Appeal Number: EA/2021/0025
First-Tier Tribunal
(General Regulatory Chamber)
Information Rights
Heard on the papers
On: 23 rd June 2022.
Panel: Brian Kennedy QC, Susan Wolf and Jo Murphy.
Between:
Raymond Lawton
Appellant:
and
The Information Commissioner
First Respondent:
and
The University of Central Lancashire
Second Respondent:
Representation:
For the Appellant: Raymond Lawton, as a litigant in person.
For the 1 st Respondent: Sapna Gangani, Solicitor through the Commissioner’s written Response dated 08/03/2022.
For the 2 nd Respondent: Written response from Information Governance Manager & Data Protection Officer, Legal and Governance, University of Central Lancashire, Preston, PR1 2HE
Decision: The Tribunal dimiss the appeal.
REASONS
Introduction:
This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“the FOIA”). The appeal is against the decision of the Information Commissioner (“the Commissioner”) contained in a Decision Notice (“DN”) dated 17 November 2021 (reference IC-76644-F7P8), which is a matter of public record.
Factual Background to this Appeal:
Full details of the background to this appeal, the complainant’s request for information and the Commissioner’s decision are set out in the DN. The appeal concerns the decision of the Council of the University of Central Lancashire (“The University”) to apply section 40(2) FOIA to some of the requested information, on the basis that it contained personal data of third parties.
The Commissioner maintains the position set out in her DN; namely that the Council correctly applied section 40(2) FOIA to some of the requested information, on the basis that it contained personal data of third parties. However, as the Appellant’s request was for the whole brochure, section 40(2) FOIA is not applicable to all parts and therefore the University should disclose the remainder of the information. The Appellant now appeals against the DN. The Commissioner opposes the appeal and invites the Tribunal to dismiss the appeal. The Parties consent to this matter being dealt with on the papers.
History and Chronology:
On 1 June 2020, the Appellant requested the following:
“I request copies of graduation brochures, in particular list of graduates for engineering disciplines for 1997 and 1998.”
The University responded on 26 June 2020. It stated that it held information in relation to the request. However, it cited section 40(2) of the FOIA – personal information.
Following an internal review, the University wrote to the complainant on 4 November 2020. It stated that it upheld its original position.
The complainant contacted the Commissioner on 10 December 2020 to complain about the way their request for information had been handled.
The Commissioner considers the scope of her investigation is to establish whether the public authority is entitled to withhold the names of those who graduated, along with any other named individuals under section 40(2) of the FOIA.
Legal Framework:
S1 FOIA – General right of access to information held by public authorities
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
(2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.
(3) Where a public authority—
(a) reasonably requires further information in order to identify and locate the information requested, and
(b) has informed the applicant of that requirement,
the authority is not obliged to comply with subsection (1) unless it is supplied with that further information.
(4) The information—
(a) in respect of which the applicant is to be informed under subsection (1)(a), or
(b) which is to be communicated under subsection (1)(b),
is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.
(5) A public authority is to be taken to have complied with subsection (1)(a) in relation to any information if it has communicated the information to the applicant in accordance with subsection (1)(b).
(6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.
Section 40 FOIA provides that:
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection
Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).
(4A) The third condition is that—
(a) on a request under Article 15(1) of the GDPR (general processing:
right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.
(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—
(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—
(i) would (apart from this Act) contravene any of the data
protection principles, or
(ii) would do so if the exemptions in section 24(1) of the Data
Protection Act 2018 (manual unstructured data held by public
authorities) were disregarded;
(b) giving a member of the public the confirmation or denial that would
have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);
(c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);
(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.
(6) Omitted
(7) In this section—
“the data protection principles” means the principles set out in—
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).
(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
(as amended by Schedule 19 of the Data Protection Act 2018)
Section 40(1) FOIA is an absolute exemption by virtue of s.2(3)(f) FOIA, and is therefore not subject to the public interest test under s.2(2)(b) FOIA.
Personal data is defined as “ any information relating to an identified or identifiable living individual.” (s.3(2) Data Protection Act 2018 (“DPA”)), and the ‘processing’ of such information includes “ disclosure by transmission, dissemination or otherwise making available” (s.3(4)(d) DPA), and therefore includes disclosure under FOIA.
The data protection principles referred to in s.40(3A)(1) FOIA are set out in Article 5(1) of the General Data Protection Regulations EU2016/679 (‘GDPR’), and s.34(1) DPA18 (the latter with regards to law enforcement processing) (s.40(7) FOIA). The first data protection principle under Article 5(1)(a) GDPR is that personal data shall be:
“ processed lawfully, fairly and in a transparent manner in relation to the data subject”.
The information can therefore only be disclosed if to do so would be lawful (i.e. would meet one of the conditions of lawful processing listed in Article 6(1) GDPR), fair, and transparent.
In considering the application of Article 6(1)(f) of the GDPR in the context of a request for information under the FOIA, it is necessary to consider the following three-part test:-
Legitimate interest test: Whether a legitimate interest is being pursued in the request for information;
Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question;
Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.
Commissioner’s Decision Notice:
The Commissioner investigated the matter and held that part of the brochures were exempt from disclosure under section 40(2) FOIA.
In the circumstances of this case, having considered the withheld information, the Commissioner was satisfied that the information relates to the data subjects. The names of individuals, alongside their graduate qualification, quite obviously is information that both relates to and identifies those concerned. This information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA.
The fact that information constitutes the personal data of an identifiable living individual does not automatically exclude it from disclosure under the FOIA. The second element of the test is to determine whether disclosure would contravene any of the DP principles.
The Commissioner referred to Article 5(1)(a) of the GDPR and Article 6(1) in respect of the lawfulness. Further, the Commissioner considered the three-part test to be applied under Article 6(1)(f), which is as follows:
Legitimate interest test: Whether a legitimate interest is being pursued in the request for information;
Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question;
Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.
The Commissioner give due consideration to each element of the test and decided that disclosure would cause unwarranted damage or distress to those named in the brochures, nor would these individuals have a reasonable expectation that their personal data would be disclosed in response to an information request. Further, that it would be disproportionate to obtain consent from each graduate.
Grounds of Appeal:
The Appellant’s Grounds of Appeal does not question that section 40(2) applies to the withheld information and that the information does constitute personal data. The Appellant focuses on the balance of legitimate interests. The Grounds of Appeal can be summarised as follows:
“ (a) with regard to the decision, I object on the following grounds: Point 46) The information was also posted on the University website at the time. Point 47) The graduates concerned would have had a reasonable expectation of such disclosure, since website publishing was widely used by them. Disclosure to the “world at large” has already happened long ago. There can be no objection based on this point”.
The Commissioner’s Response:
The Commissioner maintained her position as outlined in the DN and resisted the appeal. The Commissioner accepted that, if the names of the data subjects/the graduation brochures were published on the internet back in 1997-1998 then this may have some bearing on the balancing exercise.
The Commissioner received confirmation from the University that they did not publish the names of the data subjects online at the time. The Commissioner denied that disclosure to the world at large had already happened. The Commissioner maintained the balancing exercise was correct and that the legitimate interest of the Appellant in seeking the withheld information did not outweigh the reasonable expectation of the graduates that their names and grades would not be disclosed to the world at large. Further, the Appellant has failed to produce any compelling reason to overturn the balancing test in favour of disclosure. The Commissioner invited the Tribunal to dismiss the appeal.
Second Respondent’s Submissions:
The Second Respondent provided a response to the Appellant’s specific grounds of appeal. In response to the contention that the information was also posted on the University website at the time, the Second Respondent confirmed that there were two graduation ceremonies which occurred in 1997 and 1998, and stated that this information was not published on the University website.
In relation to the argument that disclosure to the world at large had already happened long ago, the Second Respondent argued that graduates would not have had a reasonable expectation of such disclosure of this nature since disclosures of this nature did not take place at the time. The Second Respondent opposed the Appellant’s Grounds of Appeal on the basis that they are not factually accurate, as the information was not published on the University’s website in 1997 and 1998 and further because the individuals in question would not have had a reasonable expectation that this information would be disclosed either in 1997 or 1998, or the present day. The Second Respondent confirmed that redacted copies of brochures were provided to the Appellant. The Second Respondent invited the Tribunal to dismiss the appeal.
The Hearing on the papers:
The Tribunal is satisfied that the names of graduands and their degrees and classifications is personal data as defined Section 3(2) of the DPA. This defines personal data as: “any information relating to an identified or identifiable living individual”.
Personal data must be processed in accordance with the data protection principles set out in Article 5 of the GDPR. The Tribunal agrees with the Commissioner that the most relevant principle in this case is Article 5(1)(a) personal data shall be processed lawfully, fairly and in a transparent manner.
The Tribunal considered the lawful basis for processing under the GDPR and agreed with the Commissioner that Article 6(1)(f) (legitimate interests) was the most applicable. The Tribunal considers that to obtain consent from the data subjects would involve disproportionate effort by the data controller due to the numbers involved and the passage of time and is unlikely to lead to a meaningful disclosure.
In considering the application of Article 6(1)(f) the Tribunal considered the three-stage test:
a) The legitimate interest test: Whether a legitimate interest is being pursued in the request for information;
b) The Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; and
c) The Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.
The Tribunal accepts and adopts the Commissioners’ considered assertion that the legitimate interest is only that of the complainant’s own interest and as such there is limited legitimate interest. The Appellant may have a sentimental interest but the appellant has failed to offer any wider legitimate interest in the information other than sentimental purposes.
In relation to the necessity test, the Tribunal is required to consider whether disclosure is necessary to meet the legitimate interest in question. Necessary means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity and involves consideration of alternative measures which may make disclosure of the requested information unnecessary. Disclosure under the FOIA must therefore be the least intrusive means of achieving the legitimate aim in question. The Tribunal accepts and adopts the Commissioners view, and is satisfied in this case that there are no less intrusive means of achieving the legitimate aims identified.
On the balancing test the Tribunal has to consider whether the requestor’s legitimate interests override the fundamental rights and freedoms of the data subjects, in this case the graduands referred to in the Graduation Ceremony Brochures. The Tribunal accepts and adopts the Commissioners assessment that a key issue is whether the individuals (the graduands) concerned would have a reasonable expectation that their information will not be disclosed. The Tribunal agree that these expectations can be shaped by factors such as an individual’s general expectation of privacy, whether the information relates to an employee in their professional role or to them as individuals, and the purpose for which they provided their personal data. There is no evidence before us that the graduands understood, or would have expected, that their information would be exposed to the world at large.
The Appellant argues that the data subjects would have had a reasonable expectation that information would be disclosed because he argues that the information was made public in the brochure and he asserts that it would have been published, at the time, on the University Web Site.
The University states that the brochures were only made available to those attending graduation ceremonies. The University states that this information would not have been published on its web site in 1997/98. The University has provided an archived version of its web site from 1998 which can be publicly viewed at this link:
https://web.archive.org/web/19980124144412/http://www.uclan.ac.uk/althom3.htm
This does not include or contain any information about the graduands or graduation brochures. The Tribunal therefore accepts the University’s assertion that in 1998 this information was not made publicly available other than to those attending the ceremonies. Therefore, the Tribunal concludes that graduands of 1997 and 1998 would not have any expectation that information about their graduation and degree award would be made public now, some 25 years later, to the world at large.
Conclusion:
The Tribunal concludes that the requestor's legitimate interests, which are entirely personal, are insufficient to outweigh the fundamental rights and freedoms of the data subjects.
For the above reasons we find the Appellant has failed to identify any error of Law in the DN and accordingly we must dismiss this appeal.
Brian Kennedy QC. 23 June 2022.
Promulagtion date 30 th June 2022