On26 November 2020 Mr Edward Williams, the Appellant in these proceedings, wrote to the Avon & Somerset Constabulary (‘ASC’) referring to events on the night of 31 October/1 November 2020 when its officers shut down an illegal rave on the outskirts of Bristol and a member of the public, Ms J Andrew, sustained severe injuries to her leg as a consequence of being bitten by a police dog, requesting, pursuant to the Freedom of Information Act 2000 (‘FOIA’), information in these terms (numbering added and punctuation improved):

ASC responded on 18 December 2020, refusing to provide the information and citing FOIA (Footnote: ¹), ss30 (investigations and proceedings) and 40 (personal information).

Mr Williams took issue with that response, but, in a letter of 30 December 2020 following an internal review, ASC stood by it, in addition citing s38 (health & safety). (Footnote: ²)

On 30 December 2020, the very day of the internal review decision, Mr Williams complained to the Respondent (‘the Commissioner’) about the way in which his request for information had been handled. An investigation followed.

By a decision notice dated 8 February 2022 the Commissioner determined that:

By a notice of appeal dated 8 February 2022, the Appellant challenged the Commissioner’s adjudication on all matters save for request 4. He argued that the appeal raised a simple point of police accountability and that there was a compelling case for disclosure of the identity of the handler of the dog which had committed the attack. (It seems that the officer’s name/number could not be discerned from the Youtube video which he exhibited.) He also stressed the seriousness of the injury which Ms Andrew had sustained.

On 17 March 2022 ASC complied with the Commissioner’s decision of 8 February in relation to request 4 and voluntarily disclosed the information it held within the scope of requests 6 and 8. Accordingly, the ‘live’ dispute was restricted from then on to requests 1, 2, 3 (part only), 5 and 7.

The Commissioner resisted the appeal in a response dated 28 March 2022, drafted by a member of his staff. The document consists of a synopsis and commendation of the decision notice and an exceedingly brief critique of the notice of appeal. It contains no analysis of the relevant law. We cannot describe it as useful.

FOIA, s1 includes:

By s30 it is provided, relevantly, as follows:

By s40 it is provided, so far as material, as follows:

The data protection regime under the Data Protection Act 2018 (‘DPA 2018’) and the General Data Protection Regulation (‘GDPR’) applies to this case.

DPA 2018, s3 includes:

GDPR, Article 5 sets out the data protection principles. It includes:

Article 6, so far as material, provides:

The appeal is brought pursuant to the FOIA, s57. The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

If a qualified exemption, such as any under s30, is shown to apply, determination of the disclosure request will turn on the public interest test under s2(1)(b), namely whether, “in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in maintaining the exemption”. The proper approach, as explained by the Upper Tribunal in APPGER v IC [2013] UKUT 560 (para 149) is:

The relevant date for the purposes of applying any public interest balancing test and, it seems, determining the applicability of any exemption, is the date on which the request for information was refused, not the date of any subsequent review: see Montague v ICO and DIT [2022] UKUT 104 (AAC), especially at paras 47-90.

The analysis under s40 is different to that applicable to s30. Here, the starting-point is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded. At para 7 he commented:

In Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd & others [2017] EWCA Civ 121, Lewison LJ, giving the only substantial judgment on behalf of the Court of Appeal, remarked (para 62):

It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, ‘necessary’ means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing exercise, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.

The Upper Tribunal has held (also under the pre-1998 data protection legislation) that it is legitimate to consider at the outset the first part of (what is now) the Article 6 test (lawful processing), before addressing (if need be) the further elements of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20).

The appeal is brought pursuant to the FOIA, s57. The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

In current Guidance on Requests for Personal Data about Public Authority Employees (Footnote: ⁴), the Commissioner states (p13):

We interpret request 7 as seeking the document by which ASC referred the case to the Independent Office for Police Conduct (‘IOPC’).

Having scrutinised the closed material, we are satisfied that a document within the scope of the request (as we interpret it) was within the possession of ASC at the time of the refusal. We are also satisfied that the information sought by the request was within the scope of the exemptions under s30(1)(a) and (b). It was directed to the events of the night of 31 October/1 November 2020 to which we have referred in our introduction and it is plain from the material before us that, at the time of the refusal (only some six weeks thereafter), a police investigation was underway directed, in large part if not entirely, to the question whether anyone had acted in breach of the criminal law and, if so, whether criminal proceedings were warranted. Accordingly, the class-based exemptions under s30(1)(a) and (b) are engaged.

This brings us to the public interest balancing test. On the present facts, application of the test presents us with no difficulty whatsoever. We are entirely clear that the public interest in maintaining the exemption comprehensively outweighs any small interest in disclosure. As at the date of the refusal, there was precious little if any public interest in disclosure of the document sought. It was not a ‘report’, but a referral made with a view to an investigation being carried out by the IOPC. In the nature of things, it could not be expected to contain a full account of what had happened at the rave or how Ms Andrew had suffered her injury. In any event, such account as it contained was that of ASC only and, if disclosed at the date of the refusal, could not have been expected to command public confidence as a comprehensive or disinterested record of events.

In the balance against disclosure must be placed the obvious and powerful public interests in avoiding prejudicing law enforcement, the need to maintain the independence of judicial and prosecution processes and the need to preserve the criminal court as the sole forum for determining guilt. (Footnote: ⁵) These interests fully justify protecting information of the sort which Mr Williams seeks, to allow the police, the Crown Prosecution Service and, where applicable, other relevant agencies the time and space they need to complete their investigations and take such decisions as fall to them. Of course, protection of this kind will not be unconditional or open-ended: passage of time, apparent inconsequentiality of the information in question and other considerations may strengthen the arguments in favour of disclosure in particular cases. But we find none of these factors in play here. To the contrary, it is plain and obvious to us that, leaving aside any other objection, request 7, raised less than two months after the complex event to which it relates, was manifestly premature and could only sensibly be met with the response which ASC provided.

Here it is convenient to start by considering requests 1 and 2 and the part of request 3 which remains contentious. There is no room for any doubt that these are all requests for personal data of the dog handler. It is not in question that identification of the dog would inevitably reveal his or her handler. Likewise, identification of the dog’s records.

We have wondered whether request 5 falls into a different category but have concluded that it does not. Publication of the handler’s records would be bound to identify him or her, at least to his or her peers.

Accordingly, unless processing would be fair and lawful under GDPR, Article 5, the exemption under s40(2) applies without more.

In line with the Farrand case, we consider first the Article 6 question of lawful processing. Was processing necessary (ie reasonably necessary) for the purposes of any legitimate interest pursued by the ASC or any third party? We agree with the Commissioner (DN, para 42) that there was and is a legitimate interest in public scrutiny of police conduct, particularly in circumstances where such conduct is associated with a serious injury to a member of the public. But we also agree with the Commissioner that, at the time of the refusal, disclosure was not at all necessary for the purpose of promoting that interest. On the contrary, it is hard to see how, at that point, the processing contended for could have served the interest in any material way, let alone in the least intrusive way. At the date of the refusal, the expectation was that the facts would be fully examined by the IPOC and that, dependent on its findings, an internal ASC investigation and/or disciplinary proceedings would follow. Those processes, which would be amenable in due course to FOIA requests in so far as the findings reached were not immediately placed in the public domain, were plainly an appropriate means of promoting the relevant interest and much less intrusive than the uncontextualised, premature disclosure of personal data sought by Mr Williams’s request.

Since it is clear and obvious to us that, at the time of the refusal, the disclosure contended for was not necessary, it follows without more that the exemption under s40(2) is engaged.

The appeal must be dismissed.

Finally, we pay tribute to the ASC for its refreshing willingness to reconsider its stance to FOIA requests and volunteer information initially refused. Many public authorities would do well to share that spirit.