United Kingdom Information Tribunal including the National Security Appeals Panel

You are here: BAILII >> Databases >> United Kingdom Information Tribunal including the National Security Appeals Panel >> Harcup v Yorkshire Forward [2008] UKIT EA_2007_0058 (5 February 2008)
URL: http://www.bailii.org/uk/cases/UKIT/2008/EA_2007_0058.html
Cite as: [2008] UKIT EA_2007_58, [2008] UKIT EA_2007_0058

[New search] [Printable PDF version] [Help]





Information Tribunal Appeal Number: EA/2007/0058 Information Commissioner’s Ref: FS50091142

Considered on the papers On 3 January 2008		Decision Promulgated 5 February 2008

BEFORE	CHAIRMAN Mr H Forrest and LAY MEMBERS Mr R Creedon Mr D Wilkinson Mr Tony Harcup and INFORMATION COMMISSIONER and			Appellant
Between				Appellant
Between				Respondent

Yorkshire Forward			Additional Party

Decision The Tribunal allows the appeal and substitutes the following decision notice in place of the decision notice dated 5 June 2007.

1



	Appeal Number: EA/2007/0058

	Information Tribunal Appeal Number: EA/2007/0058 SUBSTITUTED DECISION NOTICE Dated: 5 February 2008 Public authority: Yorkshire Forward Address of Public authority: Victoria House, Victoria Place, Leeds, LS1 5AE Name of Complainant: Mr Tony Harcup The Substituted Decision For the reasons set out in the Tribunal’s determination, the substituted decision is that: 1. Yorkshire Forward should not have substantially ignored Mr Harcup’s request for information about those organisations and individuals who had received corporate hospitality organised by Yorkshire Forward. 2. Yorkshire Forward was not entitled to withhold the names of the individuals that had attended events or corporate hospitality organised by it as these did not constitute personal data within section 1 of the Data Protection Act; and therefore the exemption in section 40(2) of the Freedom of Information Act did not apply; (provided that in releasing both names of individuals and the organisations they represented, the two could not be correlated). 3. However, it is clear that the cost of providing such data would have exceeded the cost limit set by section 12 of the Freedom of Information Act, and Yorkshire Forward are not therefore obliged to release the information requested.

	Dated this 5^th day of February 2008 Humphrey Forrest Deputy Chairman, Information Tribunal

	2



	Appeal Number: EA/2007/0058

	Reasons for Decision Introduction 1. Yorkshire Forward (YF) is a public authority whose duties include promoting business in Yorkshire. To this end, it organises a number of training events and seminars, and provides corporate hospitality on occasion. The request for information 2. On 28 June 2005 Mr Harcup made a request under the Freedom of Information Act (FOIA) for “All information relating to Yorkshire Forward’s corporate hospitality, events and entertainment of potential clients, members of the business community, politicians and other guests from 2003 to date: including, but not restricted to dinners, lunches, breakfasts, drinks receptions, awards ceremonies, and the use of hospitality boxes or tickets for sporting or other events. I would like to see the amount spent, broken down per event and lists of guests attending (including which organisation they represented, if any), again broken down by event. I would also like to see any reports relating to any such event in particular or to corporate hospitality in general.” 3. On 4 July 2005, YF replied: “We recently dealt with a similar enquiry and I have attached everything we could supply based on the data we have available, which covers all activity from 2002. Unfortunately we are unable to supply you with the details of delegates who attended our events as this is against the Data Protection Act”. 4. The letter went on to provide a substantial amount of information. The bulk of this related to events in Yorkshire in 2002 to 2005, with some financial information. After further correspondence, some more information was provided. Mr Harcup remained dissatisfied with the response, which included an internal review. In the review response, 27 September 2005, YF argued that the cost of providing any more information requested would exceed the limit of £450, and therefore they were not obliged to respond further, under section 12 of FOIA. The complaint to the Information Commissioner 5. Mr Harcup complained to the Information Commissioner (IC) on 10 October 2005. His “major complaint” was that YF had used the exemption in section 40(2) of the Data Protection Act (DPA) to withhold the names of delegates, but he also complained generally about the information supplied. 6. In his Decision Notice, dated 5 June 2007, the IC found some procedural breaches of section 17 of FOIA; found that YF had correctly applied the exemption for personal data in section 40(2) when it declined to provide the names of individuals, but held that this exemption had been incorrectly applied in relation to the names of 3



	Appeal Number: EA/2007/0058 the organisations involved; and required YF to disclose “the names of the organisations represented by attendees at corporate events hosted by YF from 2003 to 28 June 2005.” YF have since provided those names. The appeal to the Tribunal 7. In his appeal to the Tribunal Mr Harcup argues that the IC and YF have wrongly interpreted the definition of personal data, relying on the decision of the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746 to argue that information relating solely to official or business capacity (such as attendance at a publicly funded corporate event) should not be classed as personal data. Secondly, he argued that in principle it is not unfair if individuals attending such publicly funded events lose any expectation of privacy, and that there is a public interest in disclosing their names. The questions for the Tribunal 8. At a hearing for Directions on 10 September 2007, the issues in the appeal were set out: The issues arising for determination in this appeal include: a. whether the disputed information amounts to personal data at all, having regard in particular to the decision in Durant v Financial Services Authority; b. if it is personal data, whether the exemption in section 40(2) of the Freedom of Information Act applies; c. if the exemption does not apply, whether Yorkshire Forward are entitled to refuse disclosure on the ground that the cost of disclosing the information would exceed the limit provided in section 12 of FOIA. 9. However, during the appeal, it became apparent from the witness statements served by YF that YF operated a clear internal dividing line between “events” and “corporate hospitality”; and that the vast majority of the information they had supplied related to “events”: that part of Mr Harcup’s original request which related to corporate hospitality had never been addressed, save for some financial information. We have also considered in our decision how this issue might be dealt with. Evidence 10. We considered an agreed bundle of documents setting out correspondence between the parties, and the information disclosed; and witness statements from Mr Harcup; and from Ms RE Mason, corporate information officer for YF and Ms TM Lindsay, head of marketing and business development. 11. The events organised by YF include internal events for staff, including briefings and an annual conference; corporate events such as the Regional Economic Strategy Review, including key organisations such as the CBI, IoD, Local Authorities, MPs, Higher Education Institutes and Urban Regeneration Companies who contribute and shape key areas of policy; and external events such as overseas trade shows, and large scale business conferences. Events may be organised centrally by the

	4



	Appeal Number: EA/2007/0058

	Communications Team within YF, or by any of 4 separate Directorates. The information provided to Mr Harcup, at least initially, came from information provided only by the Communications Team, and therefore only related to those events organised centrally. We have been given no hard information about the scale or numbers of such events, but an indication can be gained from the number of organisations named in response to the IC’s direction that Mr Harcup be given the names of organisations attending: the 72 pages listing the organisations contain over 3000 names. The list is not broken down by event. If events organised by the separate Directorates had been included, numbers would presumably have been significantly larger. The organisations involved are from a mix of public and private sector organisations, and also from the professional, educational, charitable and voluntary sectors. 12. Delegate lists are provided at some events, giving names and organisations of those attending. The press and media are invited to some events, and invited to photograph or film delegates for publication. Those registering to attend events provide their personal details against an assurance: The Data Protection Act. The information supplied on this form will be retained by YF on a database and will be used to update our records and to contact you with information about relevant initiatives, services or opportunities that we believe might be of interest to you. Your details will be stored securely and will not be released to any other organisation. YF is the Data Controller for your information. 13. Because of the specific and restricted definition of “events” adopted by YF, which excludes corporate hospitality, little information about corporate hospitality was provided by YF, save that it is not organised or recorded centrally, (though some financial information may be held centrally). 14. YF estimate that even though much of the information provided initially to Mr Harcup had already been provided in response to another request, and so was available, some 4.5 hours were spent locating, retrieving and extracting the information to make it more specific to Mr Harcup’s request. Providing the names of the organisations involved in events required 9 hours work. So far, therefore YF have spent 13.5 hours responding to Mr Harcup’s request, which at the charging rate of £25 ph, set by the Regulations, comes to £338. 15. It would take the Communications Team some 5 further hours to provide the full information requested by Mr Harcup in relation to events organised centrally by them; and a further five hours for each of the 4 Directorates that organise their own events, a total of 25 further hours. In addition, the Finance Manager estimates that it would require 3 weeks work of 37 hours (111 hours) to provide the detailed financial breakdown requested, for each event. Providing information about corporate hospitality events would require a further 25 hours. Legal Framework 16. Section 1 of FOIA provides a basic entitlement to have information held by a public authority communicated to a person who requests it. That right is subject to a number of exemptions, including the exemption in section 40.

	5



	Appeal Number: EA/2007/0058 17. Section 40 of FOIA provides, so far as material: (2) Any information to which a request for information relates is also exempt information if – (a) it constitutes personal data which do not fall within subsection (1), and (b) either the first or second condition below is satisfied. (3) the first condition is - (a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene – (i) any of the data protection principles …., and (b) in any other case, that the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions contained in section 33A(1) of the Data protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

	Section 40(7) of FOIA gives “personal data” “the same meaning as in section 1(1) of the Data Protection Act”. That provides: DPA section 1(1) Personal data means data which relate to a living individual who can be identified – (a) from those data, or (b) from those data and other information which is in the possession, or is likely to come into the possession of, the data controller. The data protection principles referred to in section 40(3) FOIA are the principles set out in Part 1 of Schedule 1 of the DPA. Section 12 of FOIA removes the obligation to provide information, under section I, if the authority estimates that the cost of complying with the request would exceed the appropriate limit. The appropriate limit is defined, (in the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations) 2004) as £450 in this case, or 18 hours work at £25ph, the designated charging rate. Section 16 of FOIA provides:

	6



	Appeal Number: EA/2007/0058

	(1) It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect it to do so, to persons who propose to make, or have made, requests for information to it. Legal submissions and analysis 1. Personal Data and Durant 18. All parties agreed that first issue in the case was whether, in asking for the names of the individuals who had attended events and been given corporate hospitality, Mr Harcup was requesting personal data, as defined in section 1(1) DPA; and that the leading authority on the meaning of personal data was Durant, and specifically paragraph 28 of Auld LJ’s Judgement: It follows from what I have said that not all information retrieved from a computer search against an individual’s name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions which may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject’s involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person’s or body’s conduct that he may have instigated. In short it is information that affects his privacy, whether in his personal or family life, business or professional capacity. A recent example is that considered by the European Court in Criminal Proceedings against Lindquist, Case C-101/01 (6 November 2003), in which the Court held, at para. 27,that “personal data” covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies. 19. The IC and YF use this passage to argue that the names of the attendees are personal data: they are biographical, since they identify where the person was at the time of the event; the focus of the information is the attendee themselves; and attendee information is “obviously about” the particular individuals who attended. That last point is taken from the Information Commissioner’s Technical Guidance on “Determining what is personal data”, published in August 2007, to take account both of the Durant decision, and the recommendations of the Article 29 Working Party. The Data Protection Act is the British implementation of the European Commission Directive 95/46; Article 29 of the Directive provides for an independent Working Party composed of representatives of the member states supervisory authorities to give advice or opinions from time to time to the Commission. The IC is the British representative on that Working Party.

	7



	Appeal Number: EA/2007/0058

	20. We have difficulty in reconciling the approach in the Guidance with that in Durant. Paragraph 3.1 of the Guidance states that if the information is “obviously about” a particular individual it is personal data for the purposes of the DPA. It gives examples: a medical history, a criminal record, or a record of a particular individual’s performance at work or in a sporting activity. The IC and YF argue that the information sought by Mr Harcup would disclose that the individual had taken part in a particular event – attended a training session or seminar run by YF, or received corporate hospitality from them. On the other hand, Auld LJ states that the information should be “biographical in a significant sense, that is going beyond … involvement in a matter or an event that has no personal connotations”. Attendance at any event must always have personal connotations, if all that is required is attendance. Clearly, Auld LJ was suggesting something further was required, significant biographical information. We reject the argument that simply because the information identifies where the data subject was at a particular time, it is necessarily significant biographical information. 21. Similarly, it seems to us that Auld LJ’s reference to focus is stripped of all meaning if focus is satisfied by looking at the constituent parts of the information sought, rather than the subject matter of the request. The focus of the request here are the events organised by and the corporate hospitality provided by YF. In Auld LJ’s words, to be personal data, “the information should have the putative data subject as its focus rather than … some transaction or event in which he may have figured.” The attendees who attended YF events figured in them, but they are not the focus of those events. We accept, as Auld LJ states, that personal data extends to “information that affects his privacy, whether in his personal or family life, business or professional capacity”, but the inclusion of business life, does not mean that every reference to business life is necessarily biographically significant, or has the data subject as its focus. The case referred to by Auld LJ, and relied on by the IC and YF, Lindquist, involved a significant breach of privacy at work: Mrs Lindquist posted information on the net about her work colleagues, revealing not just their identity and their employer, but also including “her colleagues’ jobs and hobbies, and in some cases their family circumstances were outlined, and telephone numbers and other personal information given. One of the various items was a report that a colleague was on half time on medical grounds because she had injured her foot.” In the court’s view, at paragraph 27 “referring to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies constitutes the processing of personal data…” within Article 3(1) of directive 95/46. The IC and YF argue that revealing information about individuals’ attendance reveals information about their “working conditions”, but this seems to us to suggest that mere attendance at an event is enough to attract the protection given to personal data, a view we have rejected above. 22. Is attendance at a YF seminar or corporate hospitality event “involvement in a matter or event that has no personal connotations, a life event in respect of which [the data subject’s] privacy could not be said to be compromised”? In our view, it has no personal connotations, bearing in mind the two factors of biographical significance and focus identified in Durant. Such events are of short duration and routine business occurrences; they are not generally biographically significant; the events are attended by numbers of attendees, who may each be given a list of

	8



	Appeal Number: EA/2007/0058

	fellow attendees, together with the names of the organisations they represent. The events provide networking opportunities. Those attending them expect to make contacts and to be contacted. The press may be invited, and invited to take photographs for publication. In such circumstances, it is hard to see how privacy can be further compromised if names are released. We note that in the Decision Notice the Information Commissioner invited Yorkshire Forward to “reconsider its current policy in respect of providing a guarantee to delegates attending events it hosts that their names and that of their organisations will not be disclosed in future”. YF have informed the IC that they have reconsidered, though we are not told with what result. 23. The Court of Appeal’s approach in Durant was significantly to narrow the concept of personal data as it had been widely understood and applied. The attempt in the IC’s Guidance to apply Durant in practice restores much of the previous width. If weight is given to Auld LJ’s two notions of significant biographical information and of focus, we cannot consistently with Durant find that this information constituted personal data. In making that finding, we are not attempting to lay down any general principle about attendance at events: some may be significant, some may not. We are simply attempting to follow the guidance from the Court of Appeal, which is of course binding on us, in the particular facts of this case. 24. The lengths to which the Information Commissioner’s wide view extend is demonstrated by the Information Commissioner’s proviso to the steps he required YF to take in paragraph 28 of the Decision Notice, when disclosing the names of organisations which had attended YF’s events. “In undertaking this step, YF should however consider whether any of the organisations are sole traders or partnerships whose businesses take their name from the individual trader or partners. In such instances, YF should consider whether such data should be disclosed.” Presumably, this is so that YF may consider whether, in disclosing the name of the business, YF are disclosing the name of the individual. This seems to us absurd. A person who chooses to trade under their own name can have no claim to privacy which would prevent the business being referred to by that name; and to suggest that third parties should hesitate before referring to a business trading in the name of the proprietor seems to us to impose a wholly uncalled for and undesirable restriction on the flow of information. Applying the factors in Durant, where the information in question is the name of a business, the focus of the information is on the business, not the individual proprietor; the name of the business is not personal data. 25. Our view is that to release the names of those attending YF events in the period in question does not involve the release of personal data. Moreover that is still the case even when the names of the organisations represented by those attending are also released. We accept that to release the name of an individual’s employer would be to release significant personal data, and therefore would be personal data, within both Durant and Lindquist. But given the format in which the names of the organisations have been released, an undifferentiated list running to over 70 pages, it would be impossible to correlate individual names to organisations, at least providing some basic step such as providing names alphabetically were taken to prevent correlation.

	9



	Appeal Number: EA/2007/0058

	26. To that extent therefore we disagree with the finding in the Decision Notice that section 40(2) has been properly applied: it is not in accordance with law. Neither the names of the individual attendees, nor the organisations they represent, constitute personal data; though they would if released in the format requested by Mr Harcup, who asked for “lists of guests attending (including which organisation they represented, if any), again broken down by event.” 27. Similar considerations apply to the names and organisations of those who were provided with corporate hospitality by YF during the period. We cannot see any significant difference in principle between those attending an “event”, as defined by YF, and those in receipt of hospitality. It is clear that Mr Harcup’s request extended to those enjoying corporate hospitality; we accept the view of the IC in his submission, that now that the restricted nature of YF’s interpretation of Mr Harcup’s request has become clear, the Decision Notice should be amended to cover recipients of corporate hospitality in the same way as attendees at “events”. The second issue: applying the exemption in s 40(2) 28. Given our finding that neither the names of those attending nor the names of the organisations represented at events constitute personal data, the issue of whether the exemption in section 40(2) was correctly applied becomes irrelevant. However, lest we are wrong in our conclusion above, we set out, briefly, our conclusion on this issue. We have followed the approach taken by the Tribunal in The Corporate Officer of the House of Commons v The Information Commissioner, EA/2006/0015 and 0016. 29. The first question that arises is whether the first condition in section 40(3) is satisfied: that the data processing should not contravene any of the data protection principles in the Data Protection Act. The first of those principles is that “Personal data shall be processed fairly and lawfully”. Both the IC and YF argue that it would not be fair to disclose the names of attendees, given the assurance provided to them by YF that their personal information would not be released. In the circumstances of this case, we feel that little weight can be placed by recipients on that assurance, at least as far as their names and organisations (as opposed to contact details) are concerned. Firstly, we note that delegates may already have been provided with a list of fellow attendees, and their organisations; secondly, that the press may have attended some events on the invitation of YF. Delegates can have had no real expectation of confidentiality for their names or organisations, as opposed to the significant personal details of addresses or telephone numbers, which were not provided, or requested. We reject the argument of YF that releasing the limited information sought runs the risk of exposing those attending to spam emails or unsolicited marketing since no contact details would be provided. To that limited extent therefore, fairness may not prevent release of the data. 30. However, the first principle also requires that at least one of the conditions in the second Schedule to the DPA be met. The relevant condition appears to be 6(1): the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by

	10



	Appeal Number: EA/2007/0058

	reason of prejudice to the rights and freedoms or legitimate interests of the data subject. 31. Is the processing (the release of the data) necessary to enable Mr Harcup to pursue his legitimate interests? He has a legitimate interest in seeing how public funds are spent. However, that principle should not be overstated. YF’s use of public funds is monitored in a number of ways: through its governing body, accountable ultimately to elected representatives in local and central government; and through public auditors. We accept the general benefits that follow from increased transparency and openness, but we are not persuaded that it is necessary for those benefits to accrue for the names of attendees to be published. Those attending will do so for the most part as representatives of their organisations; it is the organisation, not YF, who decides for the most part who their representatives should be. It seems to us that publishing the names of the organisations represented meets Mr Harcup’s legitimate needs; we are not persuaded that it is necessary, a strong word, to go further. Therefore, Mr Harcup fails at this first hurdle; there is no need to go on to conduct the balancing exercise. The third question: the cost limit 32. We turned to consider the alternative reason for not complying with the request advanced by YF: that to do so would, in their estimation, exceed the cost limit in section 12 of FOIA. We have set out their costs estimates in our findings of fact, above. They have not been challenged by Mr Harcup. A public authority is not required to prove their estimate to any high standard; merely that is a reasonable one. From the information provided, the estimate appears reasonable. The most cursory examination of the list of names provided indicates that to add a further list, from the 4 Directorates, and then to compile comparable lists for recipients of corporate hospitality would comfortably exceed the limit; and that is without taking into account the 3 weeks work estimated as required to provide financial information broken down by event, as requested. 33. The effect of an estimate that costs will exceed the limit is to remove the obligation to provide information altogether: it is not to provide information up to the costs limit. We note that YF have so far spent some £338 in answering Mr Harcup’s request: they are not obliged to spend the balance, up to the limit. 34. However, we should not leave this point without considering the impact of section 16, the duty to provide advice and assistance, on the cost limit in section 12. It must have been obvious to YF from the outset that the information Mr Harcup was providing was huge in scope, and likely to fall way outside the limit. The request covered both events and corporate hospitality; it extended to all 4 Directorates and to centrally organised events; it covered several years. Indeed, costs were the reason given in their initial answer for providing the information they did: they had just dealt with another, similar request and therefore had collated much of the information already. On the face of it, such a response appears well intentioned and helpful, but it was in its effect seriously deficient. It was misleading since it appeared to provide information about all the types of events Mr Harcup referred to. In fact, it was only during the course of the appeal that the IC realised that he too had been misled by that initial response, and realised that it only covered one category of the information requested, ”events”, and that “corporate hospitality” was

	11



	Appeal Number: EA/2007/0058 regarded as something entirely different by YF, and simply ignored in their response. 35. More fundamentally, there was no attempt at a dialogue with Mr Harcup, to make him aware of the cost limit and to suggest ways in which he might restrict or focus his request so as to make it, or at least some of it, attainable. It would be reasonable to expect the authority to offer information on the costs position as part of its duty to offer advice and assistance. The relationship is one sided: Mr Harcup has no way of knowing the costs involved (or whether or when the authority will consider applying the costs limit); the authority knows what information it has available, and what will take time to obtain. Offering the information already collated and available could have been part of such a dialogue, but it should have been provided as one, partial option, alongside others, not as a full response, whose limitations only became apparent during the appeal. An authority which arbitrarily provides some information in answer to an extensive request and then refuses to provide more under cover of section 12 is likely to act in breach of its duty to provide advice and assistance to those requesting information in section 16. Such an approach effectively prevents the requester making an informed choice, in the knowledge of the likely constraints, as to what information they wish to request. 36. Given that the application of section 16 was not identified as an issue in the appeal, and the parties have not therefore had the opportunity to address us on it, we make no formal finding of breach, but we draw the attention of the parties to the relationship between section 12 and 16 so that, should there be a further request (and the Act envisages repeated requests in section 14(2), it may properly be considered. We adopt and endorse the helpful guidance provided by another division of this Tribunal on this point in the case of Brown v The Information Commissioner and The National Archive, EA/2006/0088.

	Conclusion and remedy 37. In conclusion, we find that the exemption in section 40(2) was not properly applied and did not prevent the disclosure of the data requested, since in the context of the case, the names and organisations (provided they remained unconnected) of those attending events did not constitute personal data. However, since the provision of that information would clearly exceed the costs limit set in section 12, no further steps are required of Yorkshire Forward. 38. Our decision is unanimous.

	Signed Humphrey Forrest Deputy Chairman of the Tribunal Date: 5 February 2008

	12

About BAILII - FAQ - Copyright Policy - Disclaimers - Privacy Policy amended on 25/11/2010