First-tier Tribunal (General Regulatory Chamber)

Neutral Citation Number: [2023] UKFTT 469 (GRC)

Appeal Number: EA/2022/0444

 First-Tier Tribunal

(General Regulatory Chamber)

Information Rights

 

Between:

 

 

Date of Hearing:  1^st June 2022.

Panel: Brian Kennedy KC, Emma Yates, and Kate Grimley Evans.

Hearing Type: Paper consideration.

Representation

For the Appellant: John Burke, as litigant in person.

For the Respondent: Helen Wrighton, Solicitor.

Result:  The Tribunal refuses the appeal

Date of Decision: 5 June 2023.

 

REASONS

                                                                                                                                   

Introduction:   

[1]         This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“the FOIA”). The appeal is against the decision of the Information Commissioner (“the Commissioner”) contained in a Decision Notice (“DN”) dated 8 December 2022 (reference IC-182402-J5M7), which is a matter of public record.

Factual Background to this Appeal:

[2]         Full details of the background to this appeal, the complainant’s request for information and the Commissioner’s decision are set out in the DN. The appeal concerns the decision of Sussex Police who refused the Appellant’s request relating to the identity of the person who asked the police to conduct a welfare check on his late wife.

 

[3]         The Commissioner found that Sussex Police were entitled to rely on section 40(2) to refuse the request. However, the Commissioner also found that Sussex Police had breached sections 10(1) and 17(1) of FOIA by failing to respond to the request within 20 working days. The Commissioner maintains the position set out in his DN; namely that Sussex Police were entitled to rely on section 40(2) to refuse the request. The Appellant now appeals against the DN. The Commissioner opposes the appeal and invites the Tribunal to dismiss the appeal. Both the Appellant and the Commissioner consent to this matter being dealt with on the papers.  

History and Chronology:

[4]         On 24 March 2022, the Appellant contacted Sussex Police in the following terms:

 

“…I require the name of whomsoever your force alleges recommended some time before or on 30 June 2021 that policemen attend for the supposed safety and wellbeing of my late wife, Jennifer Mary Burke,...

 

… I had already twice raised the matter in correspondence to Malling House. I suggest that the tardy Sussex Police is being bureaucratic and/or pettifogging and/or obfuscating. It wastes yet more of my unpaid time and postage plus what ratepayers are charged for the force’s overheads and salaries, while also impinging on time and effort for the prevention and detection of crime.

 

As things stand, the situation is like the anonymous denunciations under the loi de 22 Prairial during the French Revolution or the Nazi and Communist informers…”

 

 

 

 

[5]         On 12 July 2022, the Appellant complained to the Commissioner saying:

 

“…I have spent a full year trying to get Sussex Police to reveal who put them upto this by alleging that my wife’s safety and/or wellbeing were at risk … I confirmed in the fifth letter … that if the name of its informant were not forthcoming forthwith then I would have no option but to complain to your good self …

 

I am having to accuse the police of causing the premature death of Jennifer Mary Burke … there is still every reason to know who gave the disruptive and defamatory notification …”

 

[6]         On 22 September 2022, the Police refused to comply with the request relying on section 40(2).

 

[7]         On 3 October 2022, the Appellant requested an internal review.

 

[8]         On 11 October 2022, the Police upheld its earlier reliance on section 40(2) in its internal review.

 

[9]         On 17 October 2022, the Appellant made substantive representations to the Commissioner as to why the relevant name should not be withheld.

 

[10]         On 8 December 2022, the Commissioner issued the decision notice now under appeal in which he upheld the reliance by the Police on section 40(2).

 

[11]         The Appellant made brief submissions in his Notice of Appeal which were supplemented by letters dated 16 and 22 December 2022.

 

[12]         Legal Framework:

 

S1 FOIA - General right of access to information held by public authorities.

 

(1) Any person making a request for information to a public authority is entitled—

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

(2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.

(3) Where a public authority—

(a) reasonably requires further information in order to identify and locate the information requested, and

(b) has informed the applicant of that requirement,

the authority is not obliged to comply with subsection (1) unless it is supplied with that further information.

 

(4) The information—

(a) in respect of which the applicant is to be informed under subsection (1)(a), or

(b) which is to be communicated under subsection (1)(b);

 - is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.

(5) A public authority is to be taken to have complied with subsection (1)(a) in relation to any information if it has communicated the information to the applicant in accordance with subsection (1)(b).

(6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.

Section 40 FOIA provides that:

(1)  Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2)  Any information to which a request for information relates is also exempt information if—

(a)  it constitutes personal data which does not fall within subsection (1), and

(b)  the first, second or third condition below is satisfied.

(3A)  The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)  would contravene any of the data protection principles, or

(b)  would do so if the exemptions in section 24(1) of the Data Protection

Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B)  The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).

(4A) The third condition is that—

(a)  on a request under Article 15(1) of the GDPR (general processing:

right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b)  on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(5A)  The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).

(5B)  The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—

(a)  giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

(i)  would (apart from this Act) contravene any of the data

protection principles, or

(ii)  would do so if the exemptions in section 24(1) of the Data

Protection Act 2018 (manual unstructured data held by public

authorities) were disregarded;

(b)  giving a member of the public the confirmation or denial that would

have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);

(c)  on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);

(d)  on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(6) Omitted

(7) In this section—
“the data protection principles” means the principles set out in—

(a)  Article 5(1) of the GDPR, and

(b)  section 34(1) of the Data Protection Act 2018;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).

(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

(as amended by Schedule 19 of the Data Protection Act 2018)

Section 40(1) FOIA is an absolute exemption by virtue of s.2(3)(f) FOIA, and is therefore not subject to the public interest test under s.2(2)(b) FOIA.

Personal data is defined as “any information relating to an identified or identifiable living individual.” (s.3(2) Data Protection Act 2018 (“DPA”)), and the ‘processing’ of such information includes “disclosure by transmission, dissemination or otherwise making available” (s.3(4)(d) DPA), and therefore includes disclosure under FOIA.

The data protection principles referred to in s.40(3A)(1) FOIA are set out in Article 5(1) of the General Data Protection Regulations EU2016/679 (‘GDPR’), and s.34(1) DPA18 (the latter with regards to law enforcement processing) (s.40(7) FOIA). The first data protection principle under Article 5(1)(a) GDPR is that personal data shall be:

“processed lawfully, fairly and in a transparent manner in relation to the data subject”.

The information can therefore only be disclosed if to do so would be lawful (i.e. would meet one of the conditions of lawful processing listed in Article 6(1) GDPR), fair, and transparent.

Article 6(1) GDPR states that “…Processing shall be lawful only if and to the extent that at least one of the following [conditions] applies:..” The only potentially applicable condition in this case is condition 6(1)(f) GDPR which states that the processing:-

“…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, …”.

The Commissioner’s Decision Notice:

[13]         The Commissioner investigated the matter and held that Sussex Police were entitled to apply section 40(2) to withhold the requested information in this instance for the following reasons:

 

-       “Section 40(2) of FOIA says that information is exempt from disclosure if it is the personal data of another individual and disclosure would contravene a data protection principle.

 

-       The withheld information in this instance is the name of the person who asked Sussex Police to conduct the welfare check, which Sussex Police has confirmed it holds. The Commissioner is satisfied that the withheld information is the personal data of an identifiable individual (‘the data subject’) as defined in section 3(2) of the Data Protection Act 2018.

 

-       The most relevant data protection principle in this case is principle (a), which states:

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

-       In the case of an FOIA request, personal data is “processed” if it is disclosed in response to a request. This means that personal data may only be disclosed if to do so would be lawful (i.e. it would meet one of the conditions of lawful processing listed in Article 6(1) UK GDPR), fair and transparent.

 

-       The Commissioner considers that the lawful basis most applicable is basis 6(1)(f), which states:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

 

-       The Appellant has a legitimate interest in the requested information.

 

-       He wishes to know who told Sussex Police to check on his late wife, as he believes that the visit was not reasonable in the circumstances, and that the stress of it exacerbated her poor health, leading, unfortunately, to her premature death. The Appellant has said that he believes he knows the data subject’s identity and wants official confirmation of it. Disclosure of the data subject’s identity would assist him to pursue his concerns about this, across multiple agencies.

 

-       However, disclosure under FOIA is to the world at large. The Commissioner is of the view that data subjects have a clear and strong expectation that their personal data will be held in accordance with data protection laws. The Commissioner considers that the data subject in this case would have a reasonable expectation that their identity, as the person recommending a welfare check, would not be released to the world at large by means of an FOI request. The Commissioner considers that it would be an intrusion of privacy and could potentially cause unnecessary and unjustified distress to the individual.

 

-       Furthermore, while the Commissioner accepts that the Appellant is pursuing a legitimate interest, he does not consider that, in this case, disclosure of the withheld information is necessary to meet that legitimate interest. There are other formal channels through which the complainant could pursue his concerns, which would not necessitate the disclosure of the data subject’s identity to the world at large.

 

-       Having exhausted Sussex Police’s complaints mechanism, the Appellant may complain to the Independent Office for Police Conduct (‘the IOPC’). The IOPC is responsible for investigating “the most serious and sensitive incidents and allegations involving the police”. The Commissioner does not consider that any such complaint would be disadvantaged by the Appellant not having had access to the withheld information; he can make a complaint regardless of whether or not he knows the data subject’s name.

 

-       The Appellant may also invoke the complaints mechanism for the particular agency or public authority in which he believes the data subject works if he considers that their behaviour in making the welfare check request was unreasonable. He may also apply for a court order, requiring that the information be disclosed to him, it he wishes to take legal action.

 

-       The Commissioner considers these to be the appropriate avenues for the Appellant to pursue his concerns, rather than trying to access this information via FOIA, which, as stated above, involves the publication of information to the world at large; it is not a private disclosure to the requester alone.

 

-       The Commissioner considers that while the Appellant has a legitimate interest in the withheld information in this case, its disclosure is not necessary to meet that legitimate interest. The data subject has a strong expectation of privacy relating to the requested information and as disclosure is not necessary, the data subject’s consequent loss of privacy would be disproportionate and unwarranted.

 

-       The Commissioner has therefore determined that disclosure of the data subject’s personal data would be unlawful and in contravention of data protection principle (a), as set out under Article 5(1)(a) of the UK General Data Protection Regulation.

 

-       As disclosing the data subject’s personal data would be unlawful, section 40(2) is engaged. The Commissioner’s decision is therefore that the Constabulary was entitled to apply section 40(2) of FOIA to withhold the requested information.

The Grounds of Appeal:

[14]         The Appellant in his Grounds of Appeal disputed that the UK GDPR was the correct legislation to be applied… “…it is to do with statecraft rather than hospitals and policing … its priority is the proper electronic interchange across frontiers of intimate personal details…”. The Appellant considered the legislation to be “…immature…” and to embody conflicting principles which “…cannot be separated.….”.

 

[15]         The Appellant argued that the Commissioner’s decision notice is contrary to:

 

“Article 7 of the United Nations Declaration of Human Rights which “…says “all are equal before the law”, yet Sussex Police are invoking a rule to give my adversary the advantage of anonymity…”

 

Article 10 of the United Nations Declaration of Human Rights which “…says that everyone “is entitled in full equality to a fair and public hearing by an independent and impartial tribunal…”, but even the reviews so far have been biased in favour of my accuser, the one at fault, whose name is not to be in the so-called public domain….”

 

Article 5(3)(d) of the European Convention of Human Rights which “…requires that an accused person has the right “to examine or have examined witnesses against him”…”

 

Article 6 of the European Convention of Human Rights “…on the right to a fair trial makes it clear that “press and public may be excluded” only on stringently limited grounds. That means the public domain, but this is not even a Press enquiry. Yet here am I, an aggrieved victim and an individual rather than the public domain, who cannot be allowed to know the name of someone who may well have committed a criminal offence, and who has certainly committed a civil tort…

 

…I therefore put it to you that the Declaration and Convention, with their natural justice, override the resort to obfuscating technicalities….”

 

[16]         The Appellant contended that the information he is seeking is “…is no more than an accused person or defence counsel requires to know before any case comes before a criminal or civil Court or any other judicial tribunal.…”. Further, that “…Under section 86 of the Coroners and Justice Act of 2009 it is up to a court, not the police, to allow a witness anonymity, that is allowed in only cases of extreme violence or delicacy.….”.

 

[17]         The Appellant argued that not all informants can expect confidentiality and some witnesses are known even in criminal cases. The Appellant stated:

“…Sussex Police had already tried to argue that informants have an expectation of confidentiality, but did not challenge my rebuttal that this obviously did not apply to most complainants, even victims of sexual assaults, or witnesses for the prosecution or eyewitnesses reviewing an identity parade….”

 

[18]         The Appellant averred that the Commissioner’s decision sets “…a dangerous precedent … for police forces throughout Britain to invent witnesses for their own pleasure and purposes or to conceal real witnesses where the outcome has been equally disastrous. As we now all know, policemen of today are capable of anything….”.

 

[19]         The Appellant stated that: “…Ironically and tragically, the clumsy attendance for a so-called welfare check provoked the premature death of my wife whom the NHS had sent home days before as incurably but not terminally ill. To quote: “… she was expected to live for a number of months …”.

 

[20]         The Appellant contended that his request not only sought the name of the informant but also the actual wording of the informant’s complaint as well as the forename of the officer named “Robinson” but that the decision notice does not address the latter two issues.

 

[21]         The Appellant stated that the Police are only refusing to disclose the informant’s name “…because they belatedly realise that they were misinformed. Furthermore, the fact that the informant misled them, whether innocently or maliciously, is all the more reason to be identified so as to prevent a repetition of wasting police time, potentially contrary to section 5(2) of the Criminal Law Act 1967….”. Further, that the Commissioner’s DN “…lays Sussex Police open to the accusation that it invented the witness as a tool for bullying us, since Sussex Police had reason to be annoyed with me for criticising the competence of five constables in another unrelated matter going back to 2015….”

The Commissioner’s Response:

[22]         The Commissioner maintained the position as outlined in the DN and resisted the appeal. The Commissioner submitted in relation to the UK GDPR assertion that it does not go to disturb the conclusion that section 40(2) of the FOIA and the data protection principles under the UK GDPR are the correct sections/regimes under which to consider whether the requested information in this instance can be properly disclosed. Further, the Commissioner contended that Articles within the Declaration and Convention insofar as they relate to receiving a fair trial are not relevant in this instance.

 

[23]         The Commissioner averred that any disclosure of personal data under the FOIA must be in accordance with the relevant data protection principles as this is the context in which the disclosure is set rather than, for example, in criminal or civil cases where different laws, rules and considerations apply.

 

[24]         The Commissioner maintained the position with regards to processing as set out in paragraphs 15 to 18 of his DN. The Commissioner added:

 

“…while the Appellant has a legitimate interest in the withheld information in this case, its disclosure is not necessary to meet that legitimate interest. The data subject has a strong expectation of privacy relating to the requested information and as disclosure is not necessary, the data subject’s consequent loss of privacy would be disproportionate and unwarranted.”

 

[25]         The Commissioner maintained that the DN is not a binding precedent, and each case is determined on its own merits. Further, the Commissioner reminded the Appellant that a legitimate interest alone is insufficient to demonstrate that disclosure of the requested information would be lawful on the data protection principles.

 

[26]         In relation to the Appellant seeking the name, working of complaint and forename of an officer named Robinson, the Commissioner argued that these matters are not within the scope of this appeal.

 

[27]         The Commissioner stated that it would not be lawful, in this instance, to disclose the name of individual who requested a welfare check irrespective of whether the subject of that check was found to be well and without complaint.

 

[28]         The Commissioner invited the Tribunal to uphold the DN and dismiss the appeal.

 

 

The Appellant’s Reply to the Commissioner’s Response:

[29]         The Appellant replied to the Commissioner on the 27^th of March 2023 with the following statements;

 

“Further to Private Eye’s complaint amid lobbying by the Crime Reporters’ Association that the police were seizing on data protection to conceal inconvenient matters, the Daily Mail of 25 March 2023 quotes Andrew Marsh

ahead of a meeting with … the Information Commissioner!

 

Henceforth, suspects on serious charges will be named.   What is good for the goose must be good for the gander.  My case is where an informant is alleged to be behind a needless welfare check that, ironically, hastened my shocked wife’s death - and the praiseworthy Information Commissioner did record that this was my accusation.   If there was an informant, she wasted police time and worse, so this is also a serious matter as, alternatively, would be invention by Sussex Police.

 

Should it be argued, that the COP/ICO concession applies only to journalists, well, I was writing for the Evening Standard back in 1961 when I made my first broadcast on the BBC German service (Parliamentarisch und Unparliamentarisch).   I hail from a writing family, and my father took me to the local county court - where I remember three cases vividly - when he was a reporter on the Willesden Chronicle about 74 years ago.”

 

The Tribunals’ Conclusions:

[30]         The Tribunal are satisfied that the withheld information is the personal data of an identifiable individual (‘the data subject’) as defined in section 3(2) of the Data Protection Act 2018 and while we too accept that the Appellant is pursuing a legitimate interest, we do not consider that, on the facts of this case, disclosure of the withheld information is necessary to meet that legitimate interest. There are other formal channels through which the appellant could pursue his concerns, which would not necessitate the disclosure of the data subject’s identity to the world at large.

[31]         The Tribunal accept that disclosure of the data subject’s personal data would be unlawful and in contravention of data protection principle (a), as set out under Article 5(1)(a) of the UK General Data Protection Regulation.

 

[32]         The Tribunal agree that disclosing the data subject’s personal data would be unlawful and that section 40(2) of the FOIA is engaged. We therefore agree with the Respondent’s decision that the Constabulary was entitled to apply section 40(2) of the FOIA (an absolute exemption) to withhold the requested information.

 

[33]         On considering the withheld information the Tribunal agree with the Commissioners assertion that section 40(2) of the FOIA and the data protection principles under the UK GDPR are the correct sections/regimes under which to consider whether the requested information in this instance can be properly disclosed. Further, we accept that the Commissioner properly contended that Articles within the Declaration and Convention, insofar as they relate to receiving a fair trial are not relevant in this instance.

 

[34]         The Tribunal acknowledge the observation of the Commissioner in the DN that having exhausted Sussex Police’s complaints mechanism, the Appellant could complain to the Independent Office for Police Conduct (‘the IOPC’). The IOPC is responsible for investigating “the most serious and sensitive incidents and allegations involving the police”. We agree that any such complaint would be disadvantaged by the Appellant not having had access to the withheld information but agree the Appellant can make a complaint regardless of whether he knows the data subject’s name.

 

[35]         We further acknowledge that the Appellant could invoke the complaints mechanism for the particular agency or public authority in which he believes the data subject works if he considers that their behaviour in making the welfare check request was unreasonable. It seems to us also that the Appellant could also apply for a court order, requiring that the information be disclosed to him, it he wishes to take legal action. The Tribunal agrees that these would be appropriate avenues for the Appellant to pursue his concerns, rather than trying to access this information via the FOIA which, critically and crucially, involves the publication of information to the world at large.

 

[36]         We further accept that other issues raised by the Appellant and identified by the Commissioner (See § 26 above) are not within the scope of this appeal. as indicated in the impugned DN.

 

[37]         The Tribunal accept and endorse the Commissioner’s assertion that the lawful basis most applicable herein s Article 6(1)(f),of GDPR which states:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”

[38]         The Tribunal have no doubt that the Commissioner has given careful consideration to all relevant and material factual information in the impugned DN and we are satisfied that the information could only be disclosed if to do so would be lawful (i.e. would meet one of the conditions of lawful processing listed in Article 6(1) GDPR), and is fair, and transparent. In all the circumstances we accept and endorse the Commissioners’ reasoning that the withheld information has been properly withheld and in accordance with the relevant Law pertaining to this appeal.

 

[39]         Accordingly, the Tribunal can find no error of Law in the impugned DN and we

must dismiss this appeal.

                                                                                                  

 

Brian Kennedy KC                                                                 5 June 2023.