interest in freedom of information must yield to the public interest in the protection of privacy.

 

13.              The purpose of s40(5A) is also clear: it is to relieve a data controller (the public authority) of the normal duty (under FOIA, s1(1)(a)) to confirm or deny possession of requested information by permitting a ‘neither confirm nor deny’ (‘NCND’) response where the information sought (if it exists at all, and if it does, if it is held by the data controller) constitutes personal data of the maker of the request. In such circumstances, the public authority’s right under s40(5A) to deliver a NCND response is, of necessity, also unqualified.

 

The data protection legislation

 

14.              The data protection regime applicable in this case is that provided for by the Data Protection Act 2018 (‘DPA 2018’) and the General Data Protection Regulation (25 May 2018).      

 

15.              DPA 2018, s3 includes:

 

(2)        “Personal data” means any information relating to an identified or identifiable living individual … 

 

(3)        “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to -

 

(a)            an identifier such as a name, an identification number, location data or an online identifier; or

(b)            one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

 

(5)        “Data subject” means the identified or identifiable individual to whom personal data relates.

 

The tribunal’s powers

 

16.              The appeal is brought pursuant to the FOIA, s57.  The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

 

(1)    If on an appeal under section 57 the Tribunal consider -

                               

(a)           that the notice against which the appeal is brought is not in accordance with the law; or

(b)          to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

 

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.

 

(2)           On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

 

Analysis and conclusions

 

17.              There is a very clear answer to this appeal. The central question under FOIA, s40(1) and (5A) is whether the information to which the request relates[3] is exempt information under s40(1) as constituting personal data of which the Appellant is the subject.  (The law in this area is confusing. We do not criticise the Appellant for his misunderstanding in thinking that the Commissioner’s decision was intended to protect data relating to the maker of the telephone call.) The question breaks down into two sub-questions, which we will take in turn.

 

18.              First, does the information relate to a living individual? The answer is yes. It relates to the Appellant, a living individual. 

 

19.              Second, is that individual identified or identifiable? Let it be assumed that he is not already identified. Is he identifiable? The Appellant could be forgiven for arguing that he is not. He might quite reasonably say that, in all probability, a transcript of the telephone conversation would contain no information likely to disclose his identity. But study of DPA 2018, s3(3)(b) shows that, for the purposes of data protection law, much less than, say, a name or a photograph may suffice to make a person “identifiable”. A reference to, say, one physical characteristic might be enough. Further and more fundamentally, it is a basic principle of FOIA jurisprudence that disclosure comprises both the information sought and the request to which it responds.  A recent reiteration of the point is to be found in the FTT decision in Naulls v The Information Commissioner and another EA/2018/0022, para 12 (the passage states the principle as part of a summary of the Commissioner’s argument but the decision as a whole must be read as accepting it).[4]  This means that, when asking if disclosure would make the data subject “identifiable”, one has to inquire whether release of the recording of the phone conversation, taken with the request, would identify the Appellant. The only possible answer to that question is that it would. The Appellant’s name was given in the request. It follows that disclosure would make him “identifiable” under DPA 2018, s3(3)(a) in any event.

 

20.              For all of these reasons, we conclude that, correctly applying FOIA, s40(5A), WMP was entitled to give a NCND response to the request and the Commissioner’s decision was right.

 

Disposal and postscript

 

21.              It follows that the appeal must be dismissed. 

 

22.              Having arrived at this outcome, we agree with the Commissioner that it is unnecessary to consider whether the request engaged third party privacy rights (see FOIA, s40(2)) and, if so, what consequences might flow from that. 

 

23.              Since the exemption under s40(1) is absolute and the law does not prescribe any public interest balancing test, it is not open to the Tribunal to take account of the obvious public interest in police officers behaving in a transparent manner and being answerable for their actions, or any other factor that might quite reasonably be thought to argue for disclosure in this case. This is because Parliament has chosen to give privacy rights ascendancy over information rights and has constructed the legal framework accordingly. But we would add two observations here. First, FOIA is not the only means by which citizens may seek to hold the police and other public bodies to account. Second, as WMP and the Commissioner have pointed out, the data protection regime may provide the Appellant with some, if not all, of the remedy he is looking for, through the medium of a (data) subject access request. 

 

24.              The Appellant’s suggestion of bias and even discrimination in the Commissioner’s decision was most regrettable. There was no possible ground for it.

 

25.              Finally, we wish to stress that, although we find no merit in this appeal, our decision implies no view about the events of 25 April 2021 and their consequences. We note the Appellant’s strong sense of grievance and we have proceeded on the assumption that his concerns are sincere and may well be justified. 

 

 

 

 

 

(Signed)        Anthony Snelson

 

Judge of the First-tier Tribunal

 

Dated: 28 November 2022

 

Promulgated: 29 November 2022