Martha Wardrop v Information Commissioner & Anor

This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 23 August 2021 (IC-111481-Y9T6, the “Decision Notice). The appeal relates to the application of the Freedom of Information Act 2000 (“FOIA”). It concerns information about the disciplinary record of a named former police officer requested from the Metropolitan Police Service (“MPS”).

The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).

On 14 August 2020, the appellant wrote to MPS and requested the following information (the “Request”):

“As a local elected councillor for the Hillhead ward, Glasgow City, I am seeking information on a former police officer of the Met in the interests of protecting the public. His name is [name redacted], [job title redacted] at the University of Glasgow. [Name redacted] was a Detective Constable at [name redacted] Police Office. Information is requested referring to [name redacted] as the subject of a disciplinary process in 2003 which led to his dismissal or resignation.”

MPS responded on 18 August 2020 and refused to confirm or deny whether it held the requested information, based on section 40(5) FOIA (personal data).

The appellant requested an internal review on 22 December 2020. MPS responded on 26 April 2021 and maintained its position.

The appellant complained to the Commissioner on 12 March 2021. The basis of her complaint was the interests of protecting the public, and reassurance that the officer is suitable to implement measures to address gender-based violence. The Commissioner decided:

The appellant appealed on 20 September 2021. Her grounds of appeal are:

The Commissioner’s response maintains that the Decision Notice was correct. The Tribunal notes that the response says that confirmation or denial was not necessary for several the legitimate interests relied on by the appellant. This appears to be different from the Commissioner’s decision, which states in paragraph 41 that “there are no less intrusive means of achieving the legitimate aims identified”. The response states:

The Tribunal met on 1 April 2021 and decided it was not possible to make a fair decision without further information from the MPS. Then MPS was joined to the proceedings as the second respondent, and the Tribunal made directions which asked for various issues about disciplinary/misconduct outcomes to be covered in its response.

MPS’s response maintains its position:

Neither the appellant nor the Commissioner provided a reply to the response from the MPS.

The relevant provisions of FOIA are as follows.

Any person making a request for information to a public authority is entitled—

Personal information.

If on an appeal under section 57 the Tribunal considers—

On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

A “neither confirm nor deny” response can be used to protect personal data, whether or not a public authority actually holds the requested information. There are situations where merely confirming or denying whether information is held will reveal personal data about a third party and breach the data protection principles.

The Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”.  The “processing” of such information includes “disclosure by transmission, dissemination or otherwise makingavailable” (s.3(4)(d) DPA), and so includes disclosure under FOIA – including disclosing whether or not information is held.

The data protection principles are those set out in Article 5(1) of the General Data Protection Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the datasubject”. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) GDPR. These include where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.

The Article 6(1)(f) balancing test involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):

As noted by the Commissioner, the GDPR has been replaced by the UK GDPR after the end of the Brexit transition period. We have considered this case in accordance with the GDPR, as the Request was received before the end of the transition period. We note that application of the UK GDPR would involve the same legal analysis.

The appellant emailed the Tribunal on 2 and 6 December 2021 asking for names in the bundle and submissions to be redacted. She provided further information in an email of 15 December 2021, requesting that any names and job titles in the bundle are not made public to prevent existing and former police officers from being identified. The appellant said that due to the level of media interest in policing matters, she was concerned that the information could result in serious harm to identified individuals and they would seek compensation for damage to their careers of character.

Judge McKenna considered this application on 30 December 2021. She made no order, and directed that the matter should be decided by the Tribunal panel hearing the appeal. She made some observations, including that the Decision Notice is drafted in terms that do not reveal the name of the individual about whom the information request is made, and it would be open to the Tribunal panel to do the same thing. She also noted that the bundle is not published, and the parties would be consulted before the bundle was released to the public after the hearing.

The appellant replied on 6 January 2022. She said there is a risk that if it is determined that information from disciplinary proceedings prior to 2015 can be made publicly available, then this may impact on job prospects, reputation and financial position of some police officers or former police officers.

The Commissioner provided submissions on this point on 28 January 2022. This provides details of names and job titles in the bundle, and confirms that three existing and former officers could be identified. The Commissioner submits that the concerns raised by the appellant are a factor to take into account in determining whether section 40(5) was correctly engaged, but points out that any decision is only binding on the parties to this appeal and would not mean the requested information (if it exists) would need to be disclosed or that other police forces would be required to confirm or deny the existence of similar information.

We have considered the application and submissions. We have decided that the appeal may be decided fairly and justly without publicly revealing the name or job title of the individual about whom the information request is made, taking into account the fact the appeal is based on data protection issues. It is also not relevant or necessary to name any other existing or former police officers in the appeal decision. It is not necessary to redact the bundle at this stage in the proceedings. If there is a request from a member of the public to view the bundle after the appeal has been decided, the parties will be given the opportunity to make further representations about redactions before it is released. Any decision about confirmation or denial in this case will only relate to this specific Request, and would not mean that similar information would necessarily need to be confirmed or denied in other cases.

The overall issue is whether MPS was entitled to rely on section 40(5B)(a)(i) to refuse to confirm or deny whether it held the requested information, on the grounds it would contravene the data protection principles. The breaks down into the following issues:

By way of evidence and submissions we had an agreed bundle of open documents, which we have read and taken into account in making our decision.

On behalf of the MPS we had a written witness statement from Mr Damion Baird (Acting Senior Information Manager within the MPS Data Office), which explains how the MPS responds to FOIA requests about police employee conduct and discipline. We also had a written witness statement from Mr Scott Didham (Police Inspector with the responsibility for the MPS Directorate of Professional Standards Misconduct Hearings Unit), which explains the history of the publication of information about police misconduct matters.

In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision.

It is a well-established principle that a public authority can issue a “neither confirm nor deny” response to a request for information, irrespective of whether or not the information is held. It is important for public authorities to be able to give a consistent response. If a public authority always revealed when information was not held, a neither confirm nor deny response would effectively give away the fact that information was held. We do not know in this case whether the requested information is held or not, and it is not necessary for us to know this in order to make our decision.

We deal in turn with the issues.

Would confirmation or denial constitute disclosure of third-party personal data? We find that it would, and this is not disputed by the respondents. The Request relates to a named individual, and confirmation or denial would provide information about whether he had been subject to a disciplinary process which led to dismissal or resignation.

If so, would confirmation or denial contravene one of the data protection principles? In particular, would the processing be lawful under Article 6(1)(f) GDPR? The legitimate interests test under Article 6(1)(f) appears to be the only relevant lawful processing condition in this case.

Is there a legitimate interest in disclosure of the personal data? A number of legitimate interests are relevant in this case.

Is confirmation or denial necessary for the purposes of those interests? The test is whether this is reasonably necessary, and we have considered whether there are less intrusive ways of furthering these interests.

In relation to the safety of girls and young women at the University, the Commissioner says that there are less intrusive means of achieving this. The named individual’s place of work would be responsible for safety checking and it is likely that security and employment checks would have been carried out. The MPS also takes this position. They say that they have invited the appellant to contact the police about safety concerns. They also say that the issue of the suitability of the individual for the role could be more effectively pursued via their named employer, who would be responsible for recruitment and performance. Mr Baird’s statement refers to voluntary disclosures during the application process, employment-related and character references, and vetting processes such as a Disclosure and Barring Service (“DBS”) check.

We agree that the individual’s employer is responsible for recruitment and checking suitability for employment in a particular role. This includes obtaining references, asking the individual for information, and potentially conducting DBS checks (depending on the role). This would go some way towards addressing the appellant’s concerns and would be less intrusive. However, it would only partially meet this legitimate interest. There might be failures with the employer’s recruitment checks. More importantly, these checks will only reveal partial information. A DBS will only reveal records of offences (plus some additional information with enhanced checks), previous employers are under no obligation to provide a reference, and an individual may not provide complete information. We accept that information about whether an individual resigned or was dismissed as a result of disciplinary proceedings may be relevant to their suitability for a role at the University. This would not necessarily be revealed by employer checks, particularly if the individual resigned during the process. We therefore find that confirmation or denial is necessary for this purpose.

In relation to transparency and the accountability of police officers for actions when on duty, the current publication scheme operated by the MPS goes some but not all of the way to meeting this legitimate interest. Not all information about disciplinary matters is published, and this Request relates to a time before publication happened at all. Mr Didham makes the point that the current system of publishing misconduct outcome rationales increases accountability and transparency. However, the current publication system does not further accountability of police officers from the time before this was implemented. Similarly, general transparency interests relating to disciplinary records from that time are not furthered by the current approach. We note the Commissioner’s point that the Request only relates to one named individual. Nevertheless, we therefore find that confirmation or denial is reasonably necessary for this purpose.

Are such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? As requested, MPS has provided information about the information that is published about police misconduct matters. This is relevant to the balancing exercise and is explained in Mr Didham’s statement.

We have considered the strength of the legitimate interests identified above.

We have considered the strength of the named individual’s rights, in particular his privacy rights.

We have balanced the legitimate interests in confirmation and denial against the named individual’s rights. We found this to be a finely balanced question. The legitimate interest in ensuring the safety of girls and young women at a University is very important. However, as discussed, this can partly be achieved through less intrusive means than public confirmation or denial under FOIA. The individual’s reasonable expectations of privacy are strong, particularly considering the age of the information and the gap in time before any details about police misconduct matters were made public. Distress and damage to the individual is likely, taking into account the strength of the expectations of privacy here and potential effects of public confirmation of a disciplinary process (if this information is held). On balance, we therefore find that the interests in confirmation or denial are overridden by the individual’s privacy rights.

This means that confirmation or denial would contravene the data protection principles, because there is no lawful basis for this processing. MPS was entitled to rely on section 40(5B)(a)(i) to refuse to confirm or deny whether it held the information requested by the appellant.

In relation to the desired outcome from the appeal, the appellant says that the decision by MPS not to publish information about disciplinary proceedings and the outcome should be subject to detailed scrutiny and challenged, as it does not provide openness and transparency relating to conduct inquiries for all police officers. We have considered this in relation to this particular request as discussed above. We also observe that MPS practice has changed, and information about misconduct hearings is now publicly available. Although there is limited transparency about events in 2003, the position is different now. Mr Baird explains in his statement how FOIA requests for misconduct and disciplinary records are now dealt with. There is now enhanced openness and transparency, and the outcome in this case may have been different if the request related to recent disciplinary proceedings.

We also note that we are not setting any precedent for future requests. Paragraph 36 of the Commissioner’s response to the appeal says that once a public authority has denied (or disclosed) certain information to a particular requester, it must then do the same for anyone else. It is important to be consistent in confirmation and denial cases in order to avoid inadvertently revealing information by giving a “neither confirm nor deny” response only when information is held. However, it is not right to say that the same response must be given to every request for the same information which involves personal data. Each request must be treated on its own merits, and the relevant balancing test carried out in all the circumstances of the case. The legitimate interests in asking for the same information may differ, and may outweigh individual privacy interests in some cases but not others.

We dismiss the appeal for the reasons set out above.