First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

NCN: [2022] UKFTT 403 (GRC)

Appeal Reference:  EA/2022/0041

 

Decided without a hearing

On 29 September 2022

 

Before

 

Judge ANTHONY SNELSON

MS RAZ EDWARDS

MS SUSAN WOLF

 

 

 

Between

 

Decision

 

 

The unanimous decision of the Tribunal is that the appeal is dismissed.

 

 

Reasons

 

Introduction

 

1.                On 26 November 2020 Mr Edward Williams, the Appellant in these proceedings, wrote to the Avon & Somerset Constabulary (‘ASC’) referring to events on the night of 31 October/1 November 2020 when its officers shut down an illegal rave on the outskirts of Bristol and a member of the public, Ms J Andrew, sustained severe injuries to her leg as a consequence of being bitten by a police dog, requesting, pursuant to the Freedom of Information Act 2000 (‘FOIA’), information in these terms (numbering added and punctuation improved):

 

1. What is the name of the dog?

2. What is the name and number of the police dog handler?

3. Provide the dog's police records, notes etc.

4. Which officer gave order to attend with dogs, provide the order?

5. Provide dog handler’s dog handling training record, qualifications, etc.

6. State if dog handler or other officer gave dog command to bite victim and reasons.

7. Provide copy of report you are sending to the IOPC.

8. Provide your reasons for the dog attacking.

           

            We will refer to these as ‘request 1, ‘request 2’ and so on.

 

2.                ASC responded on 18 December 2020, refusing to provide the information and citing FOIA [1], ss30 (investigations and proceedings) and 40 (personal information).

 

3.                Mr Williams took issue with that response, but, in a letter of 30 December 2020 following an internal review, ASC stood by it, in addition citing s38 (health & safety). [2]

 

4.                On 30 December 2020, the very day of the internal review decision, Mr Williams complained to the Respondent (‘the Commissioner’) about the way in which his request for information had been handled. An investigation followed. 

 

5.                By a decision notice dated 8 February 2022 the Commissioner determined that:

 

·        As to requests 1, 2 and 5 and parts of request 3, ASC had correctly applied s40(2) and the information sought was exempt.

·        As to requests 6, 7 and 8, ASC had correctly applied s30(1)(a) and the public interest balancing test favoured maintaining the exemption.

·        As to request 4, ASC had correctly applied s30(1)(a) but had also correctly conceded that the public interest balance favoured disclosure.

·        As to the balance of request 3, ASC had not been entitled to apply the exemptions relied upon or any exemption.

·        Accordingly, ASC should disclose the information within the scope of request 3 subject to redaction of so much as was exempt under s40(2), and, without redaction, all the information sought by request 4.

 

6.                By a notice of appeal dated 8 February 2022, the Appellant challenged the Commissioner’s adjudication on all matters save for request 4. He argued that the appeal raised a simple point of police accountability and that there was a compelling case for disclosure of the identity of the handler of the dog which had committed the attack. (It seems that the officer’s name/number could not be discerned from the Youtube video which he exhibited.) He also stressed the seriousness of the injury which Ms Andrew had sustained.

 

7.                On 17 March 2022 ASC complied with the Commissioner’s decision of 8 February in relation to request 4 and voluntarily disclosed the information it held within the scope of requests 6 and 8. Accordingly, the ‘live’ dispute was restricted from then on to requests 1, 2, 3 (part only), 5 and 7.

 

8.                The Commissioner resisted the appeal in a response dated 28 March 2022, drafted by a member of his staff.  The document consists of a synopsis and commendation of the decision notice and an exceedingly brief critique of the notice of appeal. It contains no analysis of the relevant law. We cannot describe it as useful.

 

The Statutory Framework

 

The freedom of information legislation

 

9.                FOIA, s1 includes:

 

(1)       Any person making a request for information to a public authority is entitled–

 

(a)          to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b)         if that is the case, to have that information communicated to him.  

 

‘Information’ means information “recorded in any form” (s84).

 

10.            By s30 it is provided, relevantly, as follows:

 

(1)        Information held by a public authority is exempt information if it has at any time been held by the authority for the purposes of—

 

(a)       any investigation which the public authority has a duty to conduct with a view to it being ascertained—

(i)               whether a person should be charged with an offence, or

(ii)               whether a person charged with an offence is guilty of it,

(b)       any investigation which is conducted by the authority and in the circumstances may lead to a decision by the authority to institute criminal proceedings which the authority has power to conduct, or

(c)        any criminal proceedings which the authority has power to conduct.

 

This is a class-based exemption. It does not depend on a risk of any particular harm or prejudice being demonstrated.

 

11.            By s40 it is provided, so far as material, as follows:  

 

(1)       Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

 

(2)          Any information to which a request for information relates is also exempt information if—

(a)          it constitutes personal data which  does not fall within subsection (1), and

(b)          the first, second or third  condition below is satisfied.

 

(3A)       The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)          would contravene any of the data protection principles …

 

The language and concepts of the data protection legislation are translated into the section (subsection (7)). The exemptions under s40 are unqualified under FOIA and the familiar public interest balancing test has no application.  Rather, the reach of the exemptions is, in some circumstances, limited by the data protection regime.

 

The data protection legislation

 

12.            The data protection regime under the Data Protection Act 2018 (‘DPA 2018’) and the General Data Protection Regulation (‘GDPR’) applies to this case.      

 

13.            DPA 2018, s3 includes:

 

(2)       “Personal data” means any information relating to an identified or identifiable living individual ...

 

(3)      “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to —

(a)       an identifier such as a name, an identification number, location data or an online identifier …

           

(4)      “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as —

…       

(d)           disclosure by transmission, dissemination or otherwise making available …

 

(5)       “Data subject” means the identified or identifiable living individual to whom personal data relates.

 

14.            GDPR, Article 5 sets out the data protection principles. It includes:  

 

Personal data shall be:

1.                 processed lawfully, fairly and in a transparent manner in relation to the data subject …

15.            Article 6, so far as material, provides:

 

1.                 Processing shall be lawful only if and to the extent that at least one of the following applies:

 

(a)           the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

…

(f)            processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

 

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

 

The Tribunal’s powers

 

16.            The appeal is brought pursuant to the FOIA, s57.  The Tribunal’s powers in determining the appeal are delineated in s58 as follows: 

 

(1)    If on an appeal under section 57 the Tribunal consider -

                           

(a)          that the notice against which the appeal is brought is not in accordance with the law; or

(b)         to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

 

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.

 

(2)          On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

 

Authorities

 

17.            If a qualified exemption, such as any under s30, is shown to apply, determination of the disclosure request will turn on the public interest test under s2(1)(b), namely whether, “in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in maintaining the exemption”.  The proper approach, as explained by the Upper Tribunal in APPGER v IC [2013] UKUT 560 (para 149) is:

 

… to identify the actual harm or prejudice that the proposed disclosure would (or would be likely to or may) cause and the actual benefits its disclosure would (or would be likely to or may) confer or promote. This … requires an appropriately detailed identification, proof, explanation and examination of both (a) the harm or prejudice, and (b) benefits that the proposed disclosure would (or would be likely to or may) cause or promote.

 

18.            The relevant date for the purposes of applying any public interest balancing test and, it seems, determining the applicability of any exemption, is the date on which the request for information was refused, not the date of any subsequent review: see Montague v ICO and DIT [2022] UKUT 104 (AAC), especially at paras 47-90.

 

19.            The analysis under s40 is different to that applicable to s30. Here, the starting-point is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded.  At para 7 he commented:

 

In my opinion there is no presumption in favour of release of personal data under the general obligation that FOISA [3] lays out. The references which that Act makes to provisions of [the Data Protection Act] 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data … 

 

This statement of principle is of equal application today, notwithstanding the fact that the Data Protection Act 1998 has been superseded.

 

20.            In Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd & others [2017] EWCA Civ 121, Lewison LJ, giving the only substantial judgment on behalf of the Court of Appeal, remarked (para 62):

 

The expression "personal data" undoubtedly covers the name of a person …

 

21.            It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, ‘necessary’ means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing exercise, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.

 

22.            The Upper Tribunal has held (also under the pre-1998 data protection legislation) that it is legitimate to consider at the outset the first part of (what is now) the Article 6 test (lawful processing), before addressing (if need be) the further elements of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20).

 

 

The Tribunal’s powers

 

23.            The appeal is brought pursuant to the FOIA, s57.  The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

 

(3)    If on an appeal under section 57 the Tribunal consider -

                           

(c)          that the notice against which the appeal is brought is not in accordance with the law; or

(d)         to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

 

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.

 

(4)          On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

 

The Commissioner’s Guidance

 

24.            In current Guidance on Requests for Personal Data about Public Authority Employees [4], the Commissioner states (p13):

 

The data protection exercise of balancing the rights and freedoms of the employees against the legitimate interest in disclosure is different to the public interest test that is required for the qualified exemptions listed in section 2(3) of FOIA.

 

In the FOI public interest test, there is an assumption in favour of disclosure because you must disclose the information unless the public interest in maintaining the exemption outweighs the public interest in disclosure.

 

In the case of section 40(2), the interaction with the DPA means the assumption is reversed and a justification is needed for disclosure.

 

Analysis and Conclusions

 

Request 7 - s30(1)

 

25.            We interpret request 7 as seeking the document by which ASC referred the case to the Independent Office for Police Conduct (‘IOPC’).

 

26.            Having scrutinised the closed material, we are satisfied that a document within the scope of the request (as we interpret it) was within the possession of ASC at the time of the refusal. We are also satisfied that the information sought by the request was within the scope of the exemptions under s30(1)(a) and (b). It was directed to the events of the night of 31 October/1 November 2020 to which we have referred in our introduction and it is plain from the material before us that, at the time of the refusal (only some six weeks thereafter), a police investigation was underway directed, in large part if not entirely, to the question whether anyone had acted in breach of the criminal law and, if so, whether criminal proceedings were warranted. Accordingly, the class-based exemptions under s30(1)(a) and (b) are engaged.    

 

27.            This brings us to the public interest balancing test. On the present facts, application of the test presents us with no difficulty whatsoever. We are entirely clear that the public interest in maintaining the exemption comprehensively outweighs any small interest in disclosure. As at the date of the refusal, there was precious little if any public interest in disclosure of the document sought. It was not a ‘report’, but a referral made with a view to an investigation being carried out by the IOPC. In the nature of things, it could not be expected to contain a full account of what had happened at the rave or how Ms Andrew had suffered her injury. In any event, such account as it contained was that of ASC only and, if disclosed at the date of the refusal, could not have been expected to command public confidence as a comprehensive or disinterested record of events.

 

28.            In the balance against disclosure must be placed the obvious and powerful public interests in avoiding prejudicing law enforcement, the need to maintain the independence of judicial and prosecution processes and the need to preserve the criminal court as the sole forum for determining guilt. [5]  These interests fully justify protecting information of the sort which Mr Williams seeks, to allow the police, the Crown Prosecution Service and, where applicable, other relevant agencies the time and space they need to complete their investigations and take such decisions as fall to them. Of course, protection of this kind will not be unconditional or open-ended: passage of time, apparent inconsequentiality of the information in question and other considerations may strengthen the arguments in favour of disclosure in particular cases. But we find none of these factors in play here. To the contrary, it is plain and obvious to us that, leaving aside any other objection, request 7, raised less than two months after the complex event to which it relates, was manifestly premature and could only sensibly be met with the response which ASC provided. 

 

Requests 1, 2, 3 (part) and 5 - s40

 

29.            Here it is convenient to start by considering requests 1 and 2 and the part of request 3 which remains contentious. There is no room for any doubt that these are all requests for personal data of the dog handler. It is not in question that identification of the dog would inevitably reveal his or her handler. Likewise, identification of the dog’s records.

 

30.            We have wondered whether request 5 falls into a different category but have concluded that it does not. Publication of the handler’s records would be bound to identify him or her, at least to his or her peers.  

 

31.            Accordingly, unless processing would be fair and lawful under GDPR, Article 5, the exemption under s40(2) applies without more.

 

32.            In line with the Farrand case, we consider first the Article 6 question of lawful processing.  Was processing necessary (ie reasonably necessary) for the purposes of any legitimate interest pursued by the ASC or any third party? We agree with the Commissioner (DN, para 42) that there was and is a legitimate interest in public scrutiny of police conduct, particularly in circumstances where such conduct is associated with a serious injury to a member of the public. But we also agree with the Commissioner that, at the time of the refusal, disclosure was not at all necessary for the purpose of promoting that interest. On the contrary, it is hard to see how, at that point, the processing contended for could have served the interest in any material way, let alone in the least intrusive way. At the date of the refusal, the expectation was that the facts would be fully examined by the IPOC and that, dependent on its findings, an internal ASC investigation and/or disciplinary proceedings would follow. Those processes, which would be amenable in due course to FOIA requests in so far as the findings reached were not immediately placed in the public domain, were plainly an appropriate means of promoting the relevant interest and much less intrusive than the uncontextualised, premature disclosure of personal data sought by Mr Williams’s request.    

 

33.            Since it is clear and obvious to us that, at the time of the refusal, the disclosure contended for was not necessary, it follows without more that the exemption under s40(2) is engaged.

 

Disposal

 

34.            The appeal must be dismissed. 

 

35.            Finally, we pay tribute to the ASC for its refreshing willingness to reconsider its stance to FOIA requests and volunteer information initially refused. Many public authorities would do well to share that spirit.

 

 

 

(Signed)      Anthony Snelson

 

Judge of the First-tier Tribunal

 

Dated: 4 November 2022

Promulgated: 7 November 2022