First-tier Tribunal (General Regulatory Chamber)

Neutral citation number: [2023] UKFTT 884 (GRC)

Appeal Number: EA/2023/0160

First-Tier Tribunal

(General Regulatory Chamber)

Information Rights

 

Heard on the papers: - 10 October 2023.

Decision given on:  - 23 October 2023 .

 

Tribunal Panel

Judge Brian Kennedy KC, Paul Taylor and Miriam Scott.

 

Between:

RUSSELL MELLFORD

Appellant:

And

 

THE INFORMATION COMMISSIONER

First Respondent:

And

 

MINISTRY OF JUSTICE

Second Respondent:

 

 

Decision: The Appeal is Dismissed .

 

REASONS

Introduction:   

1.    This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“FOIA”). The appeal is against the decision of the Information Commissioner (“the Commissioner”) contained in a Decision Notice (“DN”) dated 7 March 2023 (reference IC-200440-N0Q3), which is a matter of public record.

Factual Background to this Appeal:

2.      Details of the background to this appeal, the complainant’s request for information and the Commissioner’s decision are set out in the DN. The appeal concerns the Appellant’s request for the name of the Ministry of Justice (“MOJ”) staff member who responded to a complaint he made whilst incarcerated. The Commissioner’s DN upheld MOJ’s reliance on s40(2) FOIA to refuse to provide the name of the staff member as it was that staff member’s personal data.

 

3.      The Appellant, while a prisoner at HMP The Verne, on 4 February 2022 submitted a level one complaint to the prison, which was responded to on 10 February 2022. The response was signed “Staff Name: Business Hub Position: Admin”.

History and Chronology:

4.      On 14 August 2022, the Appellant wrote to the Second Respondent and requested information in the following terms (“the requested information”):

 

“You will note that the author of the response document dated 10/02/2022, has been

purposely concealed under the department name. This is contrary to the Prisoner

Complaints Policy Framework 01/08/20191…”…

 

“FOIR [Freedom of Information Act Request]

• The information that I seek is the digital date and time of the response of the

document dated 10/02/2022 (enc), and

• the electronic author of that document.”

 

5.      The FOIA request was handled by HMPPS Briefing and Correspondence Team, on behalf of the Second Respondent. A response was provided on 26 September 2022, disclosing the date and time of the document, but refusing to disclose the name of the author, citing section 40(2) of FOIA.

 

6.      On 30 November 2022 the Appellant wrote to the Second Defendant challenging the response and requesting an internal review. In particular, on the 30 November letter, the Appellant rejected the Second Defendant’s application of s 40(2), citing paragraph 4.32 of the Prisoner Complaints Policy Framework, which states: “The name of the person must be legible so that the prisoner knows who has been involved in dealing with their complaint”.

 

7.      Following an internal review, on 22 December 2022 the Second Respondent responded to the Appellant. The Second Respondent found the original response to be only partially compliant, as the response had not been sent within the deadline. It concluded, however, that s 40(2) of FOIA had been correctly applied in withholding the name of the person who had dealt with the complaint.

 

8.      The Appellant then laid a complaint with the First Respondent in January 2023, who accepted the complaint as eligible for consideration on 17 January 2023.  On 22 February 2023, the Second Respondent sent a further letter to the Appellant, explaining that it considered that, alongside s 40(2), two other FOIA exemptions were engaged. Namely: s 21 (that the information is reasonably accessible to the Appellant otherwise than under s 1 of FOIA) and s 14 (that a public authority is not required to comply with a request for information if the request is vexatious).

 

 

9.      In particular, the Second Respondent stated:

 

“Whilst we acknowledge that you had an interest in knowing who handled your complaint, we are satisfied that this interest has been appropriately met. Therefore, we believe that you are abusing your rights of access to information by using the legislation as a means to vent anger at a particular decision, or to harass and annoy HMPPS by requesting information which we know you possess already.”

 

10.  The Second Respondent further noted that the Appellant had been provided with the name, verbally, by staff at the prison, outside of FOIA. In his complaint to the First Respondent, the Appellant has denied this.

 

11.   The Second Respondent also sent a letter to the First Respondent in February 2023, informing the First Respondent that it considered that two additional FOIA exemptions applied in the Appellant’s circumstances, namely s 14 and s21, However the First Respondent did not address those additional grounds in its decision.

 

12.  On 7 March 2023, the First Respondent released the Decision Notice, stating that: “The Commissioner’s decision is that the MoJ was entitled to apply section 40(2) to refuse the request. However, it breached section 10(1) (Time for compliance) of FOIA in its handling of the request. The Commissioner requires no steps as a result of this decision.”

 

13.  The Appellant now seeks to appeal the DN to the Tribunal and the Commissioner submits that the appeal should be dismissed for the reasons given in the  DN and in his Response. The Second Respondent submits the appeal should be rejected arguing that the Commissioner’s DN of 7 is not unreasonable, and certainly not irrational, but rather, correctly applied s 40(2) of FOIA.

 

 

 

Legal Framework:

 

14.  Section 1 FOIA - General right of access to information held by public authorities:

(1) Any person making a request for information to a public authority is entitled—

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

(2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.

(3) Where a public authority—

(a) reasonably requires further information in order to identify and locate the information requested, and

(b) has informed the applicant of that requirement,the authority is not obliged to comply with subsection (1) unless it is supplied with that further information.

(4) The information—

(a) in respect of which the applicant is to be informed under subsection (1)(a), or

(b) which is to be communicated under subsection (1)(b), is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.

A public authority is to be taken to have complied with subsection (1)(a) in relation to any information if it has communicated the information to the applicant in accordance with subsection (1)(b).

(6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.

 

15.  Section 40 FOIA - Personal Information:

(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if—

(a) it constitutes personal data which does not fall within subsection (1), and

(b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act:—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).

 

(4A) The third condition is that:-

(a)    on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b)    on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1)

(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies:—

(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

(i) would (apart from this Act) contravene any of the data protection principles, or

(ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(b) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);

(c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);

(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this section— “the data protection principles” means the principles set out in—

(a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).

(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

16.  Section 3(2) of the Data Protection Act (“DPA”) defines personal data as:
“any information relating to an identified or identifiable living individual”.

 

17.  Article 5(1)(a) of the General Data Protection Regulations (GDPR) states that:

 

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

 

18.  Article 6(1)(f) of the GDPR states:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

The Commissioner’s Decision:

19.  The Commissioner investigated the matter and held that while the Appellant has a legitimate interest in the withheld information in this case,  disclosure is not necessary to meet that legitimate interest holding that the data subject has a strong expectation of privacy relating to the requested information and as disclosure is not necessary (ie the Appellant may obtain it otherwise than under FOIA), the data subject’s consequent loss of privacy would be disproportionate and unwarranted. The Commissioner  therefore determined that disclosure of the data subject’s personal data would be unlawful and in contravention of data protection principle (a), as set out under Article 5(1)(a) of the UK General Data Protection Regulation.

 

20.  The Commissioner held that as disclosing the data subject’s personal data would be unlawful, section 40(2) is engaged and therefore that the MoJ was entitled to apply section 40(2) of FOIA to withhold the requested information.

 

21.  In relation to procedural matters the Commissioner held that the MoJ had breached section 10 of FOIA as it failed to respond to the request within 20 working days and the Commissioner made a note of this delay for monitoring purposes.

Grounds of Appeal:

22.  The Appellant’s Grounds of Appeal can be ssummarised as follows:

a) HMPPS Complaint Policy Framework states the name of the decision maker must be legible;

b) Confusion that FOIA runs alongside HMPPS disclosure rules claiming inconsistency, contradiction, irrational and unreasonableness in the DN in all the circumstances.

The Commissioner’s Response:

23.  In relation to ground a) above, the Commissioner accepts that, and MOJ has accepted that, according to its own Complaints Policy, the Appellant should be told who has determined his complaint. The MOJ maintain the Appellant has been told of the name of the decision maker. This appeal is about whether the Commissioner was correct to conclude that the name of the decision maker should be withheld from the world at large (as this is how disclosure under FOIA works) and whether s40(2) was applied correctly. This ground the Commissioner argues can be dismissed.

 

24.  In relation to ground b) above the Commissioner understands the Appellant’s frustration but argues it is correct to say that FOIA can run alongside other laws that require disclosure. The point made is that the Commissioner has determined that disclosure of the decision makers name under FOIA would be unlawful and hence s 40 (2) applies to withhold such disclosure. Information can be withheld under FOIA whilst at the same time being disclosed outside of FOIA, which is what has happened here. This ground, the Commissioner argues, does not dislodge the Commissioner’s DN.

The MoJ’s Response:

25.  The MoJ proided a supportive analysis of the DN accepting that the Commissioner had therefore acted entirely reasonably, and rationally, in its application of the relevant legal framework under FOIA to the Appellant’s request,and reaching the decision that it did.

 

26.  The Second Respondent argues that  following the Appellant’s complaint to the Commissioer, the Second Respondent wrote to the Appellant (and the Commissioner), setting out two further grounds/bases on which the requested information could be withheld. Namely, ss 21 and 14 of FOIA. Whilst these sections were not addressed by the Commissioner  in the impugned DN, the Second Respondent respectfully submits they provide further legal bases for the requested information to be refused.

 

27.  In particular, the Second Respondent submits that it is open to the Tribunal to consider, if it deemed that it was appropriate or necessary to do so, that ss 14 and 21 of FOIA are engaged, notwithstanding that these sections were not addressed in the Decision Notice.  This is because in an appeal of this nature (that is, an appeal to the Tribunal under s58 of FOIA), is de novo: the Tribunal stands in the shoes of the Information Commissioner and can make any decision that he could have made.

Discussion and Conclusions:

28.  The Tribunal find that the information requested is clearly personal data, as defined under s.3(2) DPA 2018. The Court of Appeal case in Edem is relevant (Edem v IC & Financial Services Authority [2014] EWCA Civ 92). At  para.20, LJ Moses held as follows:

"A name is personal data unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure."  

 

29.  On consideration of all the evidence before us, the Tribunal are of the view that section 40 (2) applies because;

 (i)  an individual would be identifiable who is a junior member of staff,

 (ii) it seems likely information as to the identity of the individual has already been provided verbally therefore the complaint has probably already been addressed,

(iii) it would in our view, be unreasonable, unfair and disproportionate to disclose such information  to the world at large in all the circumstances ,

 (iv) its disclosure is not necessary to meet any legitimate interest in all the circumstances.

 

30.  Further and in the alternative, the Tribunal accept and endorse the detailed reasoning in the Commissioner's DN from paragraphs 9 to 21 therein and find  no error of law or wrongful exercise of discretion.

 

31.  The tribunal in passing make the following without perjudice comments on other matters raised by the Second Respondent. Reliance on the exemption under s 14, would in our view be unlikely to succeed  but  s 21 may be a more realistic propositon as an alternative exemption to rely upon.

 

32.  The Tribuunal observe and further comment obiter on the fact that the requested information is directly related to the Appellant,( i.e. his complaint is his personal data). As noted by the Commissioner at DN, para.4: "Outside the remit of FOIA, the complainant had submitted a Level 1 prisoner complaint, which was responded to in a document dated 10 February 2022...". We note the requested information (described at the foot of the same paragraph) is the "electronic author of that document." , i.e. the name of the person that responded electronically to the Appellant's complaint. Consequently, it could be argued that s.40(1) FOIA applies in respect of this information. As stated above that section reads:

 

"Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject."

 

33.  Accordingly for all the above reasons, we find no error of Law in the Commissioner’s impugned DN nor in any exercise of the discretion as applied therein, and we must dismiss this appeal.

 

Brian Kennedy KC                                                                       18 October 2023.