Appeal References: EA/2022/0130
Information Rights
Determined, by consent, on written evidence and submissions.
Considered on the papers on 7 February 2023.
Decision given on: 10 February 2023
Before
TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Anne Chafer
TRIBUNAL MEMBER Pieter de Waal
Between
SHAUN POORE
Appellant
And
INFORMATION COMMISSIONER
Respondent
Decision: The appeal is Dismissed.
Substituted Decision Notice: None
REASONS
MODE OF HEARING
The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.
The Tribunal considered an agreed open bundle of evidence of 102 pages together with a closed bundle.
BACKGROUND
On 20 January 2022, the Appellant wrote to the Commissioner in relation to the outcome of a complaint with the Portsmouth City Council (the Council) of 4 May 2021. The Commissioner requested that the Council consider the final response from the Appellant as a request for information under FOIA as below:
“In relation to [address redacted]: Confirmation of how many people live in this property or an explanation as to why PCC are unable to provide this information.”
The Council responded on 20 January 2022 to confirm it held the information requested. However, the Council declined to provide the information stating that it was personal data and exempt under section 40(2) FOIA (third party personal data).
On 21 January 2022, the Appellant asked the Council to complete an internal review and confirmed that the Appellant wished to know the total number of people residing in the house and no other details.
The Council responded on 24 February 2022. The Council revised its view to confirm they believed it only held some of the information requested. The Council explained it could not be certain information held was accurate. The Council stated it would not necessarily hold information about the following: -
All people who were registered to pay council tax as not all who are liable for council tax provide their details, only the bill payer.
The Council may not know about children enrolled at independent schools.
The Council may not know about children attending schools outside the city.
They may not know about children elected as home schooled.
The Council confirmed in their internal review that it considered section 40(2) FOIA to be engaged. The Appellant contacted the Commissioner on 25 February 2022, following the outcome of the internal review to complain about the way his request for information had been handled.
The Commissioner produced a decision notice dated 25 May 2022 in which the Commissioner said that the scope of the case was to determine if the Council was correct to withhold the information on the basis of section 40(2) FOIA.
THE LAW
Section 40 (2) FOIA reads as follows: -
Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1) (personal information of the applicant], and
(b) the first, second or third condition below is satisfied.
Section 3(2) of the Data Protection Act 2018 (DPA) defines personal data as ‘any information relating to an identified or identifiable living individual’.
The Upper Tribunal (UT) has given judgment in the case of NHS Business Services v Information Commissioner and Spivack [2021] UKUT 192 (AAC) (Spivack) on 6 August 2021, which dealt with the issue as to what should be considered to be ‘personal data’ and which is potentially relevant to this appeal. A firm conclusion was reached by the UT in Spivack that the law ‘creates a binary test: can a living individual be identified, directly or indirectly? If the answer is ‘yes’, the data is personal data. Otherwise, it is not’ (paragraph 12). It is also stated that ‘The test has to be applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer….’ (paragraph 13).
In Information Commissioner v Miller [2018] UKUT 220 (AAC) at paragraphs 12-16, the Upper Tribunal acknowledged the ‘motivated intruder’ test, which relates to ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’
Again in Miller the UT noted that a similar approach was taken by the Court of Session (Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at paragraph 24:
…it is not just the means reasonably likely to be used by the ordinary man on the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist…
The adoption of this test was confirmed in Spivack at paragraph 33.
Of course, if it is established that a person has been identified, then the question arises as to whether the information relates to that person.
If the information is personal data then the relevant condition (as referred to in s40(2) FOIA) in this case is found in s40(3A)(a) FOIA:-
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles.
Under s40(7) FOIA the relevant data protection principles in this case are to be found in Article 5(1) of the UK GDPR. Materially, Article 5(1)(a) reads: -
Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).
Further, by Article 6(1) UK GDPR: -
Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…
THE DECISION NOTICE
In this case the Commissioner decided that the requested information was personal data (as defined above). The following basis for this was put forward: -
In the circumstances of this case, having considered the withheld information, the Commissioner is satisfied that the information relates to the individuals who live at the specific address stated by the complainant in their request.
The Commissioner considers that those individuals may be identifiable from the address when combined with other information. It is possible if the number of occupiers were provided that the complainant would be able to consider this alongside electoral roll data to establish the identity of the occupants. This information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA.
Next the Commissioner considered Article 5(1)(a) of the UK GDPR which means that the information can only be disclosed if to do so would be lawful, fair and transparent. As to lawfulness, the Commissioner considered the correct approach under Article 6(1)(f) of the UK GDPR (as set out above), as follows:-
…it is necessary to consider the following three-part test: -
(a) Legitimate interest test: Whether a legitimate interest is being pursued in the request for information;
(b) Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question;
(c) Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.
The Commissioner approached the case by recognising a legitimate interest for the Appellant in his concern that the house in question is being used as a ‘house in multiple occupation’ (HMO), in the context of alleged anti-social behaviour emanating from the house. The Council provided the Appellant with a definition of an HMO as a house where more than five or more adults who are not related share facilities. This would require registration with the Council as an HMO.
The Commissioner considered that ‘Necessary’ in the second part of the test means ‘more than desirable but less than indispensable or absolute necessity’ (para 38) and applied that to the request. The Commissioner said that that this could also involve consideration of alternative measures which may make disclosure of the requested information unnecessary. However, even though the Council said that it had visited the house ‘and it is not an HMO’, the Commissioner found that ‘in addition to other information available to the complainant, disclosure of the number held by the Council may be necessary in order to pursue a complaint under other procedures (paragraph 41).
In relation to the third part of the test, the Commissioner continued that ‘this must be considered carefully alongside the occupiers’ right to have their information and identity protected. It is appropriate to consider the balancing test in this case’ and that: -
It is necessary to balance the legitimate interests in disclosure against the data subject’s interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subject would not reasonably expect that the information would be disclosed to the public under FOIA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override legitimate interests in disclosure.
The Commissioner considered that: -
The Council have confirmed that the information they hold is numerical but could lead to other information in the public domain being used to actually identify individuals in the address by name. Based upon the information available the Commissioner is in agreement with this view.
The Commissioner has also noted there are other processes available to the complainant if overcrowding or anti-social behaviour is a concern. These processes do not require the information to be shared in order to be pursued, whilst ensuring the privacy of occupants is protected.
As the requested information could potentially lead to identification of specific individuals the Commissioner agrees with the Council in its application of the exemption under section 40(2) of FOIA. It is unlikely the occupants of the address would expect the information to be made public.
The Commissioner considers that disclosure of this information would be disproportionately intrusive to the data subjects in this situation and interference with their rights to privacy must be proportionate.
Based on the above factors, the Commissioner determined that there was insufficient legitimate interest to outweigh the data subject’s fundamental rights and freedoms in this case. The Commissioner therefore decided that the Council was entitled to withhold the information under section 40(2) FOIA.
THE APPEAL AND RESPONSES
The Appellant’s appeal is dated 26 May 2022. It states as follows: -
My family & I have been subject of anti-social behaviour from the tenants of what we suspect is an HMO. Some of these incidents have been reported to the Police & are subject of Police Reports. We have photographs concerning some of these incidents of anti-social behaviour.
We live opposite the potential HMO property & see individuals entering/leaving the property on a daily basis. Therefore we already know the identities of the occupants.
We believe the property maybe an HMO requiring a mandatory licence. Portsmouth City Council have stated it is not but refuse to confirm the number of occupants living in this property. The property uses an extra-large black wheely bin & three extra-large green wheely bins which may indicate that this property is an HMO requiring a mandatory licence.
Other neighbours expressed their concerns regarding continual breaches of Covid Regulations during lockdown due to the number of people visiting the property.
I am not seeking any personal data.
My information request is for the number of people supposedly resident in this property. This number will not reveal the identity of any individuals.
…
On balance I believe my request is proportionate, reasonable, lawful & passes the criteria detailed in the attached ICO document [the appeal then sets out the three-stage test in the decision notice].
The Commissioner’s response to the appeal repeats the findings in the decision notice. In particular the response argues that disclosure of the information would make the identification of the data subjects possible when cross-referenced with other information held by the Council. The Commissioner argues that the fact that the Appellant says he knows the identities of the individuals ‘is in direct contradiction’ to his argument that disclosure will not reveal the identities of any individuals. The Commissioner stands by the application of the three-stage test in the decision notice.
DISCUSSION
The Tribunal has some difficulty with the reasoning of the Commissioner on a number of issues in this case, but ultimately has reached the same conclusion as the Commissioner as to the application of s40(2) FOIA.
In relation to the question of whether the information sought is personal data, the Commissioner’s case appears to be that once told the number of people living at the property, then the Appellant will be able to scrutinise other records held by the Council and identify the individuals who live at the house: this is the issue addressed in cases such as Spivack and Miller referred to above.
However, in our view this reasoning does not hold up to scrutiny. The information as to the identities of those (or some of those) who live at the house is already available through other records held by and available from the Council, such as the electoral register. The Appellant can already find that information if he so wishes. In our view, knowing the number of people living in the house adds nothing to the information that is available to the Appellant from other sources and does not assist him to identify who lives in the house.
On that basis we reject the Commissioner’s arguments as to why the information sought is ‘personal data’.
However, there is another way in which it can be said that the information sought is personal data. Thus, if the Appellant, say, takes the available information as to identity of an individual that the Council says it holds, who lives in the house and combines that with the number of people who live in the house, then the Appellant will know how many people live in the same premises as that individual.
In our view, that would amount to ‘information relating to an identified or identifiable living individual’ and thus come within the definition of personal data. It seems to us that disclosure as to the numbers of people living in a household of a person who can be identified must be information ‘relating to’ that person and therefore is personal data.
Therefore, we conclude that the information sought is personal data, but for reasons which differ from those put forward by the Commissioner.
Having reached that conclusion, we must also consider the three-stage test considered by the Commissioner and explained in some detail above.
We accept, as did the Commissioner, that the Appellant has a legitimate interest in having the information disclosed. He says he is suffering from anti-social behaviour from a particular house (it is not our role to decide if this is so), and he has concerns that the house should be registered as an HMO. Knowledge of the number of people living there would help him to pursue that issue.
However, in relation to the second part of the three-part test, we do not agree with the Commissioner that disclosure is necessary for the Appellant to pursue those interests. In relation to the necessity test in the Supreme Court case of South Lanarkshire Council v Scottish IC [2013] UKSC 55, Lady Hale said at paragraph 27 that a ‘measure would not be necessary if the legitimate aim could be achieved by something less’. Applying that to the context of this case, if the ‘legitimate aim’ of the Appellant is pursuing issues of anti-social behaviour and whether a house should be listed as an HMO, then there are, in our view, ways that this can be achieved other than by the disclosure of personal information. Indeed, the Commissioner has referred to this in the decision notice (albeit when considering the third part of the test) when at paragraph 47, the decision notice states: -
The Commissioner has also noted there are other processes available to the complainant if overcrowding or anti-social behaviour is a concern. These processes do not require the information to be shared in order to be pursued, whilst ensuring the privacy of occupants is protected.
We agree with this, but applying it to the second part of the test, we reach the conclusion that disclosure is not necessary to meet the Appellant’s legitimate aims. We note that the Appellant has already asked the Council to investigate whether the premises is an HMO (and the Council has reached a decision on this issue), and in his appeal document says that anti-social behaviour has been reported to the police.
Having reached that view, we do not need to go on to consider the third part of the test. However, if we had reached that aspect of our decision-making process we would have agreed with the Commissioner’s finding (as set out above) that, especially in the light of other avenues open to the Appellant, the fundamental rights of the occupants of the house in question would not have been overridden by the Appellant’s need to pursue his legitimate interest.
CONCLUSION
For the reasons set out above we are satisfied that that the Council was entitled to rely on s40(2) FOIA to withhold the information. Therefore, this appeal is dismissed.
Signed Judge Stephen Cragg KC Date: 9 February 2023