British
and Irish Legal Information Institute
Freely Available British and Irish Public Legal Information
[
Home]
[
Databases]
[
World Law]
[
Multidatabase Search]
[
Help]
[
Feedback]
First-tier Tribunal (General Regulatory Chamber)
You are here:
BAILII >>
Databases >>
First-tier Tribunal (General Regulatory Chamber) >>
Hinkel v Information Commissioner & Anor [2025] UKFTT 611 (GRC) (21 May 2025)
URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/611.html
Cite as:
[2025] UKFTT 611 (GRC)
[
New search]
[
Printable PDF version]
[
Help]
|
|
Neutral Citation Number: [2025] UKFTT 611 (GRC) |
|
|
Appeal References: FT/EA/2023/0306
FT/EA/2024/0298 |
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
|
|
Decided without a hearing
|
|
|
21 May 2025 |
B e f o r e :
JUDGE ANTHONY SNELSON
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER MIRIAM SCOTT
____________________
Between:
|
DAVID ANTHONY HINKEL
|
Appellant
|
|
- and -
|
|
|
THE INFORMATION COMMISSIONER
|
First Respondent
|
|
and
|
|
|
H M TREASURY
|
Second Respondent
|
____________________
____________________
HTML VERSION OF DECISION
____________________
Crown Copyright ©
DECISION
On considering the written representations of the parties and other documents tabled, the Tribunal unanimously determines that the Appellant's appeals are dismissed.
REASONS
Introduction and Procedural History
- The background to this litigation is helpfully summarised by the Second Respondent ('the Commissioner') in his Decision Notice ('DN') dated 19 June 2023, the subject of the first appeal before us, in the following terms:
5. In a letter to the Commissioner the complainant explained that in 2017 [he] had sought to purchase land owned by the government of a country currently subject to financial sanctions by the UK government, meaning that the land is under asset freezing restrictions. The sale of the land was never completed. Per the complainant's explanation, in order to facilitate the sale of the land, two conveyancing solicitors working at a large legal partnership claimed that they had been instructed by the government of the designated country to facilitate the sale. In order to act on behalf of the government of the designated country for the purposes of a financial transaction, it is a requirement that solicitors obtain specific licences from the Office of Financial Sanctions Implementation.[1] It is the complainant's position that the representatives did not obtain the required licenses and therefore acted in contravention of UK sanctions legislation.
The land which the complainant (the Appellant, Mr David Anthony Hinkel) was interested in purchasing is located in the UK. His oft-repeated complaint is that, in failing to obtain the necessary licence(s) (personally and/or in the name of their firm), the solicitors purporting to act on behalf of the designated country committed fraud and that he has suffered very substantial financial losses as a consequence. Latterly, as documents relating to the second appeal before us show, Mr Hinkel has broadened the scope of his attack to include a number of other legal practitioners and corporate or collective legal bodies and some insurance companies.
- On 11 November 2022 Mr Hinkel submitted to OFSI a request for information under the Freedom of Information Act 2000 ('FOIA') in the following terms:
I respectfully request you to categorically state whether [redacted] and [redacted] held such Licences during the period they had claimed to have conduct of the purported property transaction and whether [redacted] has ever applied for or held such a licence and if not, what action you propose to take or whether the Government has a policy of failing to implement the law.
We will refer to this request as Request A.
- On 9 December 2022, HMT issued a response relying on FOIA, s40(5B)[2], neither confirming nor denying that the information was held.
- Mr Hinkel challenged the response but, following an internal review, HMT maintained its position.
- On 20 January 2023 Mr Hinkel complained to the Commissioner.
- On 31 May 2023, having been contacted by the Commissioner, HMT gave notice that it relied upon a further exemption, under s41(2) (information provided in confidence).
- By his DN dated 19 June 2023, the Commissioner upheld HMT's reliance on s40(5B) to neither confirm nor deny that the information sought was held. In light of that ruling, the Commissioner did not address s41(2).
- On 22 June 2023 Mr Hinkel presented a notice of appeal challenging the Commissioner's adjudication. This gave rise to what we will call Appeal A.
- On 15 September 2023 the Commissioner presented a response to Appeal A.
- On 6 October 2023 HMT responded to Appeal A, pleading reliance on a third exemption, that under s43 (commercial interests).
- To the responses of the Commissioner and HMT, Mr Hinkel served replies dated 29 September 2023 and 8 October 2023 respectively.
- On 23 October 2023 Mr Hinkel submitted a second request to OFSI for information. Although purporting to be made under data protection legislation, the request has since been accepted by all parties and the Tribunal as standing as a request under FOIA. It was in the following terms :
7. Whether any or all of the following applied for [or] obtained the requisite licence to act as conveyancing solicitors or as agents for the [name of entities and individuals redacted] in the matter of the proposed sale of the property known as [details of property redacted]
a. [name of law firm A redacted]
b. [name of solicitor at law firm A redacted]
c. [name of solicitor at law firm A redacted]
8. Whether any or all of the following applied for or obtained the requisite licence to act as barristers, counsel or legal advisers to [name of law firm A redacted], [name of solicitor referred to at 7b redacted], [name of solicitor referred to at 7c redacted] in the matter of the proposed sale of the property known as [details of property redacted] and/or in the regulatory investigation by the Solicitors Regulation Authority or the Solicitors Disciplinary Tribunal or court or tribunal cases resulting therefrom and to accept payment for legal services provided to them from any insurer.
a. [name of barristers chambers A redacted]
b. [name of barrister at chambers A redacted]
c. [name of barrister at chambers B redacted]
d. [name of barristers chambers B redacted]
e. [name of barrister at chambers B redacted]
f. [name of barrister at chambers B redacted]
9. Whether any or all of the following applied for or obtained the requisite licence to act as solicitors, counsel or legal advisers of any sort to [name of law firm A redacted], [name of solicitor referred to at 7b redacted], [name of solicitor referred to at 7c redacted] in the matter of the proposed sale of the property known as [details of property redacted] and/or in the regulatory investigation by the Solicitors Regulation Authority or the Solicitors Disciplinary Tribunal or court or tribunal cases resulting therefrom and to accept payment for legal services provided to them from any insurer.
a. [name of law firm B redacted]
b. [name of solicitor at law firm B redacted]
c. [name of solicitor at law firm B redacted]
d. [name of solicitor at law firm B redacted]
e. [name of law firm C redacted]
f. [name of solicitor at law firm C redacted]
g. [name of solicitor at law firm C redacted]
h. [name of solicitor at law firm C redacted]
10. Whether any or all of the following applied for or obtained the requisite licence to act as professional indemnity insurers and/or to make advance or final payments for their legal representatives to [name of law firm A redacted], [name of solicitor referred to at 7b redacted], [name of solicitor referred to at 7c redacted] in the matter of the proposed sale of the property known as [details of property redacted] and/or in the regulatory investigation by the Solicitors Regulation Authority or the Solicitors Disciplinary Tribunal or court or tribunal cases resulting therefrom to make advance payment or final payment for legal defence services provided to [name of law firm A redacted], [name of solicitor referred to at 7b redacted], [name of solicitor referred to at 7c redacted] to aforementioned solicitors and barristers.
a. [name of insurance company redacted]
b. [name of insurance company redacted]
c. [name of insurance company redacted]
d. [name of insurance company redacted]
e. [name of insurance company redacted]
f. [name of insurance company redacted]
g. [name of insurance company redacted]
We will refer to this request as Request B .
- On 22 December 2023 HMT responded to Request B, citing ss40(5B), 41(2) and 43(3) and neither confirming nor denying that the requested information was held.
- Mr Hinkel challenged the response but on 26 February 2024, following an internal review, HMT maintained its stance.
- On 8 April 2024 Mr Hinkel complained to the Commissioner.
- On 14 June 2024 the Commissioner issued a DN upholding HMT's response to Request B in so far as it relied upon ss40(5B) and 41, neither confirming nor denying that the requested information was held.
- On 3 July 2024 Mr Hinkel presented to the Tribunal a notice of appeal against the DN of 14 June 2024. We will refer to this as Appeal B.
- Appeal B was resisted in responses on behalf of the Commissioner and HMT dated 22 and 25 November 2024 respectively.
- To these Mr Hinkel responded with replies dated 2 December 2024 and 9 December 2024 respectively.
- The consolidated appeals came before us for consideration on paper, the parties being content for them to be determined without a hearing. We were satisfied that it was just and in keeping with the overriding objective[3] to proceed in that manner.
- We had before us a bundle of over 1300 pages. It included not only the 'pleadings' and case management documentation arising out of both requests but also documents pertaining to the many other pieces of litigation in which Mr Hinkel has engaged as a consequence of his complaints and allegations about the alleged acts or omissions of solicitors and others in relation to the proposed property sale. The final third (approximately) of the bundle comprises a witness statement of Christopher Watts on behalf of HMT dated 19 December 2024 together with exhibits, the Appellant's letter to the Tribunal of 6 January 2025 responding to that evidence and several standard documents and guidance materials produced by HMT relating to the financial sanctions regime.
The Facts
The financial sanctions scheme
- Mr Watts has held the post of Deputy Director of OFSI for almost six years. His evidence is authoritative and persuasive. We have received no information which casts doubt on any part of it. In so far as it states facts, we accept that it is true and accurate. To set the scene, we cannot do better than to reproduce (with exhibit citations deleted) the following extract from Mr Watts's statement.
6. The IC has received a response from HMT in this case which was neither a confirmation nor denial of whether a specific designated person ('DP') or their legal representatives have made an application for a licence from OFSI.
Sanctions policy
7. Financial sanctions are restrictions put in place by the UN or the UK to achieve specific foreign policy or national security objectives. Sanctions may take various forms, including targeted asset freezes, restrictions on financial markets and services, and directions to cease business.
8. While the Foreign, Commonwealth and Development Office ('FCDO') is responsible for the UK's international sanctions policy, OFSI (within HMT) is the authority for the implementation of financial sanctions in the UK. OFSI's role is to help ensure that financial sanctions are understood, implemented and enforced in the UK and it uses its expertise to carry out a range of functions to fulfil this role. These include providing outreach and guidance to assist in the understanding of financial sanctions, holding responsibility for making decisions on and issuing licences to sanctioned individuals and entities, and ensuring that suspected breaches of financial sanctions are identified and investigated.
9. Sanctions may be imposed for a variety of reasons, such as: to coerce a regime (or individuals within it) into changing their behaviour; to constrain a target by denying them access to key resources; to signal broader political disapproval of particular activities or policies; and/or to safeguard assets that may have been misappropriated until such time as they can be repatriated. I exhibit ... the UK Sanctions Strategy, published by the FCDO on 22 February 2024, which captures these objectives as "to deter and disrupt malign behaviour and to demonstrate our defence of international norms" ... Sanctions are "a vital tool for pursuing our interests and protecting our values" and … "a critical instrument of the UK's foreign, national and security policy" …
10. Sanctions operate by limiting the provision of certain financial services or restricting access to financial markets, funds and economic resources. They are introduced through a combination of primary legislation and statutory instruments.
11. Where people, entities, aircraft or ships are designated or specified under regulations made under the Sanctions and Anti Money Laundering Act 2018, they are included in the UK Sanctions List, a publication maintained by the FCDO, alongside a brief statement of reasons for the designation or specification. At the time of writing, over 4,600 designations or specifications are in force under a wide variety of sanctions regimes, including those addressing the Russia/Ukraine conflict, nuclear proliferation in Iran and the Democratic People's Republic of Korea, conflict in the Middle East, cybercriminal groups, and abuses of human rights in countries across the world.
…
Sanctions licensing
13. Licences may be issued to grant permission for certain activities to take place which would otherwise be in breach of sanctions. This ability is fundamental to the responsible design of sanctions in accordance with the UK Sanctions Strategy ... Licencing conditions vary from case to case. Licences do impact various types of transaction, such as financial payments. For example, as it is put in UK financial sanctions general guidance "In most cases, you can provide legal advice to or act for a designated person without an OFSI licence. However, you cannot receive any payment for that advice without first obtaining an OFSI licence." …
14. As Lord Justice Singh observed in Dalston Projects & ors v Secretary of State for Transport [2024] EWCA Civ 172 at [210], "sanctions often have to be severe and open-ended if they are to be effective". The responsible use of sanctions measures depends in part on the effective operation of the licensing system, administered by OFSI on behalf of HMT.
15. Licences may be granted to named individuals or entities on application to OFSI for a Specific Licence, or by a General Licence available to multiple persons on an ongoing basis subject to specific conditions. OFSI does not accept applications for General Licences. General Licences are published, whereas Specific Licences are not. This is because Specific Licences are specific to a DP and will contain personal/commercially sensitive information; they are confidential by nature to the parties they affect. The Requests in these Appeals seek information regarding whether named individuals or entities have applied for Specific Licences relating to legal services which may have been provided.
16. OFSI may only issue a Specific Licence where a valid licensing ground exists and where the conditions of that ground have been met. While these grounds vary between sanctions regimes, Specific Licences are typically available to cover the basic needs of DPs, their reasonable professional legal fees or associated expenses; to enable the satisfaction of legal obligations arising prior to the imposition of sanctions measures; and to enable the rendering of humanitarian assistance, amongst other grounds. Further, OFSI only issues licences in relation to its areas of competence: for instance, an OFSI licence does not confirm that a particular transaction as a whole is lawful under trade or transport sanctions regulations, which are governed by the Department for Business and Trade and Department for Transport, respectively.
17. Applicants applying for a Specific Licence are invited to submit a standard form … No charge is made for such applications. The application form captures detailed information concerning the basis on which the licence is sought, including—
a. Matters relevant to prioritisation, including whether (and why) the application involves a risk of harm or threat to life, or whether there are any deadlines associated with the application and what the consequences of missing them would be …;
b. Where the applicant is not a DP, particulars of their involvement with the proposed activity for which a licence is sought …;
c. Particulars of the transaction(s) to be licensed or the direction to be issued, including its UK nexus, the degree of ownership or control by the DP and a description of the relevant funds, goods or services …;
d. Particulars of the contract under which goods or services will be supplied or obtained, including the names of the parties and their agents …;
e. Whether the applicant suspects the involvement of a DP in the transaction … ;
f. Details of past and anticipated transactions or shipments linked to this application …;
g. Details of bank accounts to be used to give effect to the licence …;
h. Details of trusts within scope of the licence, including their location, registered office, names and addresses of persons operating or managing the trust and those of its beneficiaries, trustees etc., the purpose of the trust and its date of establishment, as well as the value and types of assets held in the trust ....
18. The responses to any one of these questions may contain confidential information, some of it being extremely sensitive, that is not otherwise publicly available. For example, beneficial ownership/trusts, relationships between DPs and certain entities e.g. advisers/clinics, medical information (e.g. justifying treatment), dependents, schools.
19. To inform their answers to these questions, applicants are referred to published guidance that sets out the licensing decisions taken by OFSI, entitled OFSI Designated Individuals Licensing Principles, OFSI Travel Licensing Guidance and OFSI Personal Staff Payments Licensing Guidance, which I exhibit ... These explain that applicants should provide detailed information in support of their applications, which again is likely to be of a private nature. For example, … applicants who seek permission to use a frozen asset to meet their basic needs are expected to "demonstrate how they have reduced use of that [frozen] asset to be necessary to their basic needs only". We will also require personal information such as bank details and, for example in legal fees cases, commercially sensitive information relating to the hourly rates charged by legal professionals. Other private and sensitive information may include the fact of and details of medical treatment, arrangements made for the education of dependent children and so on.
20. OFSI may ask further questions of applicants to supplement the information provided in their application forms. The onus is on the applicant to provide complete application forms to OFSI, including all relevant information, in order to avoid any delay in the licensing process and to avoid missing information. In my view, applicants and DPs would expect that applications for specific licences, including the fact of their application, will be treated with the utmost confidence. This candour is essential to the decision-making process that follows. Transparency by applicants is essential to the effective functioning of the licensing system. Licensing is there to facilitate movement of funds to or from a DP where a licensing
ground applies. Licences are an important tool to mitigate the unintended consequences of sanctions, for example they may enable a DP to live a basic lifestyle and ensure that their fundamental human rights have been met. If even the fact of somebody having sought these licences is not confidential, then DPs and those affected may be unwilling to provide full information to OFSI in their licence applications, or to apply for them in the first place, potentially leading to an ineffective licensing regime or frustrating the policy aims of allowing Specific Licenses mentioned above. This could undermine the whole sanctions infrastructure and may call into question the proportionality of a sanctions regime or a particular designation. By allowing safe spaces for the DP to share personal information, we ensure sanctions are managed effectively and that confidentiality issues do not impede any necessary enforcement action.
Other litigation pursued by Mr Hinkel
- As we have mentioned, the failed property transaction dates back to 2017. Mr Hinkel has been litigating about it ever since. None of his claims has succeeded. He seems to have begun with an action in the Central London County Court in 2018, accusing two solicitors and the legal practice of which they were members of fraud in relation to their part in certain dealings relating to the proposed transaction. The judge gave summary judgment for the Defendants. He also refused permission to appeal, as did the High Court judge to whom Mr Hinkel next turned. His repeated efforts to re-open the initial County Court adjudication seem to have finally been brought to an end in December 2021,[4] save for issues relating to the assessment of the costs awarded against him, which were back before the County Court judge in October 2022.
- In the meantime, Mr Hinkel has pursued exceedingly serious complaints of professional misconduct against a range of legal practitioners before the Solicitors Regulation Authority, the Solicitors Disciplinary Tribunal and the Bar Standards Board. These allegations have also entirely failed, prompting Mr Hinkel to issue Judicial Review proceedings, which have fared no better. Appeals in the Judicial Review litigation have been roundly rejected by the Court of Appeal, which has reaffirmed first-instance findings that he has pursued applications and arguments which are 'totally without merit', a term of art under procedural rules governing judicial review and appellate proceedings which has been authoritatively interpreted as 'bound to fail'.
- In October 2023 an Extended Civil Restraint Order ('ECRO') was made by a judge of the Court of Appeal which, as we understand it, will preclude him from pursuing certain classes of litigation (or perhaps litigation before the courts generally) until a date in 2026.
- It hardly needs to be said that rejection of his claims and appeals has resulted in Mr Hinkel incurring enormous liabilities under numerous costs awards made against him.
- In summary, having pursued a litany of claims before a host of diverse forums, Mr Hinkel has entirely failed to persuade any of the numerous decision-makers before whom he has come that there is any substance to any of his complaints and claims. As the High Court judgment handed down on 17 December 2021 spelled out, the allegations of fraud were implausible on the facts and rightly rejected by the County Court. And the alternative claims were groundless and largely misconceived in law.
- There is no sign that his chastening experiences before the courts has given Mr Hinkel pause to wonder whether his claims and arguments, or at least some of them, may be misplaced. Rather, he brands adverse rulings as unlawful and incomprehensible and even questions the integrity of appellate judges, saying that their 'only interest' was to 'protect the image of the judges in the lower courts' (see, for example, his statement of 8 October 2023, paras 13, 14 and 18).
- Although it seems safe to surmise that Mr Hinkel is a man of substantial means (the property which he was seeking to purchase had a price tag of many millions of pounds), we note that he appears to have chosen to pursue his claims, or at least a substantial proportion of them, without the benefit of legal representation. And some of the arguments which he has put forward may suggest that he has elected to proceed without even the benefit of independent professional advice. As far as we are aware, he has been entirely self-represented in the proceedings before the Tribunal.
The Law
The right to information
- FOIA, s1[5] includes:
(1) Any person making a request for information to a public authority is entitled–
(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
'Information' means information recorded in any form (s84).
- As we will explain, the obligation under s1(1)(a), known as 'the duty to confirm or deny', is disapplied in specified circumstances where the exemptions under ss40 and 41 are in play. In such cases, the public authority may reply to the request for information with a 'neither confirm nor deny' ('NCND') response.
The personal information exemption – s40
- By s40 it is provided, so far as material, as follows:
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if –
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act –
(a) would contravene any of the data protection principles …
…
(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies –
(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) –
(i) would (apart from this Act) contravene any of the data protection principles …
The language and concepts of the data protection legislation are translated into the section (subsection (7)).
- The exemption under s40(2) is unqualified where the first condition under s40(3A)(a) is satisfied.[6] Accordingly, no public interest balancing test applies. Rather, the reach of the exemption is, in some circumstances, limited by the data protection regime.
- The data protection regime under the Data Protection Act 2018 ('DPA') and the General Data Protection Regulation ('GDPR') applies to this case.
- DPA, s3 includes:
(2) "Personal data" means any information relating to an identified or identifiable living individual ...
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to —
(a) an identifier such as a name, an identification number, location data or an online identifier …
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as —
…
(d) disclosure by transmission, dissemination or otherwise making available …
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
- GDPR, Article 5 sets out the data protection principles. It includes:
Personal data shall be:
1. processed lawfully, fairly and in a transparent manner in relation to the data subject …
- Article 6, so far as material, provides:
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
…
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
- It is convenient here to give brief consideration to the law enforcement provisions under DPA, Part 3 (ss29-81). Mr Hinkel raised the matter in his notice of appeal in Appeal A, at para 21, asserting that the applicable data protection legislation was DPA, Part 3, and adding the remarkable claim that those provisions afforded 'no entitlement to privacy'.[7] We are far from being persuaded (not having received legal argument on the point) that the law enforcement regime under DPA, Part 3 is applicable to the financial sanctions system in the UK or, even if it is, that data processing in the form of a substantive response to Mr Hinkel's request would fall within the ambit of those provisions. In short: (a) there seems to be a real question whether 'the law enforcement purposes' (s31), which are focused on the criminal justice system and protection of public security, extend to the matter of financial sanctions; and in any event, (b) the data protection principles (ss35-40) are confined to the duties of the controller in the processing of personal data 'for any of the law enforcement purposes' and it is not easy to see how processing in the form of providing a substantive answer to Mr Hinkel's request would constitute processing for any law enforcement purpose.
- Further and in any event, the legislation which Mr Hinkel prays in aid argues against him. DPA, s 35(1) provides that the first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. This formulation mirrors GDPR, Article 5.1 save only that it does not include the stipulation of transparency. By DPA, s35(2) the processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either the data subject has consented or the processing is 'necessary for the performance of a task carried out for that purpose' by a 'competent authority'. If these provisions applied, the only possible 'competent authority' would be HMT. Unlike under GDPR, Article 6.1(f), there would be no scope for balancing third-party interests or other wider considerations against the legitimate interests of the data controller. Accordingly, it can immediately be seen that Mr Hinkel's reliance on the law enforcement provisions is entirely misguided. If he were right, many of the arguments open to him under GDPR, Article 5.1 and 6.1(f), in particular those which rest on what he sees as his 'legitimate interests' would not be available to him and he would be left to do battle only on the issue of 'necessity'.
- For the reasons stated, we proceed on the basis (favourable to Mr Hinkel) that we are concerned here with the general data processing regime under GDPR and not the narrower regime under the law enforcement provisions.
- Unlike the general run of information rights cases, the starting-point for the purposes of s40 is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded. At para 7 he commented:
In my opinion there is no presumption in favour of release of personal data under the general obligation that FOISA[8] lays out. The references which that Act makes to provisions of [the Data Protection Act] 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data …
- In current Guidance on Requests for Personal Data about Public Authority Employees[9], the Commissioner states (p13):
The data protection exercise of balancing the rights and freedoms of the employees against the legitimate interest in disclosure is different to the public interest test that is required for the qualified exemptions listed in section 2(3) of FOIA.
In the FOI public interest test, there is an assumption in favour of disclosure because you must disclose the information unless the public interest in maintaining the exemption outweighs the public interest in disclosure.
In the case of section 40(2), the interaction with the DPA means the assumption is reversed and a justification is needed for disclosure.
- It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, 'necessary' means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be 'necessary' there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, 'necessity' is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing exercise, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.
The information provided in confidence exemption – s41
- FOIA, s41 includes:
(1) Information is exempt information if –
(a) it was obtained by the public authority from any other person …, and
(b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.
(2) The duty to confirm or deny does not arise if, or to the extent that, the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) constitute an actionable breach of confidence.
- The exemption under s41 is absolute (see s2(3)(g)).
- The natural starting point when considering s41 is the three-part test propounded by Megarry J in Coco v A N Clark (Engineers) Ltd [1966] RPC 41 at p47, where the learned judge said this:
In my judgment, three elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself, in the words of Lord Greene MR in Saltman Engineering Co Ltd v Campbell Engineering Co Ltd,[10] must "have the necessary quality of confidence about it". Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it.
- In the present context of a dispute about a NCND response, the Coco analysis must be modified. The Commissioner submitted (response, para 26) that the following questions should be substituted:
a. If held, whether the information would have the necessary quality of confidence;
b. If held, whether the information would have been imparted in circumstances importing an obligation of confidence; and
c. Whether a confirmation or a denial that the information was held would be detrimental to any person to whom a duty of confidence would be owed if the information was held.
- While noting that developments in the case-law since the Coco judgment call into question whether the third requirement, a detriment (over and above the inherent detriment resulting from the disclosure of private and personal information), remains an essential element, Mr Hanstock, counsel for HMT, agreed that the Commissioner's proposed adaptation of the test provides a useful guide. In the absence of any direct authority on the point, it seems to us that the Commissioner's approach is effective in translating the key elements of the Coco analysis into the NCND context.
- Where the Coco test (as adapted) is satisfied, a further question will arise, namely whether the (hypothetical) action for breach of confidence could withstand a public interest defence. It is well established that any public interest defence is for the party advancing it to make good. This being so, and the exemption being absolute, it follows that the burden falls upon the requester to show that a public interest defence to the breach of confidence action would succeed. In other words, there is an in-built public interest test, but here there is a presumption against disclosure whereas, in any case where a qualified exemption is relied upon, the presumption (under FOIA, s2(1)(b)) is in favour of disclosure. That said, the presumption is a mild one. The presumption wins the day where the issues are finely balanced, but it can be displaced by an overriding public interest the other way. We direct ourselves in accordance with the following guidance of the Court of Appeal in Brevan Howard Asset Management LLP v Reuters Ltd [2017] EMLR 28 (para 75):
The only question which the Judge had to address, and which he did address, was whether the important public interest in the observation of obligations of confidence was outweighed by sufficiently significant matters of public interest in favour of publication. Unless his conclusion on that issue was one which no judge could properly reach, or he was swayed by matters he wrongly took into account or by failing to take into account matters he should have considered, his decision cannot be disturbed on appeal.
The Tribunal's powers
- The appeals are brought pursuant to the FOIA, s57. The Tribunal's powers in determining the appeal are delineated in s58 as follows:
(1) If on an appeal under section 57 the Tribunal consider –
(a) that the notice against which the appeal is brought is not in accordance with the law; or
(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.
Analysis
- Since Appeal B is much wider than Appeal A, it is convenient to consider it first.
Appeal B – s40
- Mr Hinkel did not help us (or the Respondents, or himself) by running strange and inscrutable arguments about the juridical nature of the request in Appeal B (which included, by a letter of 23 November 2023, taking the absurd stance of 'neither confirming nor denying' that it was a freedom of information request). Fortunately, at a case management hearing the following day, he accepted that it was indeed a freedom of information request. Despite subsequent contortions, he has rightly not sought formally to resile from that position and we hold him to it. (To do otherwise would not benefit him: if we were not dealing with an appeal under FOIA, the proceedings (however interpreted) would be outside our jurisdiction and fall to be dismissed at once on that ground alone.)
- The first question is whether the information in issue amounts to personal data. The answer is yes. The information is that which would be divulged by a reply to the request which confirmed or denied that HMT held the information sought by the request. Confirmation would reveal that one or more of the legal practitioners referred to in paras 7b, 7c, 8b, 8c, 8e, 8f, 9b, 9c, 9d, 9f, 9g and 9h of the request had applied for and/or been granted licences for the purposes of the relevant property transaction. (Here we respectfully differ from the Commissioner, who appeared to say (Response, para 38) that the protection of s40(5B) is available only in so far as the request is directed to the solicitors referred to in para 7b and 7c. In agreement with Mr Hanstock we see no sound basis for the distinction between them and the other individual practitioners referred to in the requests under paras 8 and 9.) Denial would reveal that none had applied for or been granted such a licence; confirmation would reveal something to the contrary. Either way, the answer would convey personal data, namely information which 'relates to' individuals who are 'identified' and 'living' (DPA, s3(2)).
- Slightly less straightforward is the question of the corporate or collective entities to which the request refers. Here again, the Commissioner considers that the request does not engage s40(5B). His view, quite simply, is that a response other than NCND would not reveal any identifiable, living individual. For HMT, however, Mr Hanstock submits to the contrary (Response, paras 25-31). Here again, we agree with him. It seems to us that a confirmation or denial in relation to any of the named bodies or corporations would reveal information 'relating to' the identified individuals because the request explicitly links each of them to a particular entity.
- We also agree with Mr Hanstock (Response, para 28) that a confirmation or denial that an application has been made by or on behalf of a corporate entity will amount to personal information relating to the DP in that it will tend to reveal the existence, or non-existence, of a relationship between the DP and the corporate entity.
- Mr Hinkel challenges the Respondents' analysis on many grounds, some of which can be understood and some not. One of his arguments (grounds of appeal, paras 19-20) is that he has not sought 'full information': his request is directed only to whether 'the solicitors and the firm applied for a licence'. That is plainly wrong as a matter of simple fact. The request is a great deal wider. But his objection misses a more fundamental point. If a request is valid, the public authority is under a legal duty to disclose all recorded information within its scope. That would include all information generated by any licence application. As the Commissioner points out (Response, para 44), it is not open to the public authority to meet a request with a 'yes or no answer'.
- In so far as the information relates to any relevant individuals, it is the personal data of those individuals, and so exempt under FOIA, s40(2) if any of the three 'conditions' referred to in that subsection applies. The only relevant condition is that disclosure would contravene any of the data protection principles (subsection (3A)(a)). The relevant data protection principles are those provided for under GDPR, Article 5.1 and Article 6.1(f).
- The threshold question here is whether, at the time of the request, Mr Hinkel was pursuing a 'legitimate interest'. He was very clear at the outset about the interest which his request sought to promote. It was to vindicate his numerous allegations of fraud and sustain or revive numerous pieces of litigation based on those allegations. More recently he has tended in addition to cite public interest grounds. We prefer not to speculate as to why his case seems to have broadened in that way. It would not be proportionate to do so and in addition, we have reminded ourselves that our focus must be on events as they stood at the time of the request. As at that date, was Mr Hinkel pursuing a legitimate interest? We proceed on the footing that he was and remains sincere in his belief that his rights have been violated and that his exceedingly serious allegations against numerous individuals are well-founded. But sincerity will not always be enough. In our view, given the disastrous litigation history dating back to 2018, prosecution of his extraordinary campaign, run (it seems) very largely without legal advice, based on contentions and arguments repeatedly found by distinguished judges to be 'totally without merit', attracting massive costs penalties and culminating in an Extended Civil Restraint Order on 4 October 2023, could no longer be regarded at the date of the request (23 October 2023) as representing a 'legitimate interest'. The language of GDPR, Article 6.1(f) does not, in our view, connote a subjective test. Rather, the Tribunal must enquire whether, objectively, the interest was legitimate. We find that, certainly by the date of the request, it was anything but. Nor are we persuaded that, at the date of the request at least, Mr Hinkel was motivated to any material extent by any nobler secondary interest in promoting the effective operation of the financial sanctions system. It seems to us that if he has developed any such genuine interest since, he did so later and even then it was never more than a minimal influence upon his actions. We bear in mind that he has chosen to present his case in written form. The meagre evidence presented before us is quite inadequate to make out a secondary purpose capable of being seen as legitimate.
- If we are right so far, Mr Hinkel's case under s40 collapses at this point. But we will complete the analysis. Assuming (contrary to our finding) a legitimate interest in pursuing (notionally) tenable claims to recover substantial losses, the question whether any processing of personal data is 'lawful' next engages the issue of 'necessity'. Since we are here faced with a challenge to a NCND response, the question is whether the disclosure of the information which would result from a substantive response to the request would have been, at the time of the request, necessary (ie reasonably necessary) for the purposes of any legitimate interest which Mr Hinkel established. In our view, even on this hypothesis, the answer is no. The legitimate interest was achievable by the conventional means of bringing appropriate proceedings in an appropriate form, at an appropriate time, before an appropriate court or tribunal. It was never reasonably necessary to invoke the freedom of information legislation in order to promote the (assumed) legitimate interest. On the contrary, use of FOIA as a procedural weapon in parallel litigation before the courts seems to us to amount to an abuse of the process or something very close to that.
- On our reasoning so far, Mr Hinkel fails to establish a legitimate interest and further fails to demonstrate that, even if there was a legitimate interest, recourse to FOIA was 'necessary' for the purposes of that interest. At this point, it must be said that the appeal comprehensively fails. In these circumstances, it would not be proportionate to devote much time and energy to further analysis. But it is appropriate to make several additional points quite briefly.
- The first observation we would make is that Mr Hinkel's entire case very largely rests on the unsubstantiated (and, in distinguished judicial company, we would say highly unpromising) assertion of fraud. Time and again, his reasoning is premised on the assumption that the legal professionals on whom he trains his fire have committed fraud. On that foundation, he mounts the argument that it is 'necessary' for him to receive an answer to his request. To state the obvious, this is an impermissible, question-begging argument, that is to say an argument which starts by assuming what it sets out to prove.
- Our second observation is that the processing contended for is not the only reasonable means by which any relevant legitimate interest can be, or might have been, pursued (see the Halpin case cited above). In particular, the legal professionals against whom Mr Hinkel has directed his fire operate in a disciplinary and regulatory environment in which all proper complaints and allegations can be ventilated and examined. He has availed himself of those avenues of inquiry. The fact that doing so has left him dissatisfied and that no successful appeal has eventuated is not a reason to disregard the opportunities which have been open to him. Similar means of raising inquiries and, if so minded, airing grievances and complaints, must also be available in respect of professional indemnity insurers.
- Third, Mr Hinkel's 'necessity' argument fails for the further reason that it is impossible to argue that the disclosure which would result from a confirm or deny response would amount to the minimum interference with data subjects' privacy rights needed to secure any legitimate interests which might be assumed in his favour. The fact that he has (or has had) other means of redress available to him argues compellingly against the view that disclosure would be a proportionate measure in keeping with the principle in the R v Minister for the Cabinet Office case (see above).
- Fourth, it is elementary that disclosure under FOIA is disclosure to the whole world. It is plainly not 'necessary' to disclose to the whole world the material which a substantive response to the question would reveal, and it would be disproportionate and wrong in principle to do so. Disclosure of such material by other means (for example pursuant to an order for discovery in litigation under the control of a court) would not be to the whole world and any recipient would be under a duty of confidence in holding and using it. Had his High Court claims against the solicitors not failed in limine, no doubt Mr Hinkel would have been in a good position to press for disclosure in that litigation of documents relating to any relevant licence. The fact that those claims have fallen away as being entirely unmeritorious cannot justify him pursuing the same objective in this quite inappropriate forum.
- Fifth, on our analysis, we do not get to the point of balancing competing interests at all. Mr Hinkel does not get his appeal off the ground. But if it were otherwise, we would unhesitatingly find that the factors examined below in relation to the s41 appeal, taken in conjunction with the structural bias in the system which favours privacy rights over information rights, militate comprehensively against the appeal and in favour of upholding the NCND response.
- Finally, we should return to Mr Hinkel's apparent reliance on the law enforcement provisions. In light of our discussion above, we consider the provisions inapplicable. But if we had thought them applicable, we would have held that they lent no support to his case. To the contrary, we would have found that they narrowed and diminished the arguments available to him. His throwaway assertion that they exclude privacy rights is unexplained and seems to us to be entirely groundless.
Appeal B – s41
- In our judgment, the exemption under s41(2) is also made out. Again, we have a number of reasons. In the first place, while the sanctions regime itself is inherently, and necessarily, a public affair, the licensing system which is an essential component of it is inherently, and necessarily, a private matter between OFSI and the parties involved. It is concerned with information which is very often highly sensitive. In respect of DPs, the information may bear upon matters such as personal safety, individual dignity, personal, professional and commercial connections and relationships and third-party interests (including, for example, those of dependent children). In respect of applicants for licences, the information may bear upon matters such as commercial and trading history, prior connection with the DP(s), budgets and charging rates. Information generated by licensing applications plainly has a highly confidential character.
- Second, a corollary of the first point, information is communicated under the licensing system with the expectation that it will be treated confidentially. This derives not merely from the character of the subject-matter but also from the fact that the licence application process, in line with OFSI guidance, operates throughout on a confidential footing.
- Third, confidentiality is essential to the proper functioning of the licensing system. Without it, the sharing of information which is needed in order for OFSI to maintain the rigour of the sanctions regime while mitigating its most harsh and undesirable consequences would be liable to be undermined.
- Fourth, a substantive answer to Mr Hinkel's request would, in our view, convey information having the necessary 'quality of confidence' about it. Confirmation that a licence had been granted would connote that the DP had received, or been authorised to receive, professional advice and/or been permitted to engage in certain commercial activity. That, in itself, would be information of a confidential kind. Confirmation that a licence had been applied for would tend to reveal a link or connection between the applicant and the DP. A denial that any application had been made would convey something about the professional practice of the putative applicant. In the context of an inherently confidential process, we are satisfied that any of these responses would convey information with the requisite quality of confidence.
- Fifth, a substantive answer to Mr Hinkel's request would also, we think, convey information imparted in circumstances importing an obligation of confidence. The confidential nature of the licensing system and the corresponding expectation on the part of those participating in it clearly warrant that assessment.
- Sixth, we also consider that a substantive answer to the request would amount to unauthorised use of the information by OFSI, which would operate to the detriment of the parties communicating it. It may be that the law now treats any unauthorised disclosure as inherently detrimental. Whether it does or not, it seems to us clear that detriment would result to the solicitors and the DP. They would be deprived of their justifiable expectation of privacy in respect of commercial and professional activity. Further and more substantial detriments might also result. For example, disclosure that no licence was granted might well prompt assumptions of wrongdoing on the part of the DP, the solicitors for both which might be entirely unjustified and could result in reputational damage.
- Seventh and more generally, we consider that our reasoning above on the data protection principles (in relation to the s40 exemption) is, to a large extent, also applicable here and tends firmly against this appeal.
- For all of these reasons, stepping back and applying the built-in public interest test under s41 read in the light of the Coco analysis (as modified), we are in no doubt that Mr Hinkel's somewhat confected transparency arguments must give way to the compelling public interest in protecting information communicated in confidence. The structural presumption in favour of maintaining the exemption is nowhere near rebutted.
Appeal A
- Our analysis under Appeal B is determinative of Appeal A. That appeal must be dismissed for the reasons we have given in relation to Appeal B.
Result
- This is a very clear case. The processing of personal data for which Mr Hinkel contends would plainly be unlawful. Accordingly, the request is for information which is exempt under s40(2). Further, the exemption under s41 is also engaged. Both exemptions are absolute.
- It follows that the appeals must be dismissed.
(Signed) Anthony Snelson
Judge of the First-tier Tribunal
Dated: 2 June 2025
Note 1 A unit within HMT, to which we will refer by its initials, OFSI. [Back]
Note 2 Unless otherwise stated, all section numbers mentioned hereafter refer to FOIA. [Back]
Note 3 See the First-tier Tribunal (General Regulatory Chamber) Rules 2009 (as amended), rule 2. [Back]
Note 4 It is not clear to us whether Mr Hinkel attempted to persuade the Court of Appeal to entertain a challenge to the High Court’s rejection of his appeal. If so, it certainly failed. [Back]
Note 5 Unless otherwise stated, all references to section numbers hereafter are references to FOIA. [Back]
Note 6 See FOIA, s2(3)(fa). [Back]
Note 7 See the Notice of Appeal in Appeal A, para 21. He may (or may not) have repeated the argument in Appeal B. At all events, we treat the point as ‘live’ for the purposes of both appeals. [Back]
Note 8 The proceedings were brought under the Freedom of Information (Scotland) Act 2000, but its material provisions do not differ from those of FOIA. [Back]
Note 9 [Back]
Note 10 [1948] 65 RPC 203 [Back]