BAILII
British and Irish Legal Information Institute


Freely Available British and Irish Public Legal Information

[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]

First-tier Tribunal (General Regulatory Chamber)


You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Smart v Information Commissioner [2025] UKFTT 679 (GRC) (11 June 2025)
URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/679.html
Cite as: [2025] UKFTT 679 (GRC)

[New search] [Printable PDF version] [Help]

Neutral Citation Number: [2025] UKFTT 679 (GRC)
Case Reference: FT/EA/2024/0213

First-tier Tribunal
General Regulatory Chamber
Information Rights

Decided without a hearing
Decision Given On: 11 June 2025

B e f o r e :

JUDGE STEPHEN ROPER
MEMBER PIETER DE WAAL
MEMBER JO MURPHY

____________________

Between:
JOHN SMART
Appellant
- and -

THE INFORMATION COMMISSIONER
Respondent

____________________


____________________

HTML VERSION OF DECISION
____________________

Crown Copyright ©

    Decision: The appeal is Dismissed

    REASONS

    Preliminary matters

  1. In this decision, we use the following terms to denote the meanings shown:
  2. Appellant: John Smart.
    Authority: Office of the Police and Crime Commissioner for Cheshire.
    Commissioner: The Information Commissioner (the Respondent).
    Decision Notice: The Decision Notice of the Commissioner dated 13 May 2024, reference IC-301915-Y3Z0, relating to the Request.
    Disputed Information: The information in item numbered 3 of the Request.
    DPA: The Data Protection Act 2018.
    Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 23).
    FOIA: The Freedom of Information Act 2000.
    Previous Decision Notice: The Decision Notice of the Commissioner dated 6 February 2024, reference IC-256179-W0Q0, relating to the Request.
    Public Interest Test: The test, pursuant to section 2(2)(b) (set out in paragraph 26), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information.
    Reply: The Appellant's reply to the Response.
    Request: The request for information made to the Authority by the Appellant dated 20 June 2023, as set out in paragraph 5.
    Response: The Commissioner's response to the appeal.
    UK GPDR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.

  3. Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:
  4. a. to numbered paragraphs are references to paragraphs of this decision so numbered;

    b. to any Article are references to the applicable Article of the UK GDPR;

    c. to any section are references to the applicable section of FOIA.

    Introduction

  5. This was an appeal against the Decision Notice, which (in summary) decided that the Authority could rely on section 40(2) to withhold the Disputed Information.
  6. Background to the Appeal

  7. The background to the appeal is as follows.
  8. The Request

  9. On 20 June 2023, the Appellant contacted the Authority and requested information in the following terms:
  10. "Can you please let me know:

    1. How many staff are employed in the PCC's office?

    2. How many of the employees have served in the police?

    3. What were the roles of those who have served in the police?".

  11. On 18 July 2023, the Authority responded. It provided a weblink in respect of item numbered 1 of the Request, which showed the structure of the Authority. The Authority refused to confirm or deny whether it held the other information in the Request, citing section 40(5).
  12. The Appellant was dissatisfied with the response to items numbered 2 and 3 of the Request and, following a compliant to the Commissioner, the Commissioner issued the Previous Decision Notice.
  13. In the Previous Decision Notice, the Commissioner required the Authority to:
  14. a. confirm or deny whether any information was held within the scope of items numbered 2 and 3 of the Request;

    b. if such information was held, to either disclose it or issue a refusal notice explaining why it is exempt from disclosure.

  15. In connection with the Previous Decision Notice, the Authority clarified with the Appellant that he wished to know the officers' current roles in the Authority (as opposed to any previous roles they had as serving police officers).
  16. Following that clarification, the Authority responded to the Appellant on 5 March 2024, confirming that it held information within the scope of items numbered 2 and 3 of the Request. It provided a response to item numbered 2 of the Request, to the effect that three employees within the Authority formerly served in the police. The Authority refused to disclose the Disputed Information, stating that it was the personal data of the three employees concerned.
  17. The Appellant contacted the Authority on 7 March 2024, requesting an internal review.
  18. On 10 April 2024, the Authority responded, upholding its previous position.
  19. The Appellant contacted the Commissioner on 17 April 2024 to complain about the Authority's response to the Request and the Commissioner subsequently issued the Decision Notice.
  20. The Decision Notice

  21. The Decision Notice recorded that the scope of the Commissioner's investigation was to consider the application of section 40 to the Disputed Information.
  22. In the Decision Notice, the Commissioner decided that the Authority was entitled to rely on section 40(2) to refuse to disclose the Disputed Information. The Commissioner did not require the Authority to take any steps.
  23. The appeal

    The grounds of appeal

  24. The Appellant stated in his notice of appeal that the outcome he was seeking was to be provided with an answer to the third item in the Request – namely, to be informed of the roles of those staff in the Authority who had served with the police. The Appellant's grounds of appeal appear to have been based on his view that the Office of the Police and Crime Commissioner for Surrey had published the names of key staff together with their roles and that the Appellant accordingly considered that the Authority should accordingly be required to disclose the Disputed Information.
  25. The Tribunal's powers and role

  26. The powers of the Tribunal in determining the appeal are set out in section 58, as follows:
  27. "(1) If on an appeal under section 57 the Tribunal considers—

    (a) that the notice against which the appeal is brought is not in accordance with the law, or

    (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

    the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

    (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.".

  28. In summary, therefore, the Tribunal's remit for the purposes of the appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a 'full merits review' of the appeal before it (so far as the Decision Notice is concerned).
  29. Mode of hearing

  30. The parties consented to the appeal being determined by the Tribunal without an oral hearing.
  31. The Tribunal considered that the appeal was suitable for determination on the papers in accordance with Rule 32 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 and was satisfied that it was fair and just to conduct the appeal in this way.
  32. The evidence and submissions

  33. The Tribunal read and took account of an open bundle of evidence and pleadings.
  34. All of the contents of the bundle, including all the submissions of the parties, were taken into account, even if not directly referred to in this decision.
  35. The relevant statutory framework[1] and legal principles

    General principles

  36. Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides:
  37. "Any person making a request for information to a public authority is entitled—

    (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

    (b) if that is the case, to have that information communicated to him.".

  38. In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides:
  39. "Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.".

  40. Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.
  41. Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides:
  42. "In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

    (a) the information is exempt information by virtue of a provision conferring absolute exemption, or

    (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.".

  43. The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). Section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied.
  44. Accordingly, in summary, the exemption to the Duty to Disclose in section 40(2) is an absolute exemption only in cases where that first condition is satisfied, otherwise the exemption is subject to the Public Interest Test.
  45. Section 40 – personal information

  46. So far as is relevant for the purposes of the appeal, section 40 provides:
  47. "…(2) Any information to which a request for information relates is also exempt information if—

    (a) it constitutes personal data which does not fall within subsection (1), and

    (b) the first, second or third condition below is satisfied.

    (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

    (a) would contravene any of the data protection principles…".

  48. Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:
  49. a. Section 3(2) of the DPA defines "personal data" as "any information relating to an identified or identifiable living individual". The "processing" of such information includes "disclosure by transmission, dissemination or otherwise making available" (section 3(4)(d) of the DPA) and so includes disclosure under FOIA.

    b. The "data protection principles" are those set out in Article 5(1) and section 34(1) of the DPA.

    c. The first data protection principle, in Article 5(1)(a), is that personal data shall be: "processed lawfully, fairly and in a transparent manner in relation to the data subject".

    d. A "data subject" is defined in section 3 of the DPA and means "the identified or identifiable living individual to whom personal data relates".

  50. To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1). One such basis is where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child" (Article 6(1)(f)).
  51. Article 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.
  52. The Legitimate Interests Test

  53. The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court's judgment in the case of South Lanarkshire Council v Scottish Information Commissioner[2]:
  54. "(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

    (ii) Is the processing involved necessary for the purposes of those interests?

    (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?".

  55. The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be: 'Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?'. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.
  56. It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.
  57. The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb can be considered.
  58. For the purposes of the second limb of the Legitimate Interests Test, case law has established that the term "necessary" means something which is more than desirable but less than indispensable or absolute necessity. Therefore the test is one of "reasonable necessity". The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the "least restrictive" means of achieving the legitimate interest in question).
  59. Discussion and findings

    The scope of the appeal

  60. As we have noted, the Decision Notice addressed only the issue of the Disputed Information (not the other aspects of the Request). Given that the Authority responded to the other aspects of the Request and the Appellant has made no complaint regarding those responses, our decision therefore likewise addresses only the Commissioner's findings in the Decision Notice that the Authority was entitled to rely on section 40(2) to refuse to disclose the Disputed Information.
  61. We would also briefly comment that the Appellant's grounds of appeal made reference to matters such as allegations regarding a police sergeant perverting the course of justice, but such matters fall outside the scope of this appeal (see paragraphs 17 and 18) and accordingly we have not addressed them in this decision.
  62. The 'burden of proof'

  63. We note that the Commissioner submitted (in his Response) that the burden of proof is upon the Appellant – essentially, that it is for the Appellant to demonstrate that the Decision Notice is not in accordance with the law.
  64. The Commissioner provided no legal authority to support that view, other than a decision of a First-tier Tribunal. Other decisions of the First-tier Tribunal are not binding on us. Various other authorities[3] have confirmed that the role of the Tribunal is to undertake a 'fresh review' of the Authority's response to the Request and that the Tribunal exercises a 'full merits appellate jurisdiction' and essentially 'steps into the shoes' of the Commissioner.
  65. In dealing with a complaint pursuant to section 50, the Commissioner does not make a resulting decision on the basis that the complainant or the public authority manages or fails to discharge any purported burden of proof. It is no different for the Tribunal's decision.
  66. Accordingly, in our view, the appeal does not involve a question of whether the Appellant has discharged a burden of proof. Our role, rather, was to consider all of the evidence in order to determine whether or not the Decision Notice involved an error of law, in accordance with our powers under section 58 of FOIA.
  67. Was the Authority entitled to rely on section 40(2) to withhold the Disputed Information?

  68. In assessing whether section 40(2) is engaged, the starting point is to determine that the information in question constitutes personal data which is not the personal data of the person making the Request (the Appellant), as specified in section 40(2)(a).
  69. There was no dispute between the parties that the Disputed Information constituted the personal data of the relevant members of staff within the Authority and we consider that it was also self-evident from the nature of the Disputed Information. We therefore find that the first limb of section 40(2) – namely section 40(2)(a) - is satisfied.
  70. Turning to the second limb of section 40(2) – namely, section 40(2)(b) - in order for the Disputed Information to be exempt from disclosure, the first, second or third condition referred to in that subsection must be satisfied. We consider that the first condition is relevant for the purposes of the appeal and that the most relevant data protection principle is the first data protection principle we have referred to. In considering whether the processing of the personal data in question is lawful, in our view the most applicable lawful basis for processing is the Legitimate Interests Basis.
  71. It may be helpful to first reiterate the Legitimate Interests Basis. It provides: "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...". Translating that language to the context of the appeal:
  72. a. the disclosure of the Disputed Information would be 'processing';

    b. the Appellant is the 'third party'; and

    c. the relevant staff members (as the individuals in respect of whom the Appellant was seeking information by way of the Request) are the 'data subjects'.

  73. As the applicable lawful basis for processing is the Legitimate Interests Basis, it is therefore necessary to address the Legitimate Interests Test, starting with the first limb of it.
  74. The Appellant stated in his grounds of appeal that "Police and Crime Commissioners were established to give the public an oversight of the police.". He also stated in his notice of appeal that "It is obvious that those who seek to represent the public are open about their background and experience for the public to have confidence in what they are doing. In Cheshire's case I believe that the OPCC are trying to hide their allegiance to the police rather than the public.".
  75. The Commissioner, in his Response, considered that the Appellant was therefore arguing that, for the purposes of section 40(2):
  76. a. there is a legitimate interest in the public knowing the background/experience of individuals working for the Auth; and

    b. the disclosure of the Disputed Information is necessary to meet that legitimate interest.

  77. The Commissioner accepted that the Appellant was pursuing a legitimate interest by way of the Request, for the purposes of the first limb of the Legitimate Interests Test. The Commissioner stated in his Response that he had accepted, at paragraph 43 of the Decision Notice, that there was a general interest in understanding the profile of employees within such offices. Paragraph 46 of the Decision Notice also referred to that legitimate interest as part of the Commissioner's consideration of the second limb of the Legitimate Interests Test.
  78. We find that the Appellant's aims in seeking the Disputed Information were to understand whether the Authority, as an organisation whose role is give the public an oversight of the police, was sufficiently independent of the police and to seek transparency in that regard. We find that such aims are legitimate and accordingly that there were legitimate interests being pursued by the Appellant by way of the Request.
  79. The second limb of the Legitimate Interests Test involves ascertaining whether the relevant processing is necessary for the purposes of those legitimate interests. As we have noted:
  80. a. the 'processing' of personal data includes disclosure under FOIA; and

    b. this test of 'reasonable necessity' must be met before the third limb of the Legitimate Interests Test can be considered.

  81. The Commissioner's position in the Decision Notice was, in essence, that the disclosure of the Disputed Information would be unnecessary and therefore that the processing would be unlawful.
  82. As we have mentioned, the Appellant referred to the Office of the Police and Crime Commissioner for Surrey publishing the names of key staff together with their roles. It is not appropriate for us to address issues regarding the alleged disclosure of staff information by the Office of the Police and Crime Commissioner for Surrey (or any other organisation). Rather, for the purposes of the appeal, it was necessary for us to assess matters in respect only of the Disputed Information in considering the potential engagement of section 40(2), regardless of any previous disclosure of staff information by any third party.
  83. Related to the preceding point, the Commissioner submitted in his Response that the Authority's website also provides profiles for certain of its senior staff, including their names, salaries and key responsibilities. In his Reply, the Appellant questioned whether the staff who previously served in the police were engaged by the Authority in 'executive' roles or in 'administrative' roles. Wanting to know whether staff were engaged in 'executive' roles or in 'administrative' roles was not specified in the Request. We appreciate that disclosure of the Disputed Information might reveal whether the roles are 'executive' or 'administrative' in nature, but for the purposes of the appeal we can only consider the Request as originally worded.
  84. The Decision Notice recorded (albeit in the section addressing the first limb of the Legitimate Interests Test) the Commissioner's view that, in essence, it would not be proportionate to disclose the current roles of the relevant members of staff, given that the Authority had disclosed the number of staff who had served with the police, and therefore such disclosure was sufficient to address the Appellant's legitimate interest. In particular, the Commissioner considered that such disclosure addressed the Appellant's concerns that the Authority had been "hijacked by ex policemen (policewomen?)" and "taken over by ex-police" (raised by the Appellant in his request for an internal review by the Authority and in his complaint to the Commissioner, respectively).
  85. The Decision Notice also recorded the Commissioner's views that the Request required details of the current roles of the relevant staff, not their former roles, and therefore that disclosure of the current roles would not assist in ascertaining whether any of them were previously officers within Cheshire Police. Accordingly, the Commissioner considered that the Appellant's concerns regarding 'independence' from the police would not be learned from disclosure of the Disputed Information.
  86. In his complaint to the Commissioner, the Appellant stated that it was "crucially important for the public to know what the roles of the ex policeman are". However, as noted in paragraph 41 of the Decision Notice, the Appellant has not explained why it was of such importance. In his Reply, the Appellant stated that failure to disclose the Disputed Information "will inevitably lead to suspicions that they are not being honest with the public". However, that is just the opinion of the Appellant and we consider, in any event, that disclosure of the Disputed Information would not be necessary to satisfy that concern, especially given the disclosure by the Authority of the numbers of staff engaged by it who have previously served with the police.
  87. We find, for the reasons we have referred to, that the relevant processing is not reasonably necessary and proportionate for the purposes of the legitimate interests being pursued by the Appellant. In other words, in respect of the second limb of the Legitimate Interests Test, we find that disclosure of the Disputed Information would not be 'necessary' (within the meaning established by case law) for the purposes of those legitimate interests.
  88. Given that the second limb of the Legitimate Interests Test has not been satisfied, this precludes consideration of the third limb of the Legitimate Interests Test.
  89. As disclosure is not necessary, this means that there is no lawful basis for disclosure/processing of the Disputed Information and it would therefore contravene the data protection principles.
  90. For all of the reasons we have given, we find that section 40(2) is engaged in respect of the Disputed Information and that the first condition referred to in that section is satisfied. Accordingly, the exemption in that section is an absolute exemption and there is no requirement to consider the Public Interest Test.
  91. Final conclusions

  92. For all of the reasons we have given, we find that the Decision Notice was correct to conclude that the Authority was entitled to rely on the exemption in section 40(2) to refuse to disclose the Disputed Information.
  93. We therefore dismiss the appeal.
  94. Signed: Stephen Roper

    Judge of the First-tier Tribunal

    Date: 9 June 2025

Note 1   We acknowledge the Practice Direction dated 4 June 2024 (https://www.judiciary.uk/guidance-and-resources/practice-direction-from-the-senior-president-of-tribunals-reasons-for-decisions/) and particularly paragraph 9, which refers to the First-tier Tribunal not needing to specifically refer to relevant authorities. We include references to the applicable legislative framework, to provide relevant context, but (apart from the reference to the Legitimate Interests Test) have accordingly not referred to the applicable case law.    [Back]

Note 2   [2013] UKSC 55, paragraph 18    [Back]

Note 3   Including, in particular, Birkett v Department For The Environment, Food and Rural Affairs [2011] EWCA Civ 1606, Information Commissioner v Home Office [2011] UKUT 17 (AAC) and Information Commissioner v Malnick [2018] UKUT 72 (AAC).    [Back]

About BAILII - FAQ - Copyright Policy - Disclaimers - Privacy Policy amended on 25/11/2010