Anna Christie v The Information Commissioner

Neutral citation number: [2022] UKFTT 00255 (GRC)

Appeal Number: EA/2021/0355

First-Tier Tribunal

(General Regulatory Chamber)

Information Rights

Heard at Remote Hearing Room 3

Heard by CVP 1629

Heard on 26 April 2022.

Decision given on: 3 May 2022.

Tribunal Panel

Judge Brian Kennedy QC

Suzanne Cosgrave

Pieter De Waal

Between:

Anna Christie

Appellant:

And

The Information Commissioner

Respondent:

Representation:

For the Appellant: Anna Christie as a Litigant in person.

For the Respondent: Nicholas Martin, Solicitor by way of written submissions.

Decision: Appeal dismissed.

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).

(4A) The third condition is that—

(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).

(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—

(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

(i) would (apart from this Act) contravene any of the data protection principles, or

(ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(b) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);

(c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);

(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this section—

“the data protection principles” means the principles set out in—

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).

(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

[8] Section 3(2) of the Data Protection Act (“DPA”) defines personal data as:
“any information relating to an identified or identifiable living individual”.

Article 5(1)(a) of the General Data Protection Regulations (GDPR) states that:

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

Article 6(1)(f) of the GDPR states:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”

Commissioner’s Decision Notice

[9] The Commissioner investigated the matter and held that the Constabulary correctly applied section 40(5B) FOIA in its initial response to NCND that it held information within the scope of the request. The Commissioner reached her decision on the following grounds:

a) “The request related to the number of complaints about the Data Subject which, if held, would reveal personal data relating to the Data Subject (DN [16]).

b) Whilst there was a legitimate interest with regards to the Appellant’s concerns (DN [21]-[24]), and confirmation or denial was necessary to meet such legitimate interest ([25]-[27]), the Appellant’s legitimate interests were not sufficient to outweigh the Data Subject’s fundamental rights and freedoms. This was on the grounds that complaints, if made, would not equate to an indication of guilt and there were other complaint and investigative procedures which could be followed. Furthermore the decision was consistent with the Commissioner and Tribunal’s decision-making in similar circumstances (DN [28]-[38]).”

Grounds of Appeal

[10] The Appellant’s Grounds of Appeal detailed that information is available online regarding the Data Subject which suggest previous allegations of sexual harassment, and it was necessary for this to have been taken into account in the decision made in this case. The Appellant argued that the Commissioner erred in considering the Data Subject’s reasonable expectations in balancing legitimate interests. Further, the Appellant contended that the Commissioner failed to take account of the public interest test.

The Commissioner’s Response

[11] The Commissioner maintained her position as outlined in the DN and resisted the appeal. The Commissioner referred to the data protection principles under Article 5(1)(a) and Article 6(1) of the UK GDPR. The Commissioner referenced the three-part test to be applied under Article 6(1)(f) GDPR in the context of a request for information under FOIA:

(I) Legitimate interest test: Whether a legitimate interest is being pursued by the request for information;

(II) Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question;

(III) Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.

[12] In consideration of the three-part test the Commissioner cited the following decisions made by the Upper Tribunal:

Goldsmith International Business School v Information Commissioner and Home Office [2014] UKUT 563 (AAC) at [35]-[42] (reiterating the Supreme Court’s approach in South Lanarkshire Council v The Scottish Information Commissioner at [18]), Glenda Rodriguez-Noza v Information Commissioner and Nursing and Midwifery Council (GIA/0433/2014), and Information Commissioner v Colleen Foster and Nursing and Midwifery Council (GIA/1626/2014) at [19], [23]-[24], [27]).

[13] The Commissioner accepted that the Appellant has a legitimate interest in requesting the information sought and obtaining confirmation or denial. However, the Commissioner referred to Judge Jacobs in Colleen Foster to note that a disclosure under FOIA is effectively a disclosure to the world with no restrictions. Thus, the privacy rights of the data subject should be taken into account.

[14] In relation to Article 6(1)(f) which states that disclosure must be “necessary”, the Commissioner outlined the test to be applied as held in Goldsmith, which states that disclosure must be “more than desirable but less than indispensable or absolute necessity”. The Commissioner reviewed her position in light of the appeal and is no longer of the view that it is necessary for the Constabulary to NCND holding the requested information given that the Appellant’s concerns can be taken up directly with the Solicitors Disciplinary Tribunal (“SDT”) who stated:

“49. At the conclusion of the Respondent’s evidence the Tribunal indicated to the Respondent and his legal representative that it did not find the case against the Respondent to have been proved and it considered it unnecessary for the Respondent to call his wife, as he had intended, to give evidence or to call his current employer to give character evidence....

53. In all of the particular circumstances of this case the Tribunal concluded that the evidence in support of the allegation made by the Applicant did not establish that the alleged events occurred beyond reasonable doubt. The Respondent was entitled to the benefit of the doubt and the Tribunal dismissed the allegations made against him.”

[15] Further, the Commissioner found that even if it were necessary to provide confirmation or denial the Appellant’s legitimate interest is outweighed by the Data Subject’s right to privacy for the reasons outlined in her DN. With reference to Glenda Rodriguez-Noza and Collen Foster, the Commissioner argued that confirmation or denial would be unwarranted given the prejudice likely to be suffered by the Data Subject as a result of confirmation or denial free from any duty of confidence and available to the world at large and given the alternative means of addressing the Appellant’s concerns.

[16] The Commissioner highlighted that as per sections 2 and 40 FOIA, the duty to NCND is an absolute exemption where it corresponds to an absolute exemption within section 40 FOIA. The Commissioner interpreted section 40(5B)(a)(i) as an absolute exemption as it corresponds to the absolute exemption in section 40(2) taken with section 40(3A)(a). This interpretation was supported by the Tribunal in Rt. Hon. Frank Field MP v the Information Commissioner (EA/2009/0055), which stated:

“What is also critical for present purposes is the further issue of whether exclusion of the duty is absolute or qualified. It is absolute in the present case since section 40(2) is treated as conferring an absolute exemption by section 2(3)(f)(ii) of FOIA: “... so far as relating to cases where the first condition referred to in that subsection [i.e. section 40(2)] is satisfied by virtue of subsection (3)(a)(i) or (b) of that section ...” ” [24]

[17] The Commissioner submitted that the Appellant’s arguments are insufficient. The Commissioner adopted and repeated the findings provided in her DN.

Appellant’s Reply:

[18] The Appellant maintained that information is available online regarding the Data Subject which suggest previous allegations of sexual harassment, and it was necessary for this to have been taken into account in the decision made. Further, the Appellant stated that she could have provided the same had she been asked.

[19] The Appellant argued that the rights of the victims have not been taken into account in this instance. The Appellant referred to the standard set by the SDT and stated that the Commissioner is not adhering to the comments made by that Tribunal in a Judgment which the Appellant asserted is in relation to the Data Subject. The Appellant averred that an alleged victim would not make false accusations. The Appellant did not accept that the appropriate recourse is through the SRA.

Appellant’s Final Submission:

[20] The Appellant stated that the Commissioner refused to direct that the withheld information be disclosed. The Appellant maintained that the personal data of any female victims of sexual misconduct could be redacted. The Appellant argued that the Commissioner has not lodged enquiries with the Constabulary or the SRA in relation to this case. The Appellant reiterated that information is available online regarding the Data Subject which suggests previous allegations of sexual harassment, and that it was necessary for this to have been taken into account in the decision made.

[21] The Appellant contended that the Commissioner is not interested in the appeal and is refusing to recognise the public interest test to be applied. The Appellant stated that the Commissioner has erred in the duty bestowed upon her as a regulator. The Appellant sought and received limited and what she regarded as unhelpful information from the SRA. The Appellant refuted the conclusions of the SRA. The Appellant highlighted that an alleged victim would not make false accusations and further that it is a criminal offence. The Appellant submitted that every case must be decided upon the facts. Therefore, the Appellant invited the Tribunal to uphold the appeal and direct that the requested information be disclosed.

The Hearing:

[22] At the hearing on 26 April 2022, the Tribunal were working from two hearing bundles, one form the Commissioner and a shorter one supplied by the Appellant, it is not clear to us whether or not the Commissioner had the Appellants bundle and some references are form the Pagination given to the Appellants bundle which may unavoidably cause some confusion.

[23] The Appellant took time to expand on her submissions and helpfully presented her arguments as set out in paragraphs [18] to [21] above in more detail and with genuine passion illustrating a grave and understandable concern for alleged victims of sexual harassment. The Appellant explained that she was aware of 12 or more complaints made against the Data Subject. She indicated that previous information is available on-line which suggests previous allegations of sexual harassment, and it was necessary that these be considered. The Appellant argued that this was a matter of grave public interest and other potential vulnerable victims needed to be warned.

[24] The Tribunal took time to try to explain to the Appellant the reasoning as set out in the DN, the recognition of the legitimate interest she has presented, the necessity test and the balance of the legitimate interest in so far as it could or should outweigh the Data Subject’s fundamental rights and freedoms. However, it was also explained that false allegations can be made and hence the significant burden required to outweigh or override those fundamental rights.

The issues:

[25] The remit of the Tribunal is limited to considering the Commissioner’s DN. It is important to focus on whether, as alleged by the appellant the commissioner erred in her decision making. 

[26] As explained to the Appellant the Tribunal have carefully considered the reasoning in the DN set out clearly at Paragraphs 11 to 37 inclusive therein, and how the conclusion at Paragraph 37 was arrived at. In our deliberations we accept, approve and adopt the Commissioner’s reasoning and find no error of Law therein. We accept that the exemption relied upon by the Constabulary is properly relied upon and it is an absolute exemption, meaning that the Public Interest balance test is not engaged.

[27] The key elements in the DN made by the Commissioner to be considered, in a somewhat cryptic form are as follows: - 

• DN paras 21 – 24 - Legitimate interest, the Commissioner considers there is a legitimate interest in the information requested. As explained to the Appellant, we agree with this.

• DN paras 25- 27 - The necessity, the Commissioner does consider whether the disclosure would be necessary.

• DN paras 28 – 38 The Commissioner considers the balance of legitimate interest and the Data Subject’s interest. The Commissioner considers that confirming whether the information is held would not be lawful. Again, we agree with this conclusion.

Further information was provided in the solicitor, Mr Nicolas Martin’s response on behalf of the Commissioner dated 21 December 2021 pages A16 – A27 ;

• At page A23 Paras 21 – 22 Legitimate Interests – the Commissioner’s position remains unchanged, and we accept these submissions.

• At page A23 – A24 Paras 23 – 26 necessity is explored, in our view correctly by the Commissioner,

• Para 24 The reference to Goldsmith at para 37 and “reasonable necessity” has, in our view been correctly adopted and applied.

• Para 25 states the Commissioner, was not aware of any information in the public domain regarding allegations or complaints. This is the Commissioner’s argument in favour of confirmation or denial being necessary, again which we accept as the position she was entitled to hold.

• The Appellant maintains that such information existed in the public domain and so she argues the Commissioner erred in law by saying it did not. In the Appellant’s opinion this position taken by the Commissioner was supportive of the necessity for disclosure. On the papers before us we cannot accept the Appellant’s contention in this regard.

• The Appellant had provided documents available online from the SRA which “may” relate to the Data Subject…this was not, as far as the Commissioner was concerned material evidence and we accept the Commissioner was entitled and to do so.

• The Appellant further says it was for the Commissioner to investigate – but we are of the view that this is counter-intuitive on the position being taken by the Commissioner, whose considerations were based on believing there was nothing available in the public domain that was material in fact and supportive of necessity. 

• Para 26 - Necessity and the Goldsmith case of “least restrictive” refers to there being alternative routes available to the Appellant e.g. taking it up directly with the SRA. We accept this interpretation of the case-law by the Commissioner as set out clearly in the DN.

• The Appellant objects to this position, not it seems on the grounds that such alternative routes do not exist but rather that she has tried that route and it has been unsuccessful. This much we find is clear from the correspondence the Appellant has provided recently (see documents page numbered AC1 – AC7 which are email exchanges with the SRA).

• At page AC1 the SRA provided some information to the Appellant in relation to a practising solicitor of the name she had provided including information concerning a decision dated 18 March 2020. This date seems significant as it is very recent (whereas information the Appellant had referred the Tribunal to related to a misdemeanour of a trainee solicitor in 2005 and a Solicitors Disciplinary Tribunal hearing in February 2005). We find it is perhaps, on the issue of dates, understandable why the Commissioner was not convinced that a restriction on a practising certificate in March 2020 was necessarily in relation to the same person referred to in the Solicitors Disciplinary Tribunal hearing, or that the two necessarily related to the same or similar issues (See AC1 13 October 2020.) 

• See also page AC7 - Nov 30, 2020, in which the Appellant is told “You have been given all the information about Mr ….  we can provide you…” and “You may recall we communicated previously in 2017 when you contacted us with a report about Mr….. as you did not provide us with sufficient evidence to support the allegations that you made, we were unable to progress your complaint further”

• The SRA correspondence with the Appellant supports the Commissioner’s view that there are alternative routes for the Appellant to address her concerns.

• The Appellant seems to interpret alternative routes as mechanisms to obtain the requested information, but this is, in our view, misguided

 Conclusion:

[26] On the papers before us, the Appellant relies on two extraneous pieces of evidence to support her submission that legitimate interest in publication of the requested information outweighs the data subject's privacy interests:

1. A judgment of the Solicitors Disciplinary Tribunal, which according to the Appellant relates to the same person as the Data Subject referred to in her information request. However, that judgment concluded that the evidence in support of the allegations did not establish that the alleged events occurred beyond reasonable doubt, and that Tribunal dismissed the allegations.

2. The fact that conditions have been recorded by the SRA on the practicing certificate of a person whom the Appellant again asserts is the same person as the Data Subject referred to in her information request. However, the SRA have not given any information about the background to those conditions or said that the conditions are related to any allegations or complaints of harassment. 

[27] For purposes of the balancing exercise between legitimate interest in disclosure of information about 'complaints of sexual misconduct' (the information request) and privacy interests, we are in no position to draw any reliable conclusion or inference in relation to the judgment of the Solicitors Disciplinary Tribunal judgment or in relation to the SRA's regulatory actions or decisions.

[28] This Tribunal also considers that, contrary to the Appellant’s understanding, the Commissioner's case is not that the Appellant has other remedies or avenues to obtain the requested information. The Commissioner's case is that the Appellant’s concerns can be taken up with the SRA who can: “investigate her concerns and make enquiries without having to publicly disclose confidential information.” This is an important factor in the balancing exercise between legitimate interests in disclosure and legitimate privacy interests. Further we are of the view that there is also recourse to criminal investigative and prosecuting authorities, recognising that the SRA's regulatory powers are limited to purposes of professional sanctions. In general, however, the position is that there are alternative options to achieve the legitimate interest without the unwarranted interference with the legitimate interests and fundamental rights of the Data Subject that would result from the public Constabulary having to confirm or deny whether the requested information is held.

[29] Accordingly for all the above reasons, we find no error of Law in the Commissioner’s decision nor in any exercise of her discretion as applied therein and we must dismiss this appeal.

Brian Kennedy QC 29 April 2022.