First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal
General Regulatory Chamber
Information Rights

		Decided without a hearing On: 26 July 2023
		Decision Given On: 03 August 2023

Decision: The appeal is Dismissed

REASONS

Background to Appeal

1. This appeal is against a decision of the Information Commissioner (the "Commissioner") dated 26 October 2022 (IC-149945-T8T0, the "Decision Notice). The appeal relates to the application of the Freedom of Information Act 2000 ("FOIA"). It concerns information about whether meetings took place requested from the Ministry of Justice (the "MOJ").
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. On 6 December 2021, the Appellant wrote to MOJ and requested the following information (the "Request"):

"… the information that you based your email and letter below on when you state:

To clarify, there is no record of meetings within the scope of your request, having taken place on the dates provided. Consequently, no recordings, minutes or notes are held".

4. The background to the Request is a series of HR issues the Appellant had with the MOJ, his employer. There had been an employment dispute involving the Appellant, and subsequent grievances against some of the Appellant's managers. The Appellant complains that a "secret" investigation was conducted into allegations against him at a senior level and this was reported to his union. He was provided with some information in response to a subject access request.
5. The Appellant had previously made a request on 9 November 2021 under FOIA in relation to two meetings (the "First Request"). He says that he was discussed during these meetings, and they also discussed advising his union about the "secret" investigation. This request was as follows:

"It is known that two Teams meetings took place on 30 April 2021 and 6 May 2021.

These meetings were hosted by [redacted]

Attending these meetings were [redacted]

Including any other person who may have attended any of these two meetings.

I would ask that the Teams recordings of both these meetings be provided, the minutes of the meeting and any notes, action plans that those attending may have made.

I understand that this type of information is considered "Recorded Information" by the ICO."

6. The MOJ responded on 6 December 2021 that they held no information within scope of this request. As well as sending the Request, on 6 December the Appellant sent an email to the MOJ expressing his disappointment at the reply to his original request. This email pointed out that meetings had been referred to in witness statements and other documents. On internal review the MOJ confirmed that there was a meeting on 29 April, and the only note of this meeting had been provided as part of the subject access request. The MOJ also stated that there was a meeting on 6 May, but there were no recordings, minutes or notes held in respect of him or his case as a result of that meeting.
7. The Request we are dealing with is for the information on which the MOJ based their response that they did not hold information within scope of the first request. The MOJ responded to the Request on 6 January 2022 and provided a set of information. They redacted a substantial amount of this information under section 40(2) FOIA (exemption for personal information).
8. The Appellant requested an internal review on 10 January 2022. The MOJ responded on 9 February 2022. They confirmed that details of a time and date had been deleted in error, but otherwise maintained that the redactions were either made under section 40(2) or because the information was not relevant to the Request.
9. The Appellant complained to the Commissioner on 11 January 2022. The Commissioner decided:

a. The withheld information was names and contact details of individuals who can be identified, and so personal data under section 40(2).

b. The Appellant has a legitimate interest in the information as it is associated with a grievance – but this has been met to an extent through the response to the subject access request, and disclosure to the world at large does not further serve this legitimate interest.

c. The individuals would have a reasonable expectation that their personal data would not be disclosed to the wider world in response to a FOIA request, and disclosure would be likely to cause them harm or distress.

d. There is insufficient legitimate interest to outweigh the data subjects' fundamental rights and freedoms, meaning disclosure would not be lawful and so the information is exempt under section 40(2).

The Appeal and Responses

10. The Appellant appealed on 18 November 2022. His grounds of appeal are:

a. The personal data withheld is too wide. The MOJ is misusing FOIA to avoid the embarrassment of senior civil servants who maintain that they did not attend meetings and no notes exist.

b. It is in the public interest that civil servants should be open and honest, they are held accountable for their actions, and personal embarrassment is not a reason to deny meetings took place or withhold minutes of those meetings.

c. If there is a compromise, only names and not positions should be withheld.

d. All meeting notes and emails should be provided by the MOJ as requested.

11. The Commissioner's response maintains that the Decision Notice was correct. The information could all be categorised as personal data, and the Tribunal can consider this in the closed bundle. The appeal ground asking for all meeting notes and emails relates to the first request, not the Request which is the subject of this appeal.

Applicable law

12. The relevant provisions of FOIA are as follows.

1 General right of access to information held by public authorities.

(1) Any person making a request for information to a public authority is entitled—

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

……

2 Effect of the exemptions in Part II.

…….

(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

(a) the information is exempt information by virtue of a provision conferring absolute exemption, or

(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

……..

40 Personal information.

(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if –

(a) it constitutes personal data which do not fall within subsection (1), and

(b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

…….

58 Determination of appeals

(1) If on an appeal under section 57 the Tribunal considers—

(a) that the notice against which the appeal is brought is not in accordance with the law, or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

13. Section 3(2) of the Data Protection Act 2018 ("DPA") defines "personal data" as "any information relating to an identified or identifiable living individual".  The "processing" of such information includes "disclosure by transmission, dissemination or otherwise making available" (s.3(4)(d) DPA), and so includes disclosure under FOIA.
14. The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation ("UK GDPR"), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be: "processed lawfully, fairly and in a transparent manner in relation to the data subject". The processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." (Article 6(1)(f)). The UK GDPR states that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.
15. The balancing of interests involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):

(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii) Is the processing involved necessary for the purposes of those interests?

(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

16. In Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC), Upper Tribunal Judge Wikeley set out eight propositions taken from case law as to the approach to answering these questions. These include: "necessity" carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity; and the test is one of "reasonable necessity", reflecting European jurisprudence on proportionality.

Issues and evidence

17. The issue in this case is whether the MOJ was entitled to withhold this information under section 40(2) FOIA.
18. By way of evidence and submissions we had the following, all of which we have taken into account in making our decision:

a. An agreed bundle of open documents.

b. A closed bundle of documents containing the withheld information, and unredacted versions of an email and letter from the MOJ to the Commissioner which are redacted in the open bundle.

Discussion and Conclusions

19. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner's Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision. We deal in turn with the issues.
20. We deal first with the Appellant's point that the concept of personal data has been applied too widely, and positions could be disclosed if not names. We do not agree. Job positions can often be matched easily to names, particularly for those who hold unique or senior positions in an organisation. Disclosure of job positions alone in this case would still constitute disclosure of personal data because this information could be used to identify the individuals.
21. We have considered whether disclosure of the personal data under FOIA would be lawful.
22. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? The Appellant has some legitimate interest in this information because of his personal issues with the MOJ. He wishes to understand how they came to give an initial response that no information was held. The Commissioner says that this interest has been met to some extent through a response to a data subject access request. We have not seen this response, but it does appear to have provided him with some information about a meeting on 29 April 2021. He also had some information about HR meetings through witness statements in an Employment Tribunal case. This means there is limited interest in disclosure to the world at large under FOIA.
23. The Appellant also makes the point that civil servants should be open and honest, and held accountable for their actions. He says the MOJ has misused FOIA to avoid embarrassment of senior civil servants. We agree that there is a general public interest in ensuring that public authorities are behaving appropriately. From the information we have seen, it is not evident that there has been misuse of FOIA, taking into account that the position was clarified on review of the First Request. However, there is a general interest in openness and transparency about what happened.
24. Is the processing involved necessary for the purposes of those interests? We are not persuaded that disclosure of the personal data to the world at large under FOIA is reasonably necessary for the purposes of the identified interests. As to the Appellant's personal interests in the information, he has already received related information through the data subject access request. It also appears that he is already aware of the names and related personal details that have been redacted, because he named specific individuals in his First Request and request for a review of that request. As to the public interest, it is unclear how knowledge of the identity of the individuals involved would significantly further openness and transparency. The unredacted information that has been disclosed shows responses that state no information was held. Although we have found that the processing is not reasonably necessary, we have also considered the balancing of interests.
25. Are the interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? Although we have identified legitimate interests in disclosure of the information under FOIA, these are limited for the reasons explained above. We have balanced these interests against the privacy rights and expectations of the data subjects, and find that interests in disclosure are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. We agree with the Commissioner that the individuals concerned would have the reasonable expectation that their personal data would not be disclosed to the wider world under FOIA in this context. We note that the information relates to an employment matter rather than exercise of the MOJ's public functions. This is an issue of inherent sensitivity and would be expected to remain private. Individuals involved in correspondence about employment matters would not expect their personal details to be released to the public. The interests in disclosure are outweighed by this expectation of privacy.
26. We therefore find that disclosure of the redacted personal data under FOIA would contravene the data protection principles and the MOJ was entitled to withhold it under section 40(2) FOIA.
27. The Tribunal has seen the withheld information. As stated by the MOJ in their internal review response, some of the information was redacted because it was not relevant to the Request, rather than because it was personal data. A substantial amount of the redaction was actually due to relevance. We can confirm that we have considered the redactions and are satisfied that they are all either personal data or not relevant to the Request.
28. The Appellant has also said in his appeal that he wants all meeting notes and emails to be provided. The Tribunal is unable to deal with this issue, as it relates to the First Request which is not the subject of this appeal. This Tribunal can only deal with the information asked for in the Request of 6 December 2021. This is limited to the information on which the MOJ based their response that they did not hold information within scope of the First Request.
29. For the reasons explained above we dismiss the appeal.

Signed Judge Hazel Oliver

Date: 29 July 2023

Promulgated Date: 03 August 2023