Ian Driver v The Information Commissioner

This appeal concerns the following request made on by Mr Driver on 4 February 2020:

On 26 February 2020 the Council responded to the request and refused to confirm or deny whether it held the requested information relying on s 40(5B)(a)(i) FOIA. It upheld the position on internal review on 26 January 2021. Mr Driver referred the matter to the Commissioner on 20 April 2021.

In a decision notice dated 9 June 2022 the Commissioner decided the information requested, if held, was personal data. The Commissioner accepted that if the requested information was held, it would constitute criminal offence data in that it related to potential investigations of the commission of the criminal offence of fly tipping.

Criminal offence data can only be processed, which includes confirming or denying whether information is held, if one of the conditions of Schedule 1, Parts 1 to 3 of the Data Protection Act 2018 (DPA 2018) can be met. The Commissioner considered it likely that only two of the Schedule 1, Part 3, conditions might ever justify such processing of personal information of this type. These are:

The Commissioner was satisfied from the information provided by the Council that none of the conditions required for the processing of criminal offences data have been satisfied. Providing a confirmation or denial would breach data principle (a). The Council was therefore entitled to refuse to confirm or deny whether it held the requested information under s 40(5B)(a) FOIA.

The grounds of appeal are:

The appellant does not identify a basis under article 6(1) GDPR under which the council could lawfully confirm or deny whether it holds criminal offence data within the scope of his request. The only arguable basis is article 6(1)(f) i.e. that the processing is necessary for the legitimate interests of the public. The appellant would have to show that the interest in transparency and his own interests in receiving confirmation or denial were not overridden by the interests of fundamental rights and freedoms of the data subject. The appellant would also have to show that one of the conditions under Schedule 1 were met.

Paragraph 11(1) DPA 2018 (protecting the public against dishonesty etc.) requires that the processing be ‘necessary for the exercise of a protective function’ as defined by para 11(2). The Commissioner submits that FOIA is not in itself a ‘protective function’ intended to protect members of the public against any of the grounds in para 11(2).

The duty to confirm or deny in response to a FOIA request does not in itself make a disclosure lawful. Section 40(5B)(a)(i) FOIA is engaged where ‘the confirmation or denial…would (apart from this Act) contravene any of the data protection principles.’ The test is whether confirmation or denial ‘otherwise than under’ these laws would contravene a data protection principle.

Para 13(3) is not met in the appellant’s case. Were the Council to provide confirmation or denial they would be doing so for the purpose of responding to a FOIA request, not for the purposes of journalism. Nor is the Council obliged to hold a belief that confirming or denying whether the requested criminal offence data is held would be in the public interest as required under para 13(1)(e).

Even if the Council were somehow obliged by virtue of article 10 ECHR to facilitate the disclosure of information in the public interest, the appellant would still have to show that disclosure was necessary for reasons of substantial public interest. The appellant has failed to demonstrate the concrete, wider benefits of potential disclosure of the information in question.

The Commissioner submits that para 36 of Schedule 1 cannot be relied upon as a condition for processing criminal offence data. Even though the appellant is not required to show a substantial public interest, para 13 also requires the controller to reasonably believe that the processing is necessary in the public interest.

Although the Council have no legal basis to confirm or deny whether the requested information is held and the exemption in section 40(5B)(a) FOIA applies, that does not prevent the Council from disclosing the requested information if it is satisfied that it has complied with its obligations under DPA 2018 i.e. that the criteria in para 13 are met, it can legitimately, as a data controller, make a voluntary disclosure to a journalist without breaching DPA 2018. Alternatively the Council could disclose the requested information to a journalist on a discretionary basis outside of FOIA with conditions attached. The appellant’s reliance on article 10 ECHR does not assist him.

If the tribunal were to consider disclosure to be lawful it would still be necessary to consider if it would be fair and transparent.

Both parties agree that the requested data, if held, is criminal offence data.

Mr. Driver argues that the requested information can be lawfully processed without the need to secure the consent of the data subject and without the data subject having made the requested data public.

Mr. Driver relies on article 6(1)(f) GDPR.

Part 2, Schedule 1 DPA 2018 lists all the substantial public interest conditions which provide for the lawful processing of special category and criminal offence data. Mr. Driver relies on:

Part 3, Schedule 1 DPA 2018 para 36 makes the processing of criminal offence data less stringent than the processing of special category data, by disapplying any requirement in a part 2 Schedule 1 condition that processing is necessary for reasons of substantial public interest.

A public interest which overrides the data subject’s right to privacy must still be established via a balancing act.

Preventing or detecting unlawful acts

is necessary for the purposes of the prevention or detection of an unlawful act,

must be carried out without the consent of the data subject so as not to prejudice those purposes, and

If held by the Council, the processing of the requested data is necessary because it will reveal that Councillor X engaged in an unlawful criminal act which was contrary to paragraph 34 (Duty of care etc. as respects waste) of the Environmental Protection Act 1990.

The Council is the competent body for investigating and sanctioning those who breach the Environment Act 1990.

The Council, as the competent authority, holds records of the actions it has taken to enforce the Environment Act 1990. As the only organisation holding such records it is therefore necessary for the Council to process such data should it receive a legitimate data request.

With no alternative sources available to secure the requested data the processing will also be proportionate.

Processing is also necessary because there is a powerful, if not substantial, public interest in the conduct and behaviour of elected politicians.

The requested data, if it is held and disclosed, would likely reveal that Councillor X did commit a criminal act for which X was formally cautioned. The request therefore falls within the dictionary definition of “detecting”.

If the requested data was to be disclosed, and if it establishes that Councillor X did act unlawfully, Mr. Driver intends to submit the data to the appropriate competent authorities (Kent County Council (KCC) and the Council) as a standards complaint under the terms of the Localism Act 2011. This action would engage the processing condition set out in paragraph 10.2 in that the processing is carried out in preparation for disclosure to a competent authority.

Protecting the public against dishonesty etc

must be carried out without the consent of the data subject so as not to prejudice the exercise of that function, and

dishonesty, malpractice or other seriously improper conduct,

unfitness or incompetence,

mismanagement in the administration of a body or association, or

failures in services provided by a body or association

If the requested data is disclosed and confirms that Councillor X committed an unlawful act and if Mr. Driver published articles about X’s unlawful acts this would amount to a protective act as:

Mr. Driver will have exercised a protective function which will have alerted voters to the dishonesty, malpractice or other seriously improper conduct of Councillor X. It is necessary, if the data is held, for the Council to process it in order that Mr. Driver can play a protective role. The Council is the only body holding the requested information.

The public interest in having a healthy democratic system which includes accountable, transparent and honest elected politicians is strong if not substantial.

The local authority standards committee is a regulator established by statute in order to oversee the behaviour of local authority councillors and to ensure that this behaviour complies with the local code of conduct and the Nolan principles. Mr. Driver intends to submit the data to the appropriate local authority standards committee for investigation. If the requested data exists it meets the processing condition set out in para 11(1) by assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has committed an unlawful act, or been involved in dishonesty, malpractice or other seriously improper conduct.

There is strong, if not substantial, general public interest in having effective political regulators in place to ensure that the behaviour of elected representatives is of the highest order. This public interest supports the efforts of journalists who work to uncover information which establishes wrongdoing by elected politicians and then passing on this information to the appropriate regulator. In this case the public interest in, and necessity for, processing the data is considerably enhanced because the allegations against Councillor X, if true, amount to extremely serious breaches of the TDC and KCC’s Members’ (councillors) Codes of Conduct.

If the withheld data proves the allegations against Councillor X to be true, there is a compelling necessity for, and public interest in, the processing of the requested data in order that the regulators can investigate and act.

Mr. Driver is a journalist. It was, and remains, his intention to use the requested information, should it exist, and be disclosed to him, to publish another article about Councillor X which will hopefully provide officially corroboration of his earlier publications and allow Mr. Driver to provide a much fuller picture than previously.

The request complies with the requirements of para 13(1)(a), (1)(b) and (1)(d) DPA 2018.

It is clear that the request under this processing condition was necessary and proportionate as there is a strong public interest in disclosing misconduct and unlawful actions by an elected politician and in this case, if the allegations against Councillor X are true, the Council is the only organisation to hold the official corroborative information, required to support truthful, evidence based, journalism.

Fairness of processing is determined by considering:-

The Council in its responses to the FOI request and internal review does not mention Councillor X’s expectation of confidentiality.

Bloomberg LP v ZXC [2022] UKSC 5 states that a person under criminal investigation has prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation. According to Mr. Driver’s tip off Councillor X admitted under caution that they had breached their legally required duty of care and were issued with a formal caution/warning that any further offences would be prosecuted and to pay around £750 as a fine. If this is true there was no possibility of Councillor X being subject to further investigations or being charged in relation to this offence.

Public figures, especially politicians, must have lower expectations of privacy/confidentiality than the ordinary citizen (Couderc and Hachette Filipacchi Associés v. France [2015] ECHR 992).

The ICO publication ‘Request for personal data about public authority employees’ provides further important guidance in relation to the confidentiality/privacy expectations of public authority employees which applies equally to local authority Councillors. ‘Seniority’ and ‘public facing roles’ are two factors related to a data subject’s expectations of privacy/confidentiality.

At the time of my FOI request Councillor X occupied a very senior, public facing, political position in which they were involved in policy making and speaking on the behalf of the council. On this basis Councillor X could not reasonably expect to have a high expectation of privacy/confidentiality

Furthermore, the fact that Councillor X was involved in publicly representing the views of the Council on matters relating to fly-tipping law and regulations, when Councillor X themselves is alleged to have breached the same law and regulations will, if true, serve to reduce still further Councillor X’s expectation of privacy/confidentiality.

The articles written by Mr. Driver, which he is sure Councillor X would have been aware of would, in his opinion, persuade a reasonable person to believe that if the allegations were true, then by exercising my FOI rights, he might eventually obtain copies of documents which incriminate Councillor X. Such a possibility would serve to significantly reduce Councillor X’s expectation of confidentiality/ privacy related to this matter.

The findings in DH v (1) Information Commissioner, (2) Bolton Council [2016] UKUT 0139 (AAC) that it was not reasonable for a councillor to expect not to be identified where he is summoned for non-payment of council tax apply equally to a councillor who has not complied with the Environment Act duty of care requirement.

The disclosure of the data is likely to cause some reputational damage to Councillor X and may result in Councillor X being forced out of politics by voters and/or their party colleagues. This could be the cause of great embarrassment and distress to Councillor X and may result in loss of personal friendships and damaged relations with political colleagues. If Councillor X is forced to leave politics Councillor X will lose financial benefits. Although Councillor X and party colleagues were almost certainly aware of the two articles, Councillor X does not appear to have suffered any detrimental political consequences. There is no evidence from Councillor X about the future impact of disclosure.

Mr. Driver submits that the factors favouring processing of the data far outweigh Councillor X’s expectation of and right to confidentiality/privacy.

The growing cost and incidences of fly-tipping in the Thanet area add to the weight of the general public interest in this matter. This local factor has been substantially added to the by the possibility that a very senior, public facing councillor, who:-

There is also a distinct possibility, as is suggested by the tip-off and Mr. Driver’s two articles that this matter may have been deliberately covered up by the Council.

If the allegations are true then TDC, the enforcer of the Environmental Protection Act 1990, would have been under a legal duty to report Councillor X to the council’s Standards Committee for breaching the councillors’ code of conduct. If the requested data serves to establish that the council may have concealed data related to Councillor X’s alleged misconduct or unlawful actions then in doing so those council officers responsible would have breached their statutory duty. This would add further weight to the public interest in the processing of the data.

The Council’s concealment of any unlawful acts which had it had investigated and penalised would be contrary to the principle of open justice.

Paragraph 92 of the ECHR Guide on Article 8 of the European Convention of Human Rights (2022) states:

Linked to this is a restriction based upon the principles that confidentiality cannot protect inequity, as explained in the ICO guidance on section 41.

The Council publishes on its internet site a Privacy Notice for Information Governance which sets out the circumstances in which it may process the personal data it holds. This includes the possibility that personal data, including special category and criminal offence data, may be processed by the council in response to FOI or EIR requests.

Mr. Driver must show that the processing in question, i.e. to confirm or deny whether the Council held any data within the scope of the request, would not contravene any of the data protection principles. In particular, Mr Driver must show that the processing would be lawful, fair and transparent.

In relation to lawfulness Mr. Driver relies on article 6(1)(f) that the processing is necessary for the legitimate interests pursued by the controller or by a third party. The burden is on Mr. Driver to show that such interests were not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Mr. Driver does not address this.

In any event, Mr. Driver has to show that one of the conditions under Schedule 1 were met.

Note: the Commissioner conceded in oral argument that Mr. Driver was correct to submit that paragraph 36 of Schedule 1 disapplies the requirement for a substantial public interest, and therefore we have omitted those arguments from the summary of the skeleton argument.

There is nothing to show that processing data to require the Council to confirm or deny whether it holds data within the scope of this request is necessary for the prevention or detection of an unlawful act. The information, if held, is criminal offence data relating to an investigation. This is putting the cart before the horse.

The definition of ‘protective function’ is broad, but not so broad as to encompass the actions of private individuals. The term ‘function’ must be read in the light of its use elsewhere in Schedule 1 and the GDPR: ‘function’ refers not simply to any activity undertaken by an individual but ‘ a duty attached to a role or an office; an official duty’. If Mr. Driver’s role in publishing articles about potential or suspected wrongdoing were within the scope of ‘protective function’ there would be no need for a separate condition pertaining to journalism.

Further it is unclear how Mr. Driver’s activity is intended to ‘protect’ members of the public from future acts of dishonesty. The disclosure is concerned with promoting accountability for past actions. To the extent that future actions might be prevented, disclosure is not ‘necessary’.

Mr. Driver does not show why disclosure is necessary in order for the Council itself to undertake an investigation of any alleged wrongdoing.

There is no obligation on the Council to hold a belief that confirming or denying whether the requested criminal offence data is held, would be in the public interest as required under para 13(1)(e).

It is clear from the decision of the Supreme Court in Kennedy v Charity Commission [2015] AC 455 that article 10 does not confer a right to access to state-held information. Whatever the merits of the approach in Maygar Helsinki Bizotttsag v Hungary [2016] ECHR 975, the lower courts are bound to follow the Supreme Court’s decision until such time as the Supreme Court reconsiders its position.

We took account of an open and a closed bundle, plus a small number of additional closed documents.

As this is a ‘neither confirm nor deny’ appeal, very little of the closed session can be revealed without defeating the point of the appeal. The gist provided to Mr. Driver was as follows:

“The Commissioner made further submissions in closed concerning the Commissioner’s investigation of the complaint and the Councils consideration of its obligations under DPA 2018 and the GDPR.”

At the relevant time the GDPR, rather than the UK GDPR, was in force.

The relevant parts of s 40 of FOIA (in force at the relevant time) provide:

Processing includes ‘disclosure by transmission, dissemination or otherwise making available’ (section 3(4)(d) DPA).

Section 40(5B) relates to an absolute exemption (section 40(3A)(a)) and the public interest balance accordingly does not apply.

Personal data is defined in s 3 of the Data Protection Act 2018 (DPA):

The definition of "personal data" consists of two limbs:

The data protection principles are set out Article 5(1) GDPR. The first principle provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UK GDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.

The most relevant basis here is article 6(1)(f):

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:

Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:

Article 10 GDPR provides:

Section 11(2) DPA provides:

Section 10(5) DPA provides:

Schedule 1, Part 3, Paragraph 36 DPA provides:

Schedule 1, Part 2, Paragraph 10 DPA provides:

Schedule 1, Part 2, Paragraph 11 DPA provides:

Schedule 1, Part 2, Paragraph 12 DPA provides:

Schedule 1, Part 2, Paragraph 13 DPA provides:

Article 10 of the European Convention on Human Rights provides:

In Maygar Helsinki Bizottsag v Hungary [GC] 18030/11 8 November 2016, the European Court of Human Rights recognised that Article 10(1) might, under certain conditions, include a right of access to information, including in circumstances where access to the information is instrumental for the individual’s exercise of his or her right to freedom of expression, in particular “the freedom to receive and impart information” and where its denial constitutes an interference with that right.

Like the Upper Tribunal in Moss v Information Commissioner and the Cabinet Office [2020] UKUT 242 (AAC) (‘Moss’)(at paragraph 59) we consider ourselves bound by the rules of precedent to follow the view of five members of the Supreme Court in Kennedy v Charity Commission (Secretary of State for Justice and others intervening) [2014] UKSC 20, as well as the Court of Appeal in Kennedy and two if not three members of the Supreme Court in BBC v Sugar (No.2) [2012] UKSC 4 that domestic law does not consider Article 10(1) extends to include a right of access to information. We are also bound by the Upper Tribunal decision in Moss.

The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Can the tribunal apply the case of Maygar Helsinki Bizotttsag v Hungary [2016] ECHR 975, and, if so, what is the impact of the right to access information under article 10 ECHR?

Would confirming or denying that the requested information was held constitute the disclosure of a third party’s personal data relating to criminal convictions and offences?

Would confirming or denying that the requested information was held meet the requirement in Article 10 of the GDPR for authorisation by the law in that it meets one of the following conditions in Part 2 of Schedule 1 DPA:

Is the appellant pursuing a legitimate interest or interests?

Is the confirmation or denial necessary for the purposes of those interests?

Are the legitimate interests overridden by the interests or fundamental rights and freedoms of the data subject?

Would confirming or denying that the requested information was held be fair?

The parties primarily reiterated the points made in the pleadings and written submissions.

In relation to article 6(1)(f) Mr. Driver argued that his legitimate interest lay in the fact that as a local journalist he wished to publish an article which, if the data is held, would reveal misconduct and unlawful activity by a senior politician, in an area of powerful national and local interest, with environmental and health consequences, where that politician has spoken out against such unlawful activities and voted in favour of introducing stricter legislation. Confirmation or denial is necessary and proportionate because, if the information exists, the only organisation who holds it is the Council.

Mr. Driver accepts that the Councillor would face quite serious reputational damage, might lose their political position, and could be caused some fairly serious harm and distress. Mr. Driver submits that harm and distress cannot be relied upon where it is a foreseeable consequence of one’s own actions by the commission of a criminal offence or other misconduct.

Mr. Metcalfe did not make oral submissions on article 6(1)(f) on the basis that it was not necessary to do so, in keeping with the Decision Notice.

The parties agreed that the requirement to demonstrate substantial public interest is disapplied for criminal offence data.

Mr. Driver argued that if the Council were to confirm or deny that it held the data, this would be an act of detection because confirmation would reveal or expose an unlawful act. Whilst action may have been taken by the Council it has not been made public. Detecting and exposing unlawful acts plays an important role in the future prevention of unlawful acts, acting as a deterrent and leading to greater scrutiny and review of processes which aim to reduce and prevent similar acts in the future.

Mr. Metcalfe submitted that confirmation or denial is not necessary to prevent or detect an unlawful act. If the information is held, then any offence in question has already been detected and cannot be prevented. The fact that disclosure might have a deterrent effect does not mean confirmation or denial is necessary to prevent a future unlawful act. It has not been shown that confirmation or denial must be carried out without the consent of the data subject so as not to prejudice the purposes of detecting or preventing an unlawful act.

Mr. Driver argues that individuals, and not just the state, can and do regularly act to protect other people from dishonesty and improper conduct. An individual has the right to make a citizen’s arrest. Journalists are recognised as acting as a ‘public watchdog’ protecting the public from a wide variety of harms including dishonesty and misconduct.

Restricting the public protection role to the state is too narrow an interpretation of paragraph 11. This would mean that an area of the state that was corrupt and wished to cover up dishonesty or wrongdoing would not be able to be challenged by private individuals or the media. The references to the use of ‘function’ in other parts of the legislation are tenuous - if paragraph 11 had been intended to exclude the private citizen it would have said so.

Mr. Driver argues that disclosure of a past event will play a role in preventing future similar events.

Mr. Metcalfe argues that the definition of ‘public function’ is not so broad as to encompass the actions of private individuals, and that it has to be read in the light of how the term is used elsewhere in Schedule 1 and the GDPR. It is an official function conferred, not necessarily by statute, on a public body for the protection of the public. If there is any issue about the conduct of the Council it can be brought to the Ombudsman and confirmation or denial is not necessary to pursue that complaint.

Mr. Driver argues that it has been suggested to him that the data, if held, is in effect being ‘covered up’ and has not, as it should have been, referred to the standards committee to take the appropriate action. There is only one way to ensure that this is dealt with and that is by way of confirming or denying that the information is held.

Mr. Metcalfe submits that it is simply not necessary to confirm or deny in order for the Council to undertake an investigation. There is no situation in which confirming or denying assists the Council or any external body to undertake and investigation.

Mr Metcalfe submits that the requirement that the Council reasonably holds the belief that publication of the personal data would be in the public interest is fatal to Mr. Driver’s appeal, because there is no indication that the Council holds any such belief.

Mr. Metcalfe argues that this requirement reflects the particular unusual and specific treatment given to criminal offence data in UK law, giving the authority processing the data the right to determine for itself by reference to its own reasonable belief that the publication of the personal data would be in the public interest. In the event of a body deliberately covering up wrongdoing, this requirement would not prevent the investigative functions of external supervisory bodies, giving other avenues for people who wish to challenge a body’s refusal to disclose.

Mr. Driver submitted that the reasonable belief of the authority could be challenged. In not processing the information the authority is not taking a reasonable position and has not taken account of all the public interest factors highlighted by Mr. Driver.

In the light of the binding authority set out under ‘Legal Framework’ above, Mr. Driver’s arguments based on article 10 and Maygar do not assist him. Domestic law does not consider Article 10(1) extends to include a right of access to information.

It is accepted that the requested information, if held, would be personal data relating to criminal convictions and offences. Given the terms of the request, including the fact that the Councillor is named in the request, if the authority were to confirm that the requested information was held this would disclose a third party’s personal data relating to criminal convictions and offences.

Mr. Driver does not assert that the conditions of consent (paragraph 29) or data in the public domain (paragraph 32) are present. There is no evidence before us that could support a conclusion that either of those conditions is satisfied.

It was agreed between the parties that there are no requirements of substantial public interest where the data is criminal offence data, as a result of paragraph 36 of Schedule 1 DPA.

We conclude that confirmation or denial is not necessary for the purposes of the prevention or detection of an unlawful act. First, we accept that if the authority holds the information, the unlawful act in question has already been ‘detected’. We do not accept that the making public of either that act or of any action that was taken as a result of that act forms part of the detection of that unlawful act. This is wider than the natural meaning of ‘detection of an unlawful act’.

The use of the singular – ‘prevention or detection of an unlawful act’ rather than ‘prevention or detection of unlawful acts’ – suggests to us that the section refers to a particular unlawful act, rather than unlawful acts in general. This interpretation is supported by the requirement, in paragraph 10(1)(b), that the processing ‘must be carried out with the consent of the data subject so as to not prejudice those purposes’. That paragraph makes sense if a particular unlawful act is being prevented or detected. If that is so, Mr. Driver’s submissions about the general deterrent effect in relation to future acts would not fall under paragraph 10.

In any event, although we accept that the making public of such an act might act as a deterrent for future similar acts, or might lead to other changes that might reduce the risk of similar acts taking place in the future, we do not accept that this means that confirmation or denial is reasonably necessary for the prevention of future unlawful acts.

Further, we do not accept that it has been shown that confirmation or denial must be carried out without the consent of the data subject in order not to prejudice the purposes of prevention or detection of an unlawful act.

For those reasons paragraph 10 does not apply.

We are not persuaded that Mr Driver is exercising ‘a function’ intended to protect members of the public against dishonesty etc. We accept Mr. Metcalfe’s submission that, in this context, the use of the word ‘function’ entails some duty attached to a role or an office or an official duty. In our view it is intended to refer to bodies exercising a protective function that has been conferred on them, by statute or otherwise. This is supported by other uses of the word ‘function’ within the DPA.

Although we accept that Mr. Driver’s purpose as journalist is, at least in part, to protect members of the public against dishonesty, we do not accept that he is exercising such a ‘function’. In our view, this is an artificially wide interpretation of that word. We do not accept that the IPSO editor’s code confers on Mr. Driver, as a journalist, a protective function.

In addition, we do not accept that it has been shown that confirmation or denial must be carried out without the consent of the data subject in order not to prejudice the exercising of that function.

For those reasons paragraph 11 does not apply.

Even assuming that the Council holds this information and is engaging in a ‘cover up’, we do not accept that confirmation or denial is reasonably necessary for the purposes of assisting the Council to comply with a regulatory requirement.

We accept that there may be a relevant ‘regulatory requirement’ imposed on the Council or its standards committee, but we do not accept that it is reasonably necessary for the Council to confirm or deny to the world whether it holds this information in order to assist itself or its standards committee, or in order for Mr. Driver to assist it or its standards committee, to comply with that requirement. Even assuming Mr. Driver is correct in asserting that there has been a cover up and that the Council is reluctant to act, we do not accept that confirmation or denial would assist the Council to comply with a regulatory requirement. The Council or its standards committee could take action without public confirmation or denial. If Mr. Driver’s ‘tip off’ suggests that the Council has improperly failed to take action, this could be referred to, for example, the Ombudsman.

For those reasons paragraph 12 does not apply.

We accept that confirmation or denial consists of the disclosure of personal data for the purposes of journalism, and that it is carried out in connection with the alleged commission of any unlawful act by a person (and other matters falling within paragraph 13(2) and with a view to the publication of the personal data.

One of the requirements of paragraph 13 is that the controller reasonably believes that publication of the personal data is in the public interest. This necessarily contains two elements: (i) that the Council believes that publication is in the public interest and (ii) that that belief is reasonable.

There is no evidence or even any indication before us upon which we could infer or base a conclusion that the Council believes that publication of the personal data, if it exists, is in the public interest. The condition cannot be satisfied without that belief.

Mr. Driver asks us to consider whether or not it would be reasonable for the Council to conclude that it is not in the public interest to publish. That is not the question that we are required to answer.

Although it appears unsatisfactory that a public body has the right to determine for itself, by reference to its own reasonable belief, that the publication of personal data would or would not be in the public interest, we accept that this arises from the peculiar treatment of criminal offence data. Further we accept Mr. Metcalfe’s point that a body deliberately covering up wrongdoing is not left immune to challenge. The data protection regime would not prevent or hinder the investigative functions of external supervisory bodies, giving other avenues for people who wish to challenge a body’s refusal to disclose.

For that reason, paragraph 13 does not apply.

As none of the conditions in the Schedule are satisfied, confirmation or denial would breach the first data protection principle and section 40(5B) applies. We do not need to go on to consider article 6(1)(f). This was the conclusion reached by the Commissioner, albeit that he did not consider the same conditions, and for those reasons we agree that he reached the right conclusion.

A closed annex has been provided. In the annex we deal with a particular issue raised by the Commissioner in closed which ultimately has had no bearing on our decision, but was, for reasons explained in the closed annex, appropriate to record. We are unable to provide a gist of the closed annex without revealing whether or not the information is held by the Council and therefore defeating the purpose of the proceedings.