Raymond Lawton v The Information Commissioner & Anor

This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“the FOIA”). The appeal is against the decision of the Information Commissioner (“the Commissioner”) contained in a Decision Notice (“DN”) dated 17 November 2021 (reference IC-76644-F7P8), which is a matter of public record.

Full details of the background to this appeal, the complainant’s request for information and the Commissioner’s decision are set out in the DN. The appeal concerns the decision of the Council of the University of Central Lancashire (“The University”) to apply section 40(2) FOIA to some of the requested information, on the basis that it contained personal data of third parties.

The Commissioner maintains the position set out in her DN; namely that the Council correctly applied section 40(2) FOIA to some of the requested information, on the basis that it contained personal data of third parties. However, as the Appellant’s request was for the whole brochure, section 40(2) FOIA is not applicable to all parts and therefore the University should disclose the remainder of the information. The Appellant now appeals against the DN. The Commissioner opposes the appeal and invites the Tribunal to dismiss the appeal. The Parties consent to this matter being dealt with on the papers.

On 1 June 2020, the Appellant requested the following:

“I request copies of graduation brochures, in particular list of graduates for engineering disciplines for 1997 and 1998.”

The University responded on 26 June 2020. It stated that it held information in relation to the request. However, it cited section 40(2) of the FOIA – personal information.

Following an internal review, the University wrote to the complainant on 4 November 2020. It stated that it upheld its original position.

The complainant contacted the Commissioner on 10 December 2020 to complain about the way their request for information had been handled.

The Commissioner considers the scope of her investigation is to establish whether the public authority is entitled to withhold the names of those who graduated, along with any other named individuals under section 40(2) of the FOIA.

Legal Framework:

Any person making a request for information to a public authority is entitled—

to be informed in writing by the public authority whether it holds information of the description specified in the request, and

if that is the case, to have that information communicated to him.

Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.

Where a public authority—

reasonably requires further information in order to identify and locate the information requested, and

has informed the applicant of that requirement,

The information—

in respect of which the applicant is to be informed under subsection (1)(a), or

which is to be communicated under subsection (1)(b),

A public authority is to be taken to have complied with subsection (1)(a) in relation to any information if it has communicated the information to the applicant in accordance with subsection (1)(b).

In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.

Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

Any information to which a request for information relates is also exempt information if—

it constitutes personal data which does not fall within subsection (1), and

the first, second or third condition below is satisfied.

on a request under Article 15(1) of the GDPR (general processing:

on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

giving a member of the public the confirmation or denial that would

on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);

on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

Omitted

The Commissioner investigated the matter and held that part of the brochures were exempt from disclosure under section 40(2) FOIA.

In the circumstances of this case, having considered the withheld information, the Commissioner was satisfied that the information relates to the data subjects. The names of individuals, alongside their graduate qualification, quite obviously is information that both relates to and identifies those concerned. This information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA.

The fact that information constitutes the personal data of an identifiable living individual does not automatically exclude it from disclosure under the FOIA. The second element of the test is to determine whether disclosure would contravene any of the DP principles.

The Commissioner referred to Article 5(1)(a) of the GDPR and Article 6(1) in respect of the lawfulness. Further, the Commissioner considered the three-part test to be applied under Article 6(1)(f), which is as follows:

The Commissioner give due consideration to each element of the test and decided that disclosure would cause unwarranted damage or distress to those named in the brochures, nor would these individuals have a reasonable expectation that their personal data would be disclosed in response to an information request. Further, that it would be disproportionate to obtain consent from each graduate.

The Appellant’s Grounds of Appeal does not question that section 40(2) applies to the withheld information and that the information does constitute personal data. The Appellant focuses on the balance of legitimate interests. The Grounds of Appeal can be summarised as follows:

“(a)

with regard to the decision, I object on the following grounds: Point 46) The information was also posted on the University website at the time. Point 47) The graduates concerned would have had a reasonable expectation of such disclosure, since website publishing was widely used by them. Disclosure to the “world at large” has already happened long ago. There can be no objection based on this point”.

The Commissioner maintained her position as outlined in the DN and resisted the appeal. The Commissioner accepted that, if the names of the data subjects/the graduation brochures were published on the internet back in 1997-1998 then this may have some bearing on the balancing exercise.

The Commissioner received confirmation from the University that they did not publish the names of the data subjects online at the time. The Commissioner denied that disclosure to the world at large had already happened. The Commissioner maintained the balancing exercise was correct and that the legitimate interest of the Appellant in seeking the withheld information did not outweigh the reasonable expectation of the graduates that their names and grades would not be disclosed to the world at large. Further, the Appellant has failed to produce any compelling reason to overturn the balancing test in favour of disclosure. The Commissioner invited the Tribunal to dismiss the appeal.

The Second Respondent provided a response to the Appellant’s specific grounds of appeal. In response to the contention that the information was also posted on the University website at the time, the Second Respondent confirmed that there were two graduation ceremonies which occurred in 1997 and 1998, and stated that this information was not published on the University website.

In relation to the argument that disclosure to the world at large had already happened long ago, the Second Respondent argued that graduates would not have had a reasonable expectation of such disclosure of this nature since disclosures of this nature did not take place at the time. The Second Respondent opposed the Appellant’s Grounds of Appeal on the basis that they are not factually accurate, as the information was not published on the University’s website in 1997 and 1998 and further because the individuals in question would not have had a reasonable expectation that this information would be disclosed either in 1997 or 1998, or the present day. The Second Respondent confirmed that redacted copies of brochures were provided to the Appellant. The Second Respondent invited the Tribunal to dismiss the appeal.

The Tribunal is satisfied that the names of graduands and their degrees and classifications is personal data as defined Section 3(2) of the DPA. This defines personal data as: “any information relating to an identified or identifiable living individual”.

Personal data must be processed in accordance with the data protection principles set out in Article 5 of the GDPR. The Tribunal agrees with the Commissioner that the most relevant principle in this case is Article 5(1)(a) personal data shall be processed lawfully, fairly and in a transparent manner.

The Tribunal considered the lawful basis for processing under the GDPR and agreed with the Commissioner that Article 6(1)(f) (legitimate interests) was the most applicable. The Tribunal considers that to obtain consent from the data subjects would involve disproportionate effort by the data controller due to the numbers involved and the passage of time and is unlikely to lead to a meaningful disclosure.

In considering the application of Article 6(1)(f) the Tribunal considered the three-stage test:

The Tribunal accepts and adopts the Commissioners’ considered assertion that the legitimate interest is only that of the complainant’s own interest and as such there is limited legitimate interest. The Appellant may have a sentimental interest but the appellant has failed to offer any wider legitimate interest in the information other than sentimental purposes.

In relation to the necessity test, the Tribunal is required to consider whether disclosure is necessary to meet the legitimate interest in question. Necessary means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity and involves consideration of alternative measures which may make disclosure of the requested information unnecessary. Disclosure under the FOIA must therefore be the least intrusive means of achieving the legitimate aim in question. The Tribunal accepts and adopts the Commissioners view, and is satisfied in this case that there are no less intrusive means of achieving the legitimate aims identified.

On the balancing test the Tribunal has to consider whether the requestor’s legitimate interests override the fundamental rights and freedoms of the data subjects, in this case the graduands referred to in the Graduation Ceremony Brochures. The Tribunal accepts and adopts the Commissioners assessment that a key issue is whether the individuals (the graduands) concerned would have a reasonable expectation that their information will not be disclosed. The Tribunal agree that these expectations can be shaped by factors such as an individual’s general expectation of privacy, whether the information relates to an employee in their professional role or to them as individuals, and the purpose for which they provided their personal data. There is no evidence before us that the graduands understood, or would have expected, that their information would be exposed to the world at large.

The Appellant argues that the data subjects would have had a reasonable expectation that information would be disclosed because he argues that the information was made public in the brochure and he asserts that it would have been published, at the time, on the University Web Site.

The University states that the brochures were only made available to those attending graduation ceremonies. The University states that this information would not have been published on its web site in 1997/98. The University has provided an archived version of its web site from 1998 which can be publicly viewed at this link:

This does not include or contain any information about the graduands or graduation brochures. The Tribunal therefore accepts the University’s assertion that in 1998 this information was not made publicly available other than to those attending the ceremonies. Therefore, the Tribunal concludes that graduands of 1997 and 1998 would not have any expectation that information about their graduation and degree award would be made public now, some 25 years later, to the world at large.

The Tribunal concludes that the requestor's legitimate interests, which are entirely personal, are insufficient to outweigh the fundamental rights and freedoms of the data subjects.

For the above reasons we find the Appellant has failed to identify any error of Law in the DN and accordingly we must dismiss this appeal.