First-tier Tribunal (General Regulatory Chamber)

Neutral citation number: [2023] UKFTT 1021 (GRC)

 Case Reference: EA/2022/0318

First-tier Tribunal

General Regulatory Chamber

Information Rights

 

Heard on: 30 November 2023

Decision given on: 13 December 2023

 

Before

 

TRIBUNAL JUDGE HEALD

TRIBUNAL MEMBER PAUL TAYLOR

TRIBUNAL MEMBER EMMA YATES

 

Between

 

SEAN BURNS

Appellant

and

 

THE INFORMATION COMMISSIONER

 

Respondent

 

 

The appeal was decided without a hearing as agreed by the parties and allowed by the Tribunal by rule 32(1) of the Tribunal Procedure (First -Tier Tribunal) (General Regulatory Chamber) Rules 2009 ("2009 Rules")

 

Decision: The appeal is dismissed.

 

REASONS

 

1.      Sean Burns ("Mr Burns and/or the Appellant") appeals to the Tribunal by section 57 Freedom of Information Act 2000 ("FOIA").   The Appeal relates to a decision notice ("the Decision Notice") issued by the Information Commissioner ("the Commissioner ") on 22 September 2022. 

2.      The Appeal concerns Mr Burns, the Commissioner, the Charity Commission for Northern Ireland ("CCNI") and a former charity called Growth for Adolescents and Providing Support Northern Ireland ("GAPS NI").

3.      For the Appeal we had been provided with an open bundle containing amongst other things Mr Burns' request for information ("the Request"), the Decision Notice, his appeal documents and a response from the Commissioner dated 13 December 2022 ("the Commissioner's Response").   We also had a closed bundle by rule 14(6) 2009 Rules.  

McKee

4.      Relevant to the Appeal is the Decision of the Court of Appeal In Northern Ireland in four appeals handed down on 18 February 2020 known as Mckee & Hughes -v- The Charity Commission for Northern Ireland [2020] NICA 13. 

5.      In Mckee the appeal court concluded that the Charities Act (Northern Ireland) 2008 ("the 2008 Act") did not empower any members of staff of CCNI to exercise any of the Commission's statutory powers or to discharge any of its statutory duties or functions. It also found nothing to support the view that CCNI had an implied power to delegate.

6.      This outcome caused CCNI to reflect on the validity of its previous decision making including as regards GAPS NI. 

          The Request and Reply

7.      On 23 March 2020, after the Mckee decision, Mr Burns wrote to CCNI and made a request ("the Request") for information about the content of a report by CCNI into GAPS NI.  He asked:- 

 "The information I am specifically seeking is:

 

1. A copy of the commission's report into GAPS, if there is a public

version available.

 

2. Whether there are ongoing legal proceedings in respect of the

findings of the report."

 

8.      CCNI replied to the Request on the same day and informed Mr Burns that there were no on going legal proceedings and the report in question was not public. 

9.      Although there was further correspondence about the second part of this question it does not fall into the scope of the Appeal.

10.  On 28 September 2020 Mr Burns asked CCNI:- 

".. I remain unclear as to the outcomes relating to the findings of the

commission's report on the GAPS charity. Are you in a position to

summarise the findings and related outcomes?"

 

11.  On 26 October 2020 CCNI replied to Mr Burns withholding the information sought on the basis that although it was held they considered it to be exempt from release by section 36 (2)(c) FOIA.    This letter went on to explain the issues CCNI felt it faced as a result of Mckee:-

"The impact of the judgment means that decisions previously made by Commission staff were made ultra vires (outside the scope of their powers). The statutory decisions made in respect of the investigation into GAPS were all decisions made by Commission staff and as such are void decisions. This includes the decision to publish the statutory inquiry report, which was removed from the Commission's website following the ruling."

12.  On 2 November 2020 CCNI provided the outcome of its review of the public interest test.  They said in conclusion that:-

".... you are advised that the balance of public interest favours maintaining the exemption at this time. The requested information is not therefore being disclosed to you in accordance with section 36(2)(c) ....."

       Internal Review

13.  On 5 November 2020 Mr Burns asked for an internal review and on 1 December 2020 CCNI reported that the review had not resulted in any change of its position.

       The Complaint

14.   On 30 December 2020 Mr Burns complained about CCNI's response by section 50 FOIA.  The Complaint was "I disagree with the public body's refusal to provide the information I requested"   

15.  The detail added follows:-

"Hi, I made a FOI request (ref: FOI20200928A) to The Charity Commission for Northern Ireland for information about the report they produced on the GAPS charity. They refused my FOI request on the grounds that they had yet to determine a permanent solution to the issues raised by a High Court decision handed down 19/02/2020. However, the high court decision relates to the clarification powers, and the lack thereof, of staff members of the Charity Commission for Northern Ireland to issue reports. The same high court ruling reaffirms that the power lies with the commissioners to issue such reports. Thus it is my view that the commissioners have the power and have had sufficient time to review and re-issue the GAPS report in either its original or modified form. Not to do so in my view would  be a dereliction of their statutory duties."

16.   In the Complaint form Mr Burns added:-

"The NI charity commissioners have the power (as recognised by the high court ruling) to simply review and re-issue the GAPS report in either its original or modified form so that they can fulfil their statutory duties. They could then issue to me and/or to the public domain a summary of the main findings and the resulting outcomes of the GAPS report. To do nothing, as appears to be the current approach, would surely be a dereliction of their statutory duties."

 The Decision Notice

17.  It appears from the bundle that there was no meaningful progress in 2021.  In early 2022 the Commissioner's initial focus was to enquire into the Complaint on the basis of the section 36 FOIA position adopted by CCNI.    Subsequently the position changed from reliance on section 36 to section 40(2) FOIA. As regards this we noted paragraphs 12 and 13:-

"Although the Charity Commission's submission was primarily concerned with the application of section 36(2)(c), it stated that it considered section 40(2) also applied to the withheld information, it however provided no specific arguments to support this position.

Given the Commissioner's dual role as the regulator of data protection legislation, he has a responsibility to prevent personal data being inadvertently disclosed under FOIA, he asked the Charity Commission to provide its submission in regards to the application of section 40(2). It did not deal with CCNI's original section 36 (2)(c) FOIA response."

18.  On 22 September 2022 the Commissioner issued the Decision Notice.  It decided that CCNI was entitled to withhold the requested information by section 40(2) FOIA.    It said:-

"40. The Commissioner has therefore decided that the Charity Commission is entitled to withhold the requested information under section 40(2), by way of section 40(3A)(a)."

19.  The Decision Notice also made it clear that it was not dealing with CCNI's original section 36 FOIA position.

20.  The Commissioner concludes:-

"41. In light of this decision, the Commissioner has not considered the Charity Commission's application of section 36 to the same information".

      The Appeal

21.  Mr Burns commenced the Appeal from the Decision Notice on 20 October 2022. He said that the outcome he sought was:-

 

"At the heart of the issue is the suspicion that a Charity has behaved inappropriately and possibly criminally therefore the Commission must provide an adequate account as to how it has applied itself to the GAPS NI case from the beginning through to a successful conclusion. Also how, post the Court of appeal judgement, they have amended their processes to deal with the GAPS case and any other investigation it may undertake in future."

 

The Grounds of the Appeal are:-

 

 "For background the following is from the Charity Commission for N. Ireland website:

"The Charity Commission for Northern Ireland is the independent regulator of charities in

Northern Ireland, responsible for ensuring Northern Ireland has a dynamic and well governed charities sector in which the public can have confidence.

 

The stated aims of the Charity Commission for Northern Ireland include:

1. Public confidence: To increase public trust and confidence in charities.

2. Compliance: To promote compliance by charity trustees with their legal obligations in

exercising control and management of the administration of their charities.

3. Accountability: To enhance the accountability of charities to donors, beneficiaries and the public.

4. Delivery: To manage the Charity Commission for Northern Ireland as an effective and

efficient non departmental public body."

 

In pursuit of my enquiry the Charity Commission has fulfiled none of the above. It achieved this by taking an unreasonably narrow view of my request for information in relation to its GAPS NI report.

 

The commission states that as a result of the Court of Appeal judgment of February 20201 it was found that the decision, in respect of its GAPS NI report, was void. [2020] NICA 13 Judiciary NI

 

My enquiry included ".. I remain unclear as to the outcomes relating to the findings of the

commission's report on the GAPS charity. Are you in a position to summarise the findings and related outcomes?

 

The Commissions response fails to consider providing information about the outcomes post the Appeal Court decision. For example, what it did or did not decide to do in relation to the judgement? Did it take actions to review and correct the errors in its apprach to the production of the GAPS NI report? If not, why did it decide to take no further action? Did it take actions to ensure the errors were not repeated in any future investigations it would undertake (unrelated to GAPS NI)?

 

In not providing information on the above the Charity commission can hardly claim it is fulfilling items 1 to 4 above.

 

The main thrust of the Commission response argument confined itself to concerns relating to disclosure of personal information Section 40(2).

 

I have not requested specifics in terms of personal information, my request is only concerned with the Commission's performance in relation to exercising its statutory role as decribed above.

 

At the heart of the issue is the suspicion that a Charity has behaved inappropriately and possibly criminally and yet the Commission cannot provide an adequate response and account as to how it has applied itself to the GAPS NI case. The outcomes in general remain a mystery. Hence my appeal."

 

Procedure

22.  On 20 October 2022 Mr Burns lodged the Appeal and on 13 December 2022 the Commissioner's Response was provided.

23.  Directions were issued on 21 August 2023 and 19 October 2023.

The Relevant law

24.  FOIA provides that any person making a request for information to a public authority is entitled to be informed in writing if that information is held (section 1(1) (a) FOIA) and if that is the case to be provided with that information (section 1 (1) (b) FOIA).

 

25.  These entitlements are subject to exemptions which can be absolute by section 2(2)(a) FOIA or qualified i.e. subject to the public interest balancing test set out in section 2(2)(b) FOIA which is that "in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information."

 

26.  The Decision Notice refers to section 40(2) and section 40(3A)(a). The relevant parts of section 40 FOIA provide as follows:- 

(2) Any information to which a request for information relates is also exempt information if

(a)it constitutes personal data which does not fall within subsection (1), and

(b)the first, second or third condition below is satisfied.

 

(3A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)would contravene any of the data protection principles...

 

27.  Section 40(3A)(a) FOIA is an absolute exemption by section 2(3)(fa) FOIA.    Also for section 40 FOIA

·         "personal data" is defined by reference to the Data Protection Act 2018 ("DPA") as "any information relating to an identified or identifiable living individual (subject to subsection (14)(c))".

·         "processing"  includes "disclosure by transmission, dissemination or otherwise making available" and would thus include publication following a FOIA request.

28.  "Data protection principles" refers to Article 5(1) UK GDPR and section 34(1) DPA.    Article 5(1) provides that personal data shall be processed "lawfully, fairly and in a transparent manner in relation to the data subject..."

29.  Article 10 UK GDPR is also referred to in the Decision Notice.  This relates to criminality and provides:-

"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority."

30.  By section 11(2) DPA personal data relating to criminal convictions and offences  includes personal data relating to allegations of the commission of an offence by the data subject or proceedings for "an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings including sentencing."

31.  Section 10(5) DPA sets out that the requirements for the processing for Article 10 material by reference to parts 1, 2 or 3 of schedule 1 to the DPA. 

Role of the Tribunal

32.  The Tribunal's role in an appeal by section 57 FOIA is as set out in section 58.   This provides that:-

(1) If on an appeal under section 57 the Tribunal considers—

(a) that the notice against which the appeal is brought is not in accordance with the law, or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

       Summary of the position.

33.  The Commissioner in summary concludes in the Decision Notice that publication of the report requested would contravene the data protection principles.     

34.  The Commissioner says that having reviewed withheld material it is satisfied the information sought contains personal data to which Article 10 UK GDPR would apply.  At para 24-25 of the Decision Notice:-

"The summary provides that the Charity Commission opened a statutory inquiry into the charity and includes detail of the Charity Commission's findings following its investigation.  

The Commissioner notes that if the Charity Commission was to consider providing the summary, this would consist of information relating to the alleged misconduct, mismanagement and criminal activity by named individuals involved with the charity; any decisions that may have been taken as a result and any outcome of the investigation."

35.  The Decision Notice refers to the need for processing to be lawful, fair and transparent (Article 5(1)) and focuses on Article 10.  The Commissioner says, having reviewed withheld information, that the information requested does contain information that falls within Article 10.  It says this is because:-

"...the withheld information is concerned with allegations of criminal activity of named individuals."

36.  By reference to schedule 1 DPA the Commissioner asserts that the only basis for the Article 10 material to be processed would be if the data subject had consented (part 3 para 29) or the data subject had made the information public (part 3 para 32) but there was no evidence for either:-

37.  Mr Burns' appeal and grounds are set out above in this Decision.   Two themes emerged.  These were:-

·         that he confirmed he was not seeking "specifics in terms of personal information"

·         that he considered the Commissioner in its approach had taken too narrow a view of the scope of the Request which is disputed by the Commissioner.

38.   As regards scope we noted that:-

·         in the Request Mr Burns asked for "A copy of the commission's report into GAPS, if there is a public version available."

·         in the Complaint he says "it is my view that the commissioners have the power and have had sufficient time to review and re-issue the GAPS report in either its original or modified form."

·         but in the Appeal he takes a broader approach to the information he seeks.  He says:-

".... therefore the Commission must provide an adequate account as to how it has applied itself to the GAPS NI case from the beginning through to a successful conclusion. Also how, post the Court of appeal judgement, they have amended their processes to deal with the GAPS case and any other investigation it may undertake in future."

39.   He goes on in the grounds of the Appeal to say:-

 "The Commissions response fails to consider providing information about the outcomes post the Appeal Court decision. For example, what it did or did not decide to do in relation to the judgement? Did it take actions to review and correct the errors in its apprach to the production of the GAPS NI report? If not, why did it decide to take no further action? Did it take actions to ensure the errors were not repeated in any future investigations it would undertake (unrelated to GAPS NI)?"

The Closed Bundle

40.  We were provided with a closed bundle by rule 14(6) 2009 Rules.   From our review we concluded that the information requested does contain personal data and that Article 10 UK GDPR does apply to that material. 

      Decision

41.  Mr Burns made a request to CCNI to see a report about GAPS NI which had, until just before the Request was made, been publicly available.   It was withheld on the basis of an exemption by sections 40(2) and 40(3A)(a) FOIA.   The Commissioner in the Decision Notice supported that approach. 

42.  Mr Burns is concerned that the Commissioner, in the Decision Notice, took too narrow a view regarding the scope of the Request.  While a degree of flexibility can at times be adopted, in this case the information sought in the Request and dealt with in the Decision Notice was clearly an actual report. In our view the Appeal goes too far in seeing to ask broader questions about CCNI and what it or had not done for example in response to Mckee.

43.  Accordingly, our view is that the Commissioner took the correct approach in the Decision Notice to focus on the report referred to in the Request.

44.  Mr Burns says he does not seek specific personal data.  We have reviewed the report in the closed bundle.  This does in our view contain personal data and personal data to which Article 10 UK GDPR applies.  

45.  By Article 5(1) UK GDPR the processing of this personal data must be lawful, fair and transparent.  As the personal data is also subject to Article 10 it will only be lawfully processed if done so in accordance with some element of parts 1-3 of schedule 1 DPA. 

46.  We agree with the Commissioner that there is no evidence to support a conclusion that the data subject(s) has consented to disclosure or had themselves made the data public. 

47.  In the absence of any other part of schedule 1 DPA being said to apply our conclusion is that the provision of the information requested, containing Article 10 material, would not be in accordance with the data protection principles and thus not lawful as required by Article 5(1) UK GDPR. 

48.  Accordingly if follows that we agree that the exemption in sections 40(2) and 40(3A)(a)  FOIA was correctly applied to the Request.

49.  In our review of the Closed Bundle we considered whether, with redactions, the information sought could be provided.   It was our view that it was not practically  possible for CCNI to make redactions to ensure compliance with Article 10 UK GDPR and leave anything left to publish.

50.  We also considered the evidence that the report (the subject of the Request) had for a time been published on the CCNI website but taken down following McKee.   We recognised that as a result members of the public might already have the report.   Paragraph 10 of the Decision Notice says:-

"The Commission confirmed that it does not hold an available public version of the statutory report into GAPS NI and did not hold such at the time of the query as the report had previously been made public but had been removed from the Commission's website as a result of the Court of Appeal judgment of February 2020 which found the decision was void.  The report has not been made public since that point". 

51.  We noted that Mr Burns would not have needed to make a FOIA request for this information before Mckee was handed down because it would have been available on the CCNI website.  Indeed, had he done so CCNI may have refused to provide it by the exemption in section 21 FOIA.  

52.  We recognise that because of the prior publication some (even many) members of the public may have the information now sought by Mr Burns.  However, in our view, just because information sought had in the past been available does not of itself obviate the need for a public authority, dealing with a FOIA request, to apply the principles of processing personal data. 

53.  If processing personal data by publishing it "to the world" is not in accordance with the data protection principles the fact that it may previously have been published (perhaps erroneously published) does not on its own defeat the exemptions deployed.

54.  As the personal data is subject to Article 10 UK GDPR, but we find no basis from schedule 1 DPA to enable processing of it, we conclude that the Decision Notice was correct and that the exemption in sections 40(2) and 40(3A)(a) FOIA do apply to the information sought in the Request.

55.  In light of this conclusion we did not go on to consider the exemption originally claimed by section 36(2)(c) FOIA.

Decision

56.   For the reasons set out above the Appeal is dismissed. 

 

 

Signed Tribunal Judge Simon Heald

Date:  4th December 2023