First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal
General Regulatory Chamber
Information Rights

		Heard by: determination on the papers Heard on: 14 July 2023
		Decision Given On: 18 July 2023

Decision: The appeal is struck out pursuant to Rule 8(2)(a) as the Tribunal does not have jurisdiction in relation to these proceedings.

REASONS
1. The Respondent's strike-out application dated 7 April 2023 is allowed.
2. On 6 October 2021, the Appellants wrote to the Information Commissioner to request copies of correspondence generated in the course of investigating a particular data breach. The Information Commissioner withheld the requested information, relying upon s44 Freedom of Information Act 2000 ("FOIA").
3. On 3 August 2022, the Appellants made a fresh request for a copy of the information on which the Information Commissioner had relied in deciding that s44 FOIA prevented disclosure. The Information Commissioner responded on 26 August 2022, again relying on s44 FOIA to withhold the requested information – a position it upheld following an internal review.
4. A formal Decision Notice was issued on 9 January 2023 stating that the Information Commissioner was entitled to rely on s.44(1)(a) to withhold the requested information on the grounds that s132 Data Protection Act 2018 ("DPA") prohibited the disclosure of the withheld information and that there is no gateway on the facts of this case to allow for disclosure to be made with lawful authority.
5. Section 44(1)(a) FOIA provides as follows:

44 Prohibitions on disclosure

(1) Information is exempt information if its disclosure (otherwise than under this Act) by the public authority holding it—

(a) is prohibited by or under any enactment,

6. The enactment on with the Information Commissioner relies for the purposes of s44(1)(a) is s132 DPA, which provides as follows:

132 Confidentiality of information

(1) A person who is or has been the Commissioner, or a member of the Commissioner's staff or an agent of the Commissioner, must not disclose information which—

(a) has been obtained by, or provided to, the Commissioner in the course of, or for the purposes of, the discharging of the Commissioner's functions,

(b) relates to an identified or identifiable individual or business, and

(c) is not available to the public from other sources at the time of the disclosure and has not previously been available to the public from other sources,

unless the disclosure is made with lawful authority.

(2) For the purposes of subsection (1), a disclosure is made with lawful authority only if and to the extent that—

(a) the disclosure was made with the consent of the individual or of the person for the time being carrying on the business,

(b) the information was obtained or provided as described in subsection (1)(a) for the purpose of its being made available to the public (in whatever manner),

(c) the disclosure was made for the purposes of, and is necessary for, the discharge of one or more of the Commissioner's functions,

(d) . . .

(e) the disclosure was made for the purposes of criminal or civil proceedings, however arising, or

(f) having regard to the rights, freedoms and legitimate interests of any person, the disclosure was necessary in the public interest.

(3) It is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).

7. The Appellants grounds of appeal are that:

a. The Information Commissioner's Office have provided false and misleading information as an unamended template letter was sent to the Appellants. The Appellants submit there must exist underlying documents which should be disclosed in the public interest pursuant to s132(2)(f) DPA. Reference was made to the decision of the Court of Appeal in Hyde Park Residences v Yelland [2000] EWCA Civ 37 at [75].

b. The refusal of the Information Commissioner to disclose information has had an adverse impact on the Appellants, as it relates to hackers obtaining the medical records of Ms Burton's late father. The Appellants submit that there is a public interest in disclosure given the potential impact on all persons potentially or actually affected by the hack.

c. They are contemplating issuing a claim, and the Appellants need the information in order to consider the merits of their possible claim in order to comply with the requirements of the pre-action protocol. As such, the disclosure would be for the purposes of civil proceedings and fall within s132(2)(e).

8. It is not in dispute that the information for which the Appellants seek disclosure was obtained by the Information Commissioner in the course of undertaking an investigation of a data breach, and was therefore obtained in the course of carrying out his statutory functions. Section 132(1) DPA is therefore engaged.
9. Section 132(2)(e) DPA exempts disclosure made for the purposes of civil proceedings. At the moment, the Appellants are only contemplating civil proceedings, and I find that this paragraph is not engaged. However, if the Appellants obtained an order for pre-action disclosure, the paragraph would be engaged and the confidentiality obligation in s132(1) would be overridden by the court order.
10. Section 132(2)(f) DPA gives the Information Commissioner limited discretion to disclose information, if disclosure is in the public interest (having taken account of the rights, freedoms and legitimate interests of any persons). In his response, the Information Commissioner has explained why he considers that disclosure under s132(2)(f) is not appropriate in this case. I agree with the Information Commissioner under s132(2)(f) are not appealable to this Tribunal. No jurisdiction is conferred by the DPA for the FTT to determine disputes relating to s132.
11. As s132(1) prohibits disclosure (and none of the qualifications in s132(2) apply), s44 FOIA provides for an absolute prohibition against disclosure under FOIA (see s2(3)(h) FOIA). Because this is an absolute prohibition, it is not subject to any public interest test.
12. I find that the decision of the Court of Appeal in Hyde Park Residences is irrelevant to the issues before this Tribunal. The Hyde Park case relates to photographs of the late Diana, Princess of Wales taken by a security camera on the day before her death and which were leaked to a newspaper by one of the plaintiff's employees for payment, without the plaintiff's consent. The question to be determined by the court related to the defence of fair dealing under s30(2), Copyright, Designs, and Patents Act 1981. The issues arising in a consideration of fair dealing under that Act are plainly irrelevant to the consideration of the public interest under FOIA and DPA.
13. The Appellants submit that there is an abuse of process, because the Information Commissioner filed its response late, and I was referred to the decision of the Court of Appeal in Home Department v Begum [2016] EWCA Civ 122. Whatever the merits of this submission, it does not detract from the legal principle that this Tribunal is a creature of statute and can only adjudicate on disputes that are allocated to it by statute. I have found that this Tribunal does not have jurisdiction in this appeal, and therefore it has no power to resolve this dispute, irrespective of whether the Information Commissioner filed its response late.
14. The Appellants also submit that there is an "overriding truthfulness" issue that needs to be addressed. Again, whatever the merits of this issue, it is not one within the jurisdiction of this Tribunal.
15. I was referred by the Appellants to the case of "Bedford v Paragon". No citation was given, and the only case with a similar name that I could find through an online search was that of Bedford v Paragon Asra Housing Ltd [2021] UKUT 266 (LC). This was an appeal to the Upper Tribunal (Lands Chamber) from a refusal by the FTT (Property Chamber) to strike-out the case. The issue in that appeal related to the fact that a remedy for breach of a covenant in a lease could be pursued either before the FTT or in the civil courts, and whether the existence of a remedy in the civil courts meant that it was an abuse of process to pursue a remedy before the FTT. Clearly the issues in that case have no bearing on the issues here.
16. The Information Commissioner referred me to the decision of the Upper Tribunal in OFCOM v Morrissey [2011] UKUT 116 (AAC) in support of his submission that this Tribunal has no jurisdiction in relation to his decisions under s132(2)(f). The Appellants submit that OFCOM can be distinguished, as in the circumstances of this appeal the Information Commissioner had already released some information. They submit that as the Information Commissioner is in breach of his obligations under s132(1), he can no longer rely on this s132(1). The fundamental problem with the Appellants' submission is that even if there was a breach of s132 by the Information Commissioner, the existence of that breach does not confer jurisdiction on this Tribunal.
17. As the Tribunal does not have jurisdiction in relation to these proceedings, Rule 8(2)(a) requires me to strike them out.
18.  I acknowledge that the Appellants have strong feelings about these issues, but the Tribunal may only act within its statutory powers.
NICHOLAS ALEKSANDER
TRIBUNAL JUDGE 14 July 2023