Case Reference: EA/2021/0380
Information Rights
Heard: on the papers
Decision given on: 07 July 2022
Before
TRIBUNAL JUDGE BUCKLEY
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER DAVE SIVERS
Between
MARTINA HOGG
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The appeal is allowed.
Substituted Decision Notice:
Original Decision Notice: IC-82968-F7M6 of 7 December 2021
Organisation: Pendle Borough Council
Complainant: Martina Hogg
The substitute decision:
1. The appeal is allowed.
2. For the reasons set out below and in the closed annex to this decision:
a. The public authority was not allowed to withhold the information specified in part A of the closed annex pursuant to s40(2) of the Freedom of Information Act 2000.
b. The public authority was entitled to withhold the information specified in part B of the closed annex pursuant to s40(2) of the Freedom of Information Act 2000.
3. The public authority must disclose to the appellant the information specified in part A of the closed annex within 35 days of the date of promulgation of this decision.
4. Any failure to abide by the terms of the tribunal’s substituted decision notice may amount to contempt which may, on application, be certified to the Upper Tribunal.
REASONS
Introduction
The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.
This is an appeal against the Commissioner’s decision notice IC-82968-F7M6 of 7 December 2021 which held that the Pendle Borough Council (‘the Council’) was entitled to rely on s 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold some of the requested information and that the Council did not hold some of the information requested.
The Commissioner found that the Council was not entitled to withhold some of the information and ordered the Council to disclose some information that had previously been redacted.
We have provided a closed annex to this decision containing those aspects of our reasoning which refer to closed material. If the respondent does not appeal against our decision, or if any appeal is unsuccessful, then some of that reasoning (part A) need not remain confidential.
The time limit in the information rights jurisdiction for making an application for permission to appeal to the Upper Tribunal is normally 28 days from the date that the tribunal’s written reasons are issued: see Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009, rule 42(2).
We therefore direct that part A of the closed annex will remain confidential until at least 28 days after the date this decision is issued to the parties (or such later date as is required by rule 42 or final disposal of an application for permission to appeal and subsequent appeal.
The effect of this decision is that, in normal circumstances, the confidentiality will be removed from part A 28 days after this decision is issued, unless within that time a party makes an application for permission to appeal to the Upper Tribunal. In that event, and subject to any contrary order of the Upper Tribunal, the confidentiality order will continue until disposal of the permission application and any ensuing appeal but will then be discharged. If the confidentiality order is discharged, part A of the closed annex will then be added to the publicly available decision and copied to Ms Hogg. Part B of the closed annex contains reference to the information we have determined can be withheld and will remain closed.
Procedural background to the appeal
By order dated 9 March 2022 the Council were invited to state whether they intended to become a party to the proceedings. The Council confirmed by email dated 23 March 2022 that they did not intend to become a party to the appeal.
Factual background to the appeal
The appeal relates to an independent review into the handling of an animal licensing application made to the Council by Douglas Hall Kennels. The remaining disputed information is redacted from the review report.
The review report is a peer review of the application. The scope of the review was an assessment of how the Council administered and regulated the new licence application and of the renewal in relation to the kennel’s activities. The review report states that its purpose is to highlight whether the owner(s) of the kennels met the legal requirements and conditions under the Animal Welfare (Licensing of Activities Involving Animals) (England) Regulations 2018 and whether the Council has ensured that the operator has a licence for activities that were being undertaken at the time of the inspection.
The disputed information is the redaction of the name(s) of the business owner(s) from para 11.9 of the review report. Para 11.9 forms part of the ‘recommendations’ section of the report and reads are follows:
The legal entities of the applicants should be questioned further with the licensee to seek clarification. [redacted] This will ensure that the licences are in the correct legal name.
Request, decision notice and appeal
The request
This appeal concerns the following request made on 2 December 2020 in relation to an independent review into the handling of the licensing application submitted by Douglas Hall Kennels. The request is for:
The name(s) of the person(s) who conducted the review
Confirmation of how the person(s) was appointed. From an existing panel? Via tender?
A copy of the letter of instruction or other document(s) setting out the terms of reference /remit of the review
A copy of the review report
Ms Hogg made a further request on 7 December 2020 which was dealt with in the same decision notice, but which is not the subject of any appeal to the tribunal.
The response
The Council responded on 9 December 2020 and provided some information. It redacted some information from the letter of instruction and the review report.
Ms Hogg requested an internal review in relation to the redactions to the review report.
Ms Hogg referred the matter to the Commissioner on 18 January 2021, complaining about (i) the redactions made under s 40(2) and (ii) the ‘not held’ response to her request of 7 December 2020.
The Council carried out an internal review and on 25 February 2021 upheld the decision to withhold the redacted information under s 40(2). The internal review also deals with the request on 7 December 2020 which is not the subject of this appeal.
During the course of the Commissioner’s investigation the Council reconsidered the review report and decided that three words should not have been redacted.
The Decision Notice
In a decision notice dated 7 December 2021 the Commissioner decided that:
In relation to the request of 7 December 2020 the information was, on the balance of probabilities, not held.
The Council was entitled to withhold some of the redacted information under s 40(2).
The Council was not entitled to withhold some of the redacted information under s 40(2).
It is not necessary for the purposes of this appeal to set out the Commissioner’s reasoning in relation to 16.1 above.
The remaining disputed information was the redaction in para 11.9 of the review report of the name(s) of the business owner(s). The Commissioner accepted that the information identified the business owner(s) and related to them. The Commissioner found that the withheld information fell within the definition of personal data in s 3(2) of the Data Protection Act 2018 (‘DPA’).
The Commissioner concluded the appellant’s legitimate interest was that disclosure would add to the accountability and transparency of the Council in relation to the licence and help to address any concerns about animal welfare.
The Commissioner considered that the review report sufficiently met the legitimate interests without the need to disclosure the name(s) of the business owner(s). He did not need to go on the conduct the balancing test under article 6(1)(f) GDPR.
Notice of Appeal
The two grounds of appeal are:
The Council should have had regard to the Council’s conduct, in initially withholding other information which was clearly not personal data, when deciding whether or not it was entitled to withhold the information redacted from para 11.9.
The Commissioner erred in concluding that it was not reasonably necessary to disclosure the name(s) for the purposes of the legitimate interest.
In relation to ground two, Ms Hogg argues that it is clear, in context, that the redacted sentence relates to potential shortcomings as regards licences being issued in the correct name. There is a legitimate public interest in disclosure of information relating to who the licensee is, and whether or not any third party has been involved in the business without being appropriately licenced. There is also a public interest in establishing whether or not the Council’s own procedures correctly identified and licensed the right entity and/or that all entities involved in the regulated activities of dog breeding and pet selling are licenced.
The ICO’s response
The Commissioner now considers that the report with one remaining redaction does not sufficiently meet the legitimate interest in the Council’s licencing function because one of the outcomes from the report was that further consideration is required in relation to the legal name(s) on the licence.
The Commissioner concedes the appeal to the extent the Commissioner should have concluded that disclosure of the information is necessary to meet the legitimate interest. If the tribunal agrees the Commissioner was wrong to conclude that the disclosure was not necessary to meet the legitimate interest then the Commissioner invites the tribunal to perform the balancing test and to reach a decision on disclosure. The tribunal may consider it would need further information to enable it to perform this exercise. The Commissioner invited the tribunal to join the Council to the appeal.
Evidence
We read and took account of an open and a closed bundle. The closed bundle consisted of (i) the disputed information and (ii) two items of correspondence between the Commissioner and the Council which refer to the content of the disputed information. These documents have to be closed, otherwise the purpose of the proceedings would be defeated.
Legal framework
Personal data
The relevant parts of s 40 of FOIA provide:
Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
Any information to which a request for information relates is also exempt information if –
It constitutes personal data which does not fall within subsection (1), and
either the first, second or the third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
would contravene any of the data protection principles, or..
Personal data is defined in s 3 of the Data Protection Act 2018 (DPA):
‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—
an identifier such as a name, an identification number, location data or an online identifier, or
one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
This is in line with the definitions in the General Data Protection Regulation (EU) 2016/679. Recital 26 to the Regulation is relevant, because it refers to identifiability and to the means that should be taken into account:
The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a
manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
The definition of "personal data" consists of two limbs:
i) Whether the data in question "relate to" a living individual and
ii) Whether the individual is identified or identifiable, directly or indirectly, from those data.
The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd [2017] EWCA Civ 121; Durant v FSA [2003] EWCA Civ 1746 and Edem v Information Commissioner [2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.
In Durant, Auld LJ, giving the leading judgment said at [28]:
Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.
In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:
It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.
The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider:
Does the data "relate" to an individual in the sense that it is "about" that individual because of its:
"Content" in referring to the identity, characteristics or behaviour of the individual?
"Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?
"Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)?
Are any of the 8 questions provided by the TGN are applicable?
These questions are as follows:
Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller?
Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession?
Is the data 'obviously about' a particular individual?
Is the data 'linked to' an individual so that it provides particular information about that individual?
Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?
Does the data have any biographical significance in relation to the individual?
Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?
Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)?
Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?
The data protection principles are set out Article 5(1) of the GDPR and s 34(1) DPA. Article 5(1)(a) GDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) GDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.
The only potentially relevant basis here is article 6(1)(f):
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.
The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows
Is the data controller or a third party pursuing a legitimate interest or interests?
Is the processing involved necessary for the purposes of those interests?
Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:
... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ...
S 40(3A) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.
The role of the tribunal
The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner, and may make different findings of fact from the Commissioner.
Issues
In relation to the remaining disputed information redacted from para 11.9 of the review report the issues for the tribunal to determine are:
Does the information relate to an identified or identifiable living individual?
Is the data controller or a third party pursuing a legitimate interest or interests?
Is the processing involved necessary for the purposes of those interests?
Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
Discussion and conclusions
Personal data
The question for us to determine is whether the withheld information is the personal data of an identifiable living individual. We find that the sentence redacted from para 11.9 relates to an identifiable individual or individuals. It is clearly about the individual(s) and the individual(s) is/are named.
Legitimate interest
We accept that the appellant is pursuing a legitimate interest, namely that disclosure would add to the accountability and transparency of the Council in relation to the licence and help to address any concerns about animal welfare.
Reasonable necessity
We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interests. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least restrictive means of achieving the legitimate aim in question, because it would not be necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subjects.
On balance, we agree with the Commissioner that disclosure of the information specified in part A of the closed annex is reasonably necessary for the purposes of the legitimate interests. The legitimate interest relates to transparency around the Council’s licencing function. The purpose of the peer review report was to assess how the Council had administered and regulated the new licence application and renewal for Douglas Hall Kennels Ltd. One of the recommendations of the report was that ‘the legal entities of the licensee should be questioned further with the licensee to seek clarification’.
Without the information specified in part A, it is more difficult to understand why this recommendation was made. In order to serve the legitimate interest in transparency we conclude that it was reasonably necessary to see the redacted information specified in part A, which provides context and assists in understanding the recommendation.
In relation to the information specified in part B of the closed annex, namely the final four words of the redacted sentence, we do not agree that disclosure is reasonably necessary for the purposes of the legitimate interests. The information does not add to the understanding of the review report or why this recommendation was made, nor is it relevant to the Council’s licencing function. On this basis we do not need to consider the balance of interests in relation to the information specified in part B and we find that the Council was entitled to withhold this information under s 40(2).
Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
The reasoning in this section relates to the information specified in part A of the closed annex only.
Given the limited information that has been withheld, we find that it contributes to transparency only to a moderate extent.
We then consider whether those interests identified above are outweighed by the interests of the individual(s).
The seriousness of the consequences of disclosure will be affected by the extent to which the withheld information is already in the public domain. Our reasoning and conclusions on the extent to which the withheld information is in the public domain and the effect of this on the interests of individual(s) is in the closed annex, on the basis that it would defeat the purposes of the appeal if included in the open decision. In summary we have concluded there will be no or no significant impact on the individual or individuals involved by the release of the information.
We have considered the extent to which disclosure would be within the reasonable expectations of the individual(s). Our reasoning and conclusions on this are in the closed annex, on the basis that it would defeat the purposes of the appeal if included in the open decision. In summary we have concluded that the individual or individuals would reasonably expect this information to be public and therefore would reasonably expect it to be disclosed. In these circumstances we conclude that the individual(s) would have had a reasonable or legitimate expectation that his or her identity or identities would be disclosed.
We accept that there is no evidence of consent, but given the nature of the information and our conclusions in the closed annex in relation to what information, if any, was already in the public domain, we find that there is no potential harm or distress.
Taking all the above into account, we conclude that although there is only a moderate interest in disclosure of this small amount of information, it is not outweighed by the legitimate interests of the individual(s) involved. In those circumstances we find that the Council was not entitled to withhold the information in part A of the closed annex under s 40(2) FOIA.
Signed Sophie Buckley Date: 6 July 2022
Judge of the First-tier Tribunal
Case Reference: EA/2021/0380
NCN: [2022] UKFTT 00256 (GRC)
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard: on the papers
Heard on: 1 July 2022
Decision given on: 07 July 2022
Before
TRIBUNAL JUDGE BUCKLEY
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER DAVE SIVERS
Between
MARTINA HOGG
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
CLOSED ANNEX
PART A – TO BE DISCLOSED AFTER 28 DAYS UNLESS PERMISSION TO APPEAL IS GRANTED
The specified information is the following wording from para 11.9 of the peer review report:
‘On the Companies House website there are various companies operated by Mr. Eric Lancaster and Mr. John ’William’ Lancaster’
Both individuals are named elsewhere in the report, which has been released to the world under FOIA. They both appear on the licence. We find that both individuals would have had no expectation that their names would not be disclosed. The withheld information is a factual statement describing information which is in the public domain and easily accessible by a simple search on the Companies House website. We find that there would have been no reasonable expectation of privacy in relation to this information, and no significant impact on those individuals by its disclosure.
Signed Sophie Buckley Date: 6 July 2022
Judge of the First-tier Tribunal