First-tier Tribunal (General Regulatory Chamber)

Neutral citation number: [2023] UKFTT 830 (GRC)

 Case Reference: EA/2022/0409

First-tier Tribunal

General Regulatory Chamber

Information Rights

 

Determined, by consent, on written evidence and submissions.

Considered on the papers on 6 September 2023.

 

Decision given on: 11 October 2023

 

Before

 

TRIBUNAL JUDGE Stephen Cragg KC 

TRIBUNAL MEMBER Paul Taylor

TRIBUNAL MEMBER Dan Palmer-Dunk

 

Between

 

JOHM MCTIGHE

Appellant

And

 

INFORMATION COMMISSIONER

 

Respondent

 

 

Decision: The appeal is Dismissed.

 

Substituted Decision Notice: No substituted decision notice.

 

 

REASONS

 

 

MODE OF HEARING AND PRELIMINARY MATTERS

1.    The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.

 

2.    The Tribunal considered an agreed open bundle of evidence of 94 pages and submissions from the parties..

 

BACKGROUND

 

3.       The Appellant made the following information request to South Wales Police (SWP) on 8 May 2022, about an individual named in the request (redacted in the version below):-

“Could you please provide a clear explanation of why South Wales Police (SWP) have asked [redacted] to accept that his actions were "human error".

In particular could SWP explain how "human error" was involved in the bus passenger figures for the T2 service increasing from 345,814 passengers in 2017/2018 to 691,628 passengers in 2018/2019 representing an increase of 20%. The false figures indicate that the passenger numbers exactly doubled and I request that SWP explain how this can be attributed to "human error".

I asked a number of questions following your communication of 07/03/2022 which you have had 1 month to consider. They are not difficult questions but you have refused to answer them. 

Could you please therefore provide copies of the following documents referred to by SWP during the 12 month investigation.

(1) The notes for the police interview of [redacted] (referred to by SWP on 30/11/2021, 01/12/2021, 21/01/2021 and 07/03/2022 ).

(2) The “incorrect” version of the 2018-2019 Trawscymru Annual report.(referred to by SWP on 11/08/2021, 12/08/2021 and 07/03/2022)

(3) The “correct” version of the 2018-2019 Trawscymru Annual report.(referred to by SWP on 07/03/2022)

(4) The “documented evidence”, (provided to SWP by the Welsh Government Data Security Head), that [redacted] had attempted to correct the incorrect data over the months before the Strategic Management Board Meeting (referred to by SWP on 07/03/2022)

(5) The minutes from the Strategic Management Board meeting (referred to by SWP on 07/03/2022)

(6) The “incorrect” version of the form (which contained the figures  subsequently published) (referred to by SWP on 07/03/2022)

(7) The “correct” version of the form (referred to by SWP on 07/03/2022)

(8) The copy of the bus passenger figures for 2018-2019 provided to South Wales Police by Bus Users Cymru.(referred to by SWP on 22/10/2021 and 07/03/2022)

(9) Copies of all the email trails retrieved during the investigation. (referred to by SWP on 21/01/2022 as “awaiting some further email trails “).”

 

4.       SWP’s final position was to neither confirm nor deny it holds information within scope of the request under section 40(5) FOIA, section 30(3) FOIA which concerns investigations and proceedings, and section 31(3) FOIA which concerns law enforcement.

 

5.       The Appellant complained to the Commissioner who provided a short decision notice dated 28 November 2022. The relevant part of the decision notice reads as follows:-

 

5. Section 1(1)(a) of FOIA obliges a public authority to confirm whether or not it holds information that has been requested - this is known as ‘the duty to confirm or deny’.

 

6. However, under section 40(5) of FOIA a public authority is not obliged to comply with section 1(1)(a) if the mere fact of confirming whether or not information is held would disclose the personal data of a third person.

 

7.  In this case, if South Wales Police were to confirm it did or did not hold the requested information it would, in effect, be confirming whether or not the individual named in the request was the subject of a particular investigation. Whether that individual was the subject of an investigation is their personal data.

 

8. The Commissioner appreciates that the complainant has an interest in the subject of the request. It is a legitimate interest for them to have that would be met, in the first instance, through South Wales Police confirming or denying it holds the requested information. As South Wales Police noted in its response to the request (although in regard to sections 30 and 31) there is also a wider public interest in the public being aware of any of South Wales Police’s investigations into allegations of wrongdoing which might encourage individuals to provide

intelligence and promote trust. 

 

9. In its response to the request, however, South Wales Police confirmed that it follows Authorised Professional Practice for Information Management guidance in respect of police information, which includes whether anyone has been the subject of an investigation. It processes such information for specific purposes only and these do not include disclosing it under FOIA. South Wales Police said that confirming or denying it held the requested information could therefore undermine ongoing investigations and compromise information sharing agreements.

 

10. Irrespective of any information the complainant may have gleaned outside of FOIA, the Commissioner considers that the individual named in this case would reasonably expect that their personal data would not be disclosed to the world at large under FOIA. As South Wales Police noted in it response, confirmation or denial would therefore cause that individual harm or distress.  

 

11. Based on the above factors, the Commissioner has determined that there is insufficient legitimate interest to outweigh the data subject’s fundamental rights and freedoms. The Commissioner therefore considers that confirming or denying the requested information is held would be unlawful as it would contravene a data protection principle; that set out under Article 5(1)(a) of the UK General Data Protection Regulation. Since section 40(5) is engaged, it has not been necessary for the Commissioner to consider South Wales Police’s application of sections 30(3) and 31(3).

 

 

LEGAL FRAMEWORK

6.       Under section 1(1)(a) FOIA, a public authority is obliged to tell an applicant whether or not it holds the information requested.   There are however exemptions from this duty. Section 40(5B)(a)(i) FOIA provides that the duty to confirm or deny does not arise if doing so would contravene any of the principles relating to the processing of personal data set out in Article 5 of the UK General Data Protection Regulation (UK GDPR).

 

7.       Personal data is defined as ‘any information relating to an identified or identifiable living individual’, by s.3(2) Data Protection Act 2018 (DPA), and the ‘processing’ of such information includes ‘disclosure by transmission, dissemination or otherwise making available’: see (s.3(4)(d) DPA); and therefore includes disclosure under FOIA.

 

8.       The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be ‘processed lawfully, fairly and in a transparent manner in relation to the data subject’. Confirmation or denial that the information is held can therefore only be made if to do so would be lawful, (which means it  would meet one of the conditions of lawful processing listed in Article 6(1) UK GDPR), and be fair, and transparent. 

 

9.       The condition most applicable on the facts of the present case would be that contained in Article 6(1)(f) UK GDPR which provides as follows:-

 

…processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…

 

THE APPEAL AND RESPONSE

 

10.   The Appellant’s appeal document provides context to the request he has made and explains in more depth the Appellant’s legitimate interest in the information he has sought.  The document then sets out three main grounds of appeal. These have been summarised, we think appropriately, by the Commissioner in his response as follows:-

 

(a)    Criticism of the ICO’s investigation into the Appellant’s complaint;

(b)   An argument that the requested information is not personal data;

(c)    An argument that there is public interest in disclosure of the information.

 

11.   In response  the Commissioner relied on the contents of the decision notice. The Commissioner pointed out that the conduct of the investigation by the Commissioner is beyond the scope of the Tribunal. The Commissioner re-affirmed his view that  the mere fact of confirming or denying whether information is held would constitute the named individual’s personal data. This is because it would have the effect of revealing to the world at large, whether or not the individual  was under investigation. That is information which is related to that person and identifies them as a person under investigation, and so it is their personal data, as defined by s3(2) DPA.

12.   In relation to the public interest argument, the Commissioner points out that s40 FOIA is an absolute exemption and is not subject to the public interest test.

  

13.   The Appellant has produced further submissions which says much about the Appellant’s interest in the subject matter behind his request (the calculation of numbers of Welsh bus passengers) and the way that SWP and the Commissioner have dealt with his request, but has little to say about the legal tests that have to be applied by the Commissioner and now this Tribunal.

DISCUSSION

14.   There is no escaping the fact that the information requested by the Appellant all relates to an investigation into the actions of a particular individual, and indeed that is what the Appellant is interested in, and that to confirm or deny whether the information requested or held would reveal information that is personal information relating to that individual and any investigation that they might or might not have been subjected to.

 

15.   Therefore, for the purposed of s40(5B)(a)(i) FOIA the duty to state whether or not the information is held for the purposes of s1(1)(a) FOIA does not apply if to do so would mean that any of the data protection principles would be breached.

 

16.   As explained above the first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be ‘processed lawfully, fairly and in a transparent manner in relation to the data subject’.  Confirming or denying that the information is held can therefore only be done if to do so would be lawful.

 

17.   In turn that means that it would have to meet one of the conditions of lawful processing listed in Article 6(1) UK GDPR, and then be fair, and transparent.   As set out above the condition most applicable on the facts of the present case would be that contained in Article 6(1)(f) UK GDPR.

 

18.   We accept that the Appellant has a legitimate interest in obtaining the information he has requested, and he clearly has a strong interest in obtaining the information to get to the bottom of figures disclosed about the calculation of levels of bus passengers.

 

19.   However, we agree with the Commissioner that the individual named in the request would reasonably expect that their personal data would not be disclosed to the world at large under FOIA. As SWP noted in its response to the Commissioner , confirmation or denial that requested information is held, would itself cause that individual harm or distress. Revelation as to whether or not a person is subject to investigation is such a serious interference with a person’s right to privacy, that the Appellant’s interests do not, in our view, however sincerely he wants to pursue his concerns, override the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

 

20.   Therefore we agree with the Commissioner that confirming or denying the requested information is held would be unlawful as it would contravene a data protection principle; that set out under Article 5(1)(a) of the UK General Data Protection Regulation.

 

21.   As we agree with the Commissioner on that issue, it is not  necessary for the Tribunal to go on to consider SWP’s reliance on sections 30(3) and 31(3) FOIA.

 

CONCLUSION

 

22.   On the basis of the above, the Tribunal dismisses the appeal.

 

Stephen Cragg KC

Judge of the First-tier Tribunal

Date:  10 October 2023