Freely Available British and Irish Public Legal Information
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
First-tier Tribunal (General Regulatory Chamber)
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Worssell v The Information Commissioner [2023] UKFTT 843 (GRC) (10 October 2023)
URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2023/843.html
Cite as: [2023] UKFTT 843 (GRC)
[New search] [Printable PDF version] [Help]
Neutral citation number:
Case Reference: EA/2023/0138
[Information Rights]
Heard: by determination on the papers
Heard on:
Decision given on:
Before
TRIBUNAL JUDGE Alison McKenna
TRIBUNAL MEMBER Pieter De Waal
TRIBUNAL MEMBER Susan Wolf
Between
and
DECISION:
This appeal is allowed.
The Tribunal makes the following Substituted Decision Notice and Directions:
1. Rushmoor Borough Council is hereby joined as the Second Respondent to this Appeal;
2. Rushmoor Borough Council is directed to disclose the requested information to the Appellant within 28 days of this Decision being sent to it.
REASONS
3. The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of this Chamber's Procedure Rules.
4. The Tribunal considered an agreed open bundle of evidence comprising pages 1 to 177. The Tribunal also considered a closed bundle, comprising pages 1 to 4. For the benefit of the Appellant, we `gist' the closed evidence as being the withheld information and correspondence which is revelatory of the withheld information.
5. This appeal concerns the Appellant's request for information about the doctor who authorised his late mother's cremation. This doctor was acting on behalf of Rushmoor Borough Council (`RBC'), which is the relevant public authority for the purposes of the Freedom of Information Act 2000 (`FOIA') : Freedom of Information Act 2000 (legislation.gov.uk)
6. The Appellant made his request to RBC on 26 July 2021 in the following terms:
7. RBC refused to provide the requested information initially on 15 November 2021 and, after an internal review, again on 22 July 2022, in reliance upon section 40 (2) of the Freedom of Information Act 2000 (`FOIA'). The Appellant complained to the Information Commissioner.
8. The Information Commissioner issued a Decision Notice on 1 March 2023, upholding RBC's reliance upon s. 40 (2) FOIA in refusing to disclose the requested information. The Appellant appealed to the Tribunal.
9. The Decision Notice concluded that the requested information was personal data because it related to and would identify a living individual. This meant that it was defined as personal data by s. 3 (2) of the Data Protection Act 2018: Data Protection Act 2018 (legislation.gov.uk)
10. Having concluded that the information requested constituted personal data, the Decision Notice considered whether there was a lawful basis for processing it under article 5 GDPR, in particular with reference to principle (a): `lawfulness, fairness and transparency.' The Decision Notice considered, in compliance with article 6 (1) (f) GDPR, whether there was a legitimate interest in the information requested, whether disclosure was necessary to meet that legitimate interest, and whether the individual's data protection rights should outweigh those factors. It concluded that, although there was a legitimate interest in the information requested, this was a personal interest and not a wider public interest. It also considered that the doctor in question did not consent to the disclosure of the personal data. It observed that disclosure under FOIA is disclosure to the world at large, equivalent to putting the doctor's details on its website. The Decision Notice weighed these factors and concluded that there was no lawful basis for RBC to disclose the information requested.
11. The Decision Notice also found that RBC had breached s. 10 (1) FOIA due to its delay in responding to the Appellant's request. It required no steps to be taken.
12. S. 40 FOIA provides (where relevant) as follows:
40 Personal information.
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
Any information to which a request for information relates is also exempt information if-
(a)it constitutes personal data which-¯does-¯not fall within subsection (1), and
the first, second or third-¯condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act-
would contravene any of the data protection principles, or
would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
13. GDPR provides (where relevant) that:
Article 5
Personal data shall be:
(a)processed lawfully, fairly and in a transparent manner in relation to the data subject (`lawfulness, fairness and transparency');
Article 6
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
14. S.40 FOIA is an absolute exemption so the public interest balancing exercise under s. 2(2) (b) FOIA is not a relevant consideration in this appeal.
15. The powers of this Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:
If on an appeal under section 57 the Tribunal considers - (a) that the notice against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.
On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.
16. The burden of proof in satisfying the Tribunal that the Commissioner's decision was wrong in law or involved an inappropriate exercise of discretion rests with the Appellant. The relevant standard of proof is the balance of probabilities.
17. The Appellant's Grounds of Appeal dated 9 March 2023 rely on submissions that he has a legitimate interest in the requested information, and that disclosure is necessary because he cannot make a complaint to the GMC unless he can supply the doctor's name and registration number.
18. The Respondent's Response dated 2 May 2023 relies on the correctness of the Decision Notice. It is submitted that the Appellant could ask for the GMC registration number from the doctor directly and could complain to the GMC if they refused to give it. It is submitted that the doctor does not occupy a public-facing role and that their data protection rights outweigh the public interest identified by the Appellant.
19. The Appellant has submitted evidence in the form of a letter from GMC dated 25 July 2022 (bundle page A13), which confirms that he would need to supply a name and registration number in order to make a complaint to the GMC.
20. The Decision Notice correctly identifies that the requested information is personal data and carries out the relevant balancing exercise under GDPR article 6 (1) (f). However, we find that it reached an erroneous conclusion for the following reasons. Firstly, the consent of the data subject is a relevant consideration under article 6 (1) (a) but is not ordinarily also a relevant factor to be weighed into the balance under article 6 (1) (f). We note that the ICO's own (non-binding) Guidance states that Public Authorities may consult the third-party data subject and that "If an individual has expressed concern about the disclosure of their personal data, you should carefully consider their reasons. You should weigh these against the identified legitimate interest in disclosure." However, the Decision Notice does not refer to any reasoned expression of concern, only that consent had not been given, so we find that it was erroneous to weigh the lack of consent into the article 6 (1) (f) balance in this case.
21. Secondly, we find that the Information Commissioner's approach to the Appellant's evidence of the GMC's requirements was inappropriately dismissive, involving speculation about the likely conduct of the GMC which should not have been regarded as carrying more weight than the Appellant's evidence.
22. We conclude that the doctor occupies a senior role for RBC which, whilst it may not be public facing, carries with it significant responsibility and that there is a public interest in transparency and accountability in relation to that role. We disagree that the Appellant's interest was personal only. We therefore find that the Appellant had a legitimate interest in the requested information.
23. We also find that it was necessary to disclose the requested information for the purposes of enabling the Appellant's complaint to the GMC. We accept the Appellant's evidence in this regard. We have concluded that these factors should outweigh the doctor's data protection rights in these circumstances.
24. Thus, we find that there is a lawful basis for processing the data by disclosing the information requested. In all the circumstances, we consider that the Decision Notice includes an error of law and accordingly, that this appeal should be allowed. We now make the substituted Decision Notice above.
25. We have also directed the joinder of RBC to this appeal. We do so pursuant to rule 9 of the GRC Rules: The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009
Signed: Judge Alison McKenna