Shaun Poore v Information Commissioner

The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.

The Tribunal considered an agreed open bundle of evidence of 102 pages together with a closed bundle.

On 20 January 2022, the Appellant wrote to the Commissioner in relation to the outcome of a complaint with the Portsmouth City Council (the Council) of 4 May 2021. The Commissioner requested that the Council consider the final response from the Appellant as a request for information under FOIA as below:

“In relation to [address redacted]: Confirmation of how many people live in this property or an explanation as to why PCC are unable to provide this information.”

The Council responded on 20 January 2022 to confirm it held the information requested. However, the Council declined to provide the information stating that it was personal data and exempt under section 40(2) FOIA (third party personal data).

On 21 January 2022, the Appellant asked the Council to complete an internal review and confirmed that the Appellant wished to know the total number of people residing in the house and no other details.

The Council responded on 24 February 2022. The Council revised its view to confirm they believed it only held some of the information requested. The Council explained it could not be certain information held was accurate. The Council stated it would not necessarily hold information about the following: -

The Council confirmed in their internal review that it considered section 40(2) FOIA to be engaged. The Appellant contacted the Commissioner on 25 February 2022, following the outcome of the internal review to complain about the way his request for information had been handled.

The Commissioner produced a decision notice dated 25 May 2022 in which the Commissioner said that the scope of the case was to determine if the Council was correct to withhold the information on the basis of section 40(2) FOIA.

Section 40 (2) FOIA reads as follows: -

Section 3(2) of the Data Protection Act 2018 (DPA) defines personal data as ‘any information relating to an identified or identifiable living individual’.

The Upper Tribunal (UT) has given judgment in the case of NHS Business Services v Information Commissioner and Spivack [2021] UKUT 192 (AAC) (Spivack) on 6 August 2021, which dealt with the issue as to what should be considered to be ‘personal data’ and which is potentially relevant to this appeal. A firm conclusion was reached by the UT in Spivack that the law ‘creates a binary test: can a living individual be identified, directly or indirectly? If the answer is ‘yes’, the data is personal data. Otherwise, it is not’ (paragraph 12). It is also stated that ‘The test has to be applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer….’ (paragraph 13).

In Information Commissioner v Miller [2018] UKUT 220 (AAC) at paragraphs 12-16, the Upper Tribunal acknowledged the ‘motivated intruder’ test, which relates to ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’

Again in Miller the UT noted that a similar approach was taken by the Court of Session (Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at paragraph 24:

The adoption of this test was confirmed in Spivack at paragraph 33.

Of course, if it is established that a person has been identified, then the question arises as to whether the information relates to that person.

If the information is personal data then the relevant condition (as referred to in s40(2) FOIA) in this case is found in s40(3A)(a) FOIA:-

Under s40(7) FOIA the relevant data protection principles in this case are to be found in Article 5(1) of the UK GDPR. Materially, Article 5(1)(a) reads: -

Further, by Article 6(1) UK GDPR: -

In this case the Commissioner decided that the requested information was personal data (as defined above). The following basis for this was put forward: -

Next the Commissioner considered Article 5(1)(a) of the UK GDPR which means that the information can only be disclosed if to do so would be lawful, fair and transparent. As to lawfulness, the Commissioner considered the correct approach under Article 6(1)(f) of the UK GDPR (as set out above), as follows:-

The Commissioner approached the case by recognising a legitimate interest for the Appellant in his concern that the house in question is being used as a ‘house in multiple occupation’ (HMO), in the context of alleged anti-social behaviour emanating from the house. The Council provided the Appellant with a definition of an HMO as a house where more than five or more adults who are not related share facilities. This would require registration with the Council as an HMO.

The Commissioner considered that ‘Necessary’ in the second part of the test means ‘more than desirable but less than indispensable or absolute necessity’ (para 38) and applied that to the request. The Commissioner said that that this could also involve consideration of alternative measures which may make disclosure of the requested information unnecessary. However, even though the Council said that it had visited the house ‘and it is not an HMO’, the Commissioner found that ‘in addition to other information available to the complainant, disclosure of the number held by the Council may be necessary in order to pursue a complaint under other procedures (paragraph 41).

In relation to the third part of the test, the Commissioner continued that ‘this must be considered carefully alongside the occupiers’ right to have their information and identity protected. It is appropriate to consider the balancing test in this case’ and that: -

The Commissioner considered that: -

Based on the above factors, the Commissioner determined that there was insufficient legitimate interest to outweigh the data subject’s fundamental rights and freedoms in this case. The Commissioner therefore decided that the Council was entitled to withhold the information under section 40(2) FOIA.

The Appellant’s appeal is dated 26 May 2022. It states as follows: -

The Commissioner’s response to the appeal repeats the findings in the decision notice. In particular the response argues that disclosure of the information would make the identification of the data subjects possible when cross-referenced with other information held by the Council. The Commissioner argues that the fact that the Appellant says he knows the identities of the individuals ‘is in direct contradiction’ to his argument that disclosure will not reveal the identities of any individuals. The Commissioner stands by the application of the three-stage test in the decision notice.

The Tribunal has some difficulty with the reasoning of the Commissioner on a number of issues in this case, but ultimately has reached the same conclusion as the Commissioner as to the application of s40(2) FOIA.

In relation to the question of whether the information sought is personal data, the Commissioner’s case appears to be that once told the number of people living at the property, then the Appellant will be able to scrutinise other records held by the Council and identify the individuals who live at the house: this is the issue addressed in cases such as Spivack and Miller referred to above.

However, in our view this reasoning does not hold up to scrutiny. The information as to the identities of those (or some of those) who live at the house is already available through other records held by and available from the Council, such as the electoral register. The Appellant can already find that information if he so wishes. In our view, knowing the number of people living in the house adds nothing to the information that is available to the Appellant from other sources and does not assist him to identify who lives in the house.

On that basis we reject the Commissioner’s arguments as to why the information sought is ‘personal data’.

However, there is another way in which it can be said that the information sought is personal data. Thus, if the Appellant, say, takes the available information as to identity of an individual that the Council says it holds, who lives in the house and combines that with the number of people who live in the house, then the Appellant will know how many people live in the same premises as that individual.

In our view, that would amount to ‘information relating to an identified or identifiable living individual’ and thus come within the definition of personal data. It seems to us that disclosure as to the numbers of people living in a household of a person who can be identified must be information ‘relating to’ that person and therefore is personal data.

Therefore, we conclude that the information sought is personal data, but for reasons which differ from those put forward by the Commissioner.

Having reached that conclusion, we must also consider the three-stage test considered by the Commissioner and explained in some detail above.

We accept, as did the Commissioner, that the Appellant has a legitimate interest in having the information disclosed. He says he is suffering from anti-social behaviour from a particular house (it is not our role to decide if this is so), and he has concerns that the house should be registered as an HMO. Knowledge of the number of people living there would help him to pursue that issue.

However, in relation to the second part of the three-part test, we do not agree with the Commissioner that disclosure is necessary for the Appellant to pursue those interests. In relation to the necessity test in the Supreme Court case of South Lanarkshire Council v Scottish IC [2013] UKSC 55, Lady Hale said at paragraph 27 that a ‘measure would not be necessary if the legitimate aim could be achieved by something less’. Applying that to the context of this case, if the ‘legitimate aim’ of the Appellant is pursuing issues of anti-social behaviour and whether a house should be listed as an HMO, then there are, in our view, ways that this can be achieved other than by the disclosure of personal information. Indeed, the Commissioner has referred to this in the decision notice (albeit when considering the third part of the test) when at paragraph 47, the decision notice states: -

We agree with this, but applying it to the second part of the test, we reach the conclusion that disclosure is not necessary to meet the Appellant’s legitimate aims. We note that the Appellant has already asked the Council to investigate whether the premises is an HMO (and the Council has reached a decision on this issue), and in his appeal document says that anti-social behaviour has been reported to the police.

Having reached that view, we do not need to go on to consider the third part of the test. However, if we had reached that aspect of our decision-making process we would have agreed with the Commissioner’s finding (as set out above) that, especially in the light of other avenues open to the Appellant, the fundamental rights of the occupants of the house in question would not have been overridden by the Appellant’s need to pursue his legitimate interest.

For the reasons set out above we are satisfied that that the Council was entitled to rely on s40(2) FOIA to withhold the information. Therefore, this appeal is dismissed.