British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
First-tier Tribunal (General Regulatory Chamber)
You are here:
BAILII >>
Databases >>
First-tier Tribunal (General Regulatory Chamber) >>
Oakley v Information Commissioner [2025] UKFTT 536 (GRC) (14 May 2025)
URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/536.html
Cite as:
[2025] UKFTT 536 (GRC)
[
New search]
[
Printable PDF version]
[
Help]
|
|
Neutral Citation Number: [2025] UKFTT 536 (GRC) |
|
|
Case Reference: FT/EA/2024/0203 |
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
|
|
Heard by Cloud Video Platform Heard on: 30 April 2025
|
|
|
Decision Given On: 14 May 2025 |
B e f o r e :
JUDGE TAFT
MEMBER DE WAAL
MEMBER SAUNDERS
____________________
Between:
|
JANET TREHARNE OAKLEY |
Appellant |
|
and |
|
|
INFORMATION COMMISSIONER |
Respondent |
____________________
Representation:
For the Appellant: Represented herself
For the Respondent: Did not appear
____________________
HTML VERSION OF JUDGMENT
____________________
Crown Copyright ©
Decision: The appeal is Dismissed
Definitions:
"DPA" |
Data Protection Act 2018 |
"FOIA" |
Freedom of Information Act 2000 |
"ICO" |
The Information Commissioner's Office |
"MCC" |
Monmouthshire County Council, the Public Authority in this case (as defined by Schedule 1 of FOIA) |
"Requester" |
a person who applied for information – referred to in FOIA, section 1 as the applicant |
"the Rules" |
The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (SI 2010/43), as amended[1] |
"SARs" |
Subject Access Requests made under the DPA |
"UK GDPR" |
UK General Data Protection Regulation |
Mode of hearing: |
The Tribunal was satisfied that it was fair and just to conduct the hearing using Cloud Video Platform (CVP) The Appellant was able to attend. The Respondent had indicated that they would not appear. |
REASONS
Introduction
- The Appellant requested of MCC:
"Please provide the Organisational chart for employees handling FOIA and SAR requests, including job titles and with the names of public facing employees within the chart"
- MCC initially stated that the information requested was not held because they did not hold an organisational chart down to officer level. During the ICO's investigation, they accepted that some information was held. They sent an email to the Appellant on 28 March 2024 that disclosed the department names and job titles of staff dealing with FOIA requests and SARs. The email included the names of managers but withheld the names of junior staff, relying on Section 40(2) FOIA.
- In a Decision Notice (IC-279203-S7D1) dated 2 May 2024, the ICO decided that MCC correctly applied Sections 40(2) and 40(3A)(a) of FOIA to refuse the request but breached Sections 1(1)(a) and 10(1) of FOIA by failing to provide the disclosable information within the statutory time period.
The Law - General
- Section 1 FOIA provides:
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
(2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.
(3) …
(4) The information—
(a) in respect of which the applicant is to be informed under subsection (1)(a), or
(b) which is to be communicated under subsection (1)(b),
is the information in question held at the time when the request is received, except that account may be taken of any amendment of deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.
(5) A public authority is to be taken to have complied with subsection (1)(a) in relation to any information if it has communicated the information to the applicant in accordance with subsection (1)(b).
(6) In this Act, the duty of a public authority to comply with subsections (1)(a) is referred to as "the duty to confirm or deny".
- FOIA defines "Information" at section 84 which provides:
"information" [subject to sections 51(8) and 75(2)] means information recorded in any form;
- There is a process of challenge – the first challenge is for the requester to apply to the ICO for a Decision Notice (FOIA, section 50). If either side (the Requester or the Public Authority) wishes to challenge the ICO's Decision Notice, they are entitled to appeal to this Tribunal (FOIA, section 57). This Tribunal's powers are found in FOIA, section 58 which provides:
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal
(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.
The law – specific to this appeal
- In Preston v IC and CC West Yorkshire Police [2022] UKUT 344 (AAC), the Upper Tribunal confirmed that in determining whether the information is in fact held, both the ICO and this Tribunal should apply the civil standard of proof, i.e. the balance of probabilities. The Upper Tribunal also approved of the decision of the First Tier Tribunal in Clyne v IC and LB Lambeth EA/2011/0190 that
"the issue for the Tribunal is not what should have been recorded and retained but what was recorded and retained."
- Section 16 FOIA confirms that:
(1) It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to it.
(2) Any public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice under section 45 is to be taken to comply with the duty imposed by subsection (1) in relation to that case.
- In Berend v Information Commissioner and LB Richmond ...EA/2006/0049), the Information Tribunal held as follows:
37. The question of whether [the public authority] had complied with its section 16 and section 1 FOIA obligations are questions of fact.
…
40. Under section 45 FOIA the Lord Chancellor has published a Code of Practice (the Code) to assist public authorities. Where the public authority has complied with the Code they will be held to have fulfilled their obligations, however, failure to comply with the Code does not inevitably mean that a public authority has breached section 16 FOIA.
…
46. The Tribunal is satisfied that the request should be read objectively. The request is applicant and motive blind and as such public authorities are not expected to go behind the phrasing of the request.
- Section 40 FOIA confirms that:
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
. . .
(7) In this section—
"the data protection principles" means the principles set out in—
(a) Article 5(1) of the [UK GDPR], and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
- Section 3(2) DPA defines personal data as "any information relating to an identified or identifiable living individual". Section 3(4) defines processing. This includes "disclosure by transmission, dissemination or otherwise making available" [at (d)].
- Article 5 of the UK GDPR sets out the principles relating to the processing of personal data:
Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation');
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation');
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').
- Article 6 UK GDPR provides that:
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
- In Goldsmith International Business School v The Information Commissioner and the Home Office [2014] UKUT 563 (AAC), the Upper Tribunal considered the predecessor to Article 6(1)(f) and held that when considering whether that condition was met, the three questions formulated by Lady Hale in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 must be asked (in this order):
(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
- The Upper Tribunal further found that "necessity" means "more than desirable but less than indispensable or absolute necessity". It held that the test was one of "reasonable necessity", which involves the consideration of alternative measures. The measure must be the least restrictive means of achieving the legitimate aim.
- The Tribunal considers that the same questions and same test should be applied in determining whether there is lawful processing under UK GDPR Article 6(1)(f).
- In Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC), the Upper Tribunal held that whether or not the legitimate interests of a requester may or may not involve the disclosure of officials' names is context specific and fact sensitive.
- In IC v Halpin [2019] UKUT 29 (AAC), the Upper Tribunal criticised an FTT decision that had focused on the requester's legitimate interests but failed to take account of the fact that the public authority would lose control of the information once it was disclosed to the world at large under FOIA.
- In Corporate Officer of the House of Commons v IC & others [2008] EWHC 1084 (Admin), the High Court reflected that to be necessary, there must be a "pressing social need" and that interference must be "proportionate as to means and fairly balanced as to ends" [at para 43]. The Upper Tribunal in Halpin summarised the test as: "what must be established is a pressing social need and that there are no other means of meeting it" [at para 31].
- Section 40(2), so far as it relates to Section 40(3A), is an absolute exemption – see Section 2(3)(fa) - and so is not subject to the public interest test.
Grounds of Appeal
- The Appellant's Grounds of Appeal state that she is not requesting the names of junior staff but only "public facing officers", who she says are senior employees whose names are already in the public domain. She further asserts that there "must be" an organisational chart because one was supplied to another requester in respect of another department and because she believes that an organisational chart is necessary for HR purposes. She suggests that an organisational chart should be supplied with the names of junior staff redacted.
- The Appellant suggests that MCC rejected her request because they believe that she is vexatious.
Response
- The Response relies on the Decision Notice. The Respondent asserts that the Appellant is requesting personal data, that the Appellant accepts that it is personal data, and that the processing of this personal data would not be lawful because none of the conditions in Article 6 UK GDPR apply, save perhaps condition (f) in respect of legitimate interests. However, it is said that the legitimate interests must be balanced with the officials' fundamental rights and freedoms. In doing so, the Respondent says, the fact that a FOIA disclosure would be to all the world with no restrictions on the use of that information must be taken into account. The Respondent further says that such a disclosure must be necessary, and that it is not necessary if the aim could be achieved by something less. It further argues that to be necessary there must be a pressing social need for disclosure of the withheld information.
- The Respondent relies on Home Office v ICO EA/2011/0203, which it says held that there is no need for the public to know the identity of an individual who does no more than communicate basic policy detail. It further relies on Cox v IC [2018] UKUT 119 (AAC), which it says supports the "ordinary principle" that only senior civil servants "carry the can in terms of responsibility and accountability".
- The Respondent says that the Appellant's request for the names of "public facing" staff does not meet the test for lawful processing, because even the most junior staff can be "public facing".
Submissions – Appellant
- The Tribunal considered written submissions the Appellant had sent by email as well as oral submissions she made during the hearing.
- The Appellant's key submission was that she believes that MCC must hold an organisational chart. She believes that it is likely that the HR department would require such a chart to comply with employment laws. She believes that recognised trade unions would hold MCC to account if there was no such chart. She says that MCC cannot run their organisation without knowing who is responsible for what and how it fits together. She relies on the fact that an organisational chart for another MCC department was disclosed.
- The Appellant further suggests that MCC should have provided her with advice and assistance under Section 16 FOIA by clarifying with her whether she was in fact requesting the names of junior staff rather than relying on Section 40(2).
- The Appellant accepts that the names of junior staff should not be released. She is seeking a copy of the organisational chart with the names of junior staff redacted. She said that her purpose was to understand the areas of responsibility and who reports to who so that she would know to whom to complain about responses to FOIA requests and SARs.
Issues
- There are several strands to establishing whether the Decision Notice was in accordance with the law:
(a) Does MCC hold the information the Appellant has requested?
(b) If not, do they hold the "building blocks" of that information?
(c) If so, has MCC disclosed that information?
(d) Was MCC correct to rely on Section 40(2) to withhold the names of individual employees?
- So far as (d) is concerned, that will require the Tribunal to consider
(i) Is the Appellant pursuing a legitimate interest?
(ii) Is disclosure necessary for the purposes of those interests, i.e is there a pressing social need?
(iii) Is disclosure unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject – or put another way, would disclosure be proportionate as to means and fairly balanced as to ends?
- The Tribunal must also consider whether Section 16 applied – i.e. whether MCC had a duty to provide advice and assistance to the Appellant and if so whether they complied with that duty.
Evidence
- The Tribunal considered a bundle of 384 pages. That includes the email sent to the Appellant on 28 March 2024, the key content of which was:
We hold no organisational chart to cover FOIA and/or SAR services.
Our corporate organisational chart is available at
[1]https://www.monmouthshire.gov.uk/meet-th....
Per the above chart, SAR requests are administered by our Customer Relations team, under the People, Partnership and Performance service, managed by Annette Evans. Underneath her there is a single Customer Relations Support Officer post.
FOI requests are administered within the Information, Security and Technology team, under Resources, managed by Sian Hayward. Whilst there are other members within this larger team, regarding FOI administration, Kathryn Evans, our Data Protection and Information Manager, reports to the Head of Information, Security and Technology, and two Information Governance Officer posts report to the Data Protection Manager.
Further staff names beyond a managerial level are exempted under Section 40(2) of the FOIA.
Tribunal's Findings of Fact
- The Appellant's request did not ask MCC to give details of areas of responsibility but was limited to a request for an organisational chart covering the department(s) handling SARs and FOIA requests. It was a clear request that did not require MCC to seek clarification or ask for more details to enable it to identify the information sought.
- MCC responded to the request by saying that it did not have an organisational chart. During the ICO's investigation, MCC confirmed that it held the "building blocks" of the information requested but claimed that there was no way to extract the information without accessing individual personnel files. It confirmed that there was an exportable team structure but said that it could not export matching personnel information. It said that the only other way to obtain the information would be to search for individuals by name in the email address directory. It said that a single team or service couldn't be identified without "anecdotal knowledge". MCC said that it would be difficult to filter information because individuals administering FOI sit in a larger team and have similar job titles to others who do not.
- Nevertheless, MCC were able to provide information about the two departments that handle SARs and FOIA requests. They provided the names of the people managing the teams and the job titles of junior staff. They also provided a link to a corporate organisational chart.
- Organisational charts are commonly produced to assist employees to understand reporting structures. MCC has an organisational chart for its Social Care, Safeguarding and Health team.
- The Tribunal finds as a fact on the balance of probabilities that MCC does not have an organisational chart covering the two departments handling SARs and FOIA requests. The Appellant has not provided any evidence other than her assertion that such a chart "must exist" to rebut the submission made by MCC that it does not.
- The Tribunal further finds as a fact that the Appellant was provided with the "building blocks" of the information that was held, i.e. the job titles of individuals handling requests, the names of the managers to whom they reported, and in the case of FOIA requests, the name of the manager to whom that manager reported.
Conclusions
- It is unfortunate that the Decision Notice does not engage with the Appellant's assertion that an organisational chart must exist but concentrates only on whether she was entitled to information withheld by reason of Section 40(2).
- Nevertheless, the Tribunal has found as a fact that the organisational chart was not held. It is not the Tribunal's role to consider whether an organisational chart should be held. The Tribunal has further found as a fact that the Appellant was provided with the "building blocks" information that was held.
- The Appellant did not reference Section 16 in her correspondence with MCC, in her Section 50 complaint to the ICO or in her correspondence with the ICO. Nevertheless, in order to determine whether the ICO's Decision Notice was in accordance with the law, the Tribunal has considered whether or not MCC complied with Section 16.
- Section 16 does not require MCC to go behind the wording of the request. The Appellant requested an organisational chart. The request did not ask for "areas of responsibility". Section 16 was not engaged because MCC was able to provide the information requested that was held, i.e. the "building blocks", save in respect of the names withheld relying on Section 40(2).
- The ICO was correct to consider whether MCC could rely on the Section 40(2) exemption. Its decision was in accordance with the law. Whilst the Appellant had a legitimate interest in knowing the structure of the department and the names of senior managers to whom she could complain, it was not necessary for the Appellant to have the names of junior staff. It would be disproportionate for the names of junior staff to be disclosed to the world at large by way of a FOIA response. The Appellant accepts that.
- The Decision Notice was therefore in accordance with the law. Whilst it did not engage with all of the Appellant's reasons for challenging the response to her request, the Decision Notice was correct to identify that MCC was entitled to rely upon Section 40(2) to withhold the names of junior staff. There was no further information held by MCC that should have been supplied to the Appellant, nor was MCC required to provide advice and assistance under Section 16.
Signed
Judge Taft
Date: 14 May 2025
Note 1 https://www.gov.uk/government/publications/general-regulatory-chamber-tribunal-procedure-rules
[Back]