Edward Williams v Information Commissioner

The appeals reference EA/2021/0086 and EA/2021/0110 concern requests for information made to the ICO. The Respondent Information Commissioner is the public authority and the regulator; when referring to her actions as a public authority dealing with the request we will refer to the ICO and when referring to her actions as regulator dealing with the appellant’s complaint we will refer to the Commissioner.

The proceedings were held by video via the Cloud Video Platform. There was no objection to this mode of hearing. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

I apologise to the parties for the time it has taken to reduce this decision to writing for it to be promulgated.

The Tribunal considered agreed open bundles of evidence as follows

In addition we received the following open evidence

Neither party relied on oral evidence from any witness. No witness statements had been served.

The tribunal received and considered a closed bundle in appeal EA/2021/0086. There was no closed session and there is no closed decision from the tribunal.

The appellant has made a number of Freedom of Information Act 2000 [FOIA] requests to the ICO in respect of the data practices of the Driver and Vehicle Licensing Agency (“DVLA”). Before the requests that concern this tribunal he had made a request on 26 September 2019 which included a request for ICO audits of the DVLA. On 5 December 2019 the ICO disclosed a redacted copy of an audit report dated 13 May 2016. Further information was withheld under s40(2) and s31(1)(g) FOIA.

The area of Mr Williams interest, in so far as this series of requests is concerned, is the discretionary power, vested in the Secretary of State for Transport (via the DVLA) to release of by registration and licensing particulars to any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him pursuant to regulation 27(1)(e) of Road Vehicles (Registration and Licensing) Regulations 2002. This may include or lead to the identification of the keeper of a motor vehicle. He is concerned that the DVLA has been responsible for unlawful processing of personal data, as he alleges they have failed to ensure that private entities had “reasonable cause” to be provided with vehicle registration data, in particular in the light of the GDPR.

Mr Williams has made other FOIA requests direct to the DVLA which have led to complaints being made to the Information Commissioner and then appealed to this tribunal and beyond, including in DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) which considered the application of section 31 FOIA to the request Mr Williams had made of the DVLA asking for records relating to the action taken by the DVLA to prevent organisations selling driver details obtained by virtue of the system run by the DVLA, known as the KADOE service, to provide disclosure of the particulars from the DVLA register.

On 12 February 2020, the Appellant emailed the ICO, he asked

“did the audit check to see if the DVLA checks for reasonable cause for wanting data prior to releasing data to private parking companies etc. pursuant to Reg 27.1.e of The Road Vehicles (Registration and Licensing) Regulations 2002?”

This is the request in EA/2021/0110.

On 13 February 2020, the Appellant sent a follow-up email asking as follows - “you sent me the executive summary, how about the full report etc.?”.

The ICO initially refused the request under the exemption provided in section 14(2) FOIA because they said it was a repeated request.

Following an internal review, requested by the appellant, the ICO refused on different grounds. They relied instead on the basis of the exemptions in sections 31(1)(g) and 40 FOIA.

The Appellant made his complaint to the Commissioner and in correspondence during the investigation into the complaint the ICO also relied on s.44 FOIA.

The refusal on the grounds of s.31 FOIA was upheld by the Commissioner in her Decision Notice IC-39673-F2Z8, dated 16 April 2021, which is the subject of appeal EA/2021/0110.

The withheld information in appeal 0110 is the information redacted from the 2016 ICO audit report that had previously been disclosed to Mr Williams.

On 26 April 2020, the Appellant emailed the ICO requesting information as follows

“under the FOIA disclose all correspondence in the last 3 years with the Dept. of Transport/DVLA, regarding the DVLA releasing data under reg 27(1)(e) road vehicles (registration and licensing) regulations 2002 without checking the request for reasonable cause for wanting the data before release.

Disclosure of Information

27 Disclosure of registration and licensing particulars

(1)

The Secretary of State may make any particulars contained in the register available for use--

(e)

by any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him.

I want to change broaden the request to:

“Please disclose all correspondence, internal ICO memos, reports and other communications etc. in the last 3 years with the Dept. of Transport/DVLA, regarding the DVLA releasing keeper data under reg the road vehicles (registration and licensing) regulations 2002.”

IF THIS EXCEEDS COST LIMIT THEN CHANGE 3 YEARS TO 18 MONTHS.”

The ICO refused this request on the basis of the exemption provided in s. 31(1)(g) FOIA. This was upheld by the Commissioner in her Decision Notice IC-45065-D8H5, which is the subject of appeal EA/2021/0086.

The information which the ICO is withholding in appeal 0086 is

The Appellant appealed against the Decision Notice IC-45065-D8H5 on 29 March 2021 (the “0086 Appeal”), and the Decision Notice IC-39673-F2Z8 on 16 April 2021 (the “0110 Appeal) on the grounds that the s. 31(1)(g) exemption was incorrectly applied by the Commissioner in both the Decision Notices.

The Appellant’s arguments in the Appeals may be summarised as follows

The Commissioner submits that s. 31(1)(g) FOIA was correctly applied and also seeks to rely in the 0086 Appeal on s. 42(1) FOIA in respect of some of the information, and in the 0110 Appeal on s. 40(2) FOIA. The Commissioner maintains her position that there would be no real legitimate public interest in the withheld names of DVLA staff members, and therefore disclosure would be unlawful and also unfair.

Section 1 FOIA sets out the duty on a public authority to communicate information requested of it as follows

“(1)

Any person making a request for information to a public authority is entitled—

(a)

to be informed in writing by the public authority whether it holds

information of the description specified in the request, and

(b)

if that is the case, to have that information communicated to him.”

It is to be noted that disclosure made pursuant to s1 FOIA is regarded as made to the world at large and not simply to the requestor.

However, the duty in section 1 does not apply to “exempt information” by virtue of section 2:

“(2)

In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

(a)

the information is exempt information by virtue of a provision conferring absolute exemption, or

(b)

in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

Section 31(1)(g) FOIA provides, so far as relevant, that:

The test for prejudice is set out in the case of Hogan v Information Commissioner [2011] 1 Info LR 588 at [29]-[30], [34]-[35] and was approved by the Court of Appeal in DWP v Information Commissioner [2017] 1 WLR 1 at [27]). The test involves the following three steps

The Information Commissioner’s regulatory functions are contained in Articles 57 and 58 of the GDPR (now in the UKGDPR), given effect in the UK via section 115 of

Section 40 FOIA provides, so far as relevant:

Therefore, where the requested information is not the personal data of the applicant, the information may only be disclosed where disclosure would not contravene the data protection principles. Personal data is defined in section 3 of the DPA 2018 as

Article 5(1)(a) GDPR, provides that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”. In the context of an FOIA request, processing occurs when the personal data are disclosed in response to a request.

Article 6(1) GDPR provides the requirements for lawful processing. The most applicable lawful basis is that in Article 6(1)(f) GDPR, which states that data may be lawfully processed where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Section 42 FOIA provides, so far as relevant:

The High Court has stated at [2009] EWHC 164 (QB) at [47]-[48], that there is a “strong public interest in non-disclosure in-built into legal professional privilege” which must be given “significant weight”.

FOIA exemptions must be assessed according to the circumstances at the time of the response to the Request: R (Evans) v Attorney General [2015] UKSC 21, [2015] A.C. 1787 and All Party Parliamentary Group on Extraordinary Rendition (APPGER) v Information Commissioner and Foreign & Commonwealth Office [2015] UKUT 377 (AAC), followed in Maurizi v Information Commissionerand others [2019] UKUT 262 (AAC) at [184].

The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:

“If on an appeal under section 57 the Tribunal considers -

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.

On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.”

As to the facts there was no witness evidence from either party. We have read and considered all of the material placed before us. We were provided with a bundle of authorities and further guidance. We refer in this decision only to those parts of the evidence and bundles that are necessary to our decision making. We have taken a similar approach to the submissions made. Just because a document, or submission is not referred to specifically in this decision does not mean it has not been considered.

Mr Williams submitted

On behalf of the Commissioner it was submitted

Mr Williams submitted in reply that

The principles to be applied by the tribunal were not in dispute. The parties disagreed on how those principles were properly applied to this case. The focus was on the engagement of the qualified exemption in s31 FOIA and application of the public interest balancing test [“PIBT”].

There was no dispute that personal data should not be disclosed. Thus, information that has been identified as personal data within the withheld material in both appeals should not be disclosed.

All public authorities subject to FOIA must respond to requests for information with reference to the authority’s specific circumstances, role and responsibilities. ICO guidance may assist in understanding how to apply the law in the circumstances but is not binding, the Upper Tribunal and higher courts’ decisions will clarify the meaning of the law and the factors to take into account but each decision about how to respond to a request made under FOIA will be unique to that public authority in the light of that guidance and binding authority. Thus, the question of whether s31 FOIA is engaged in relation to the same information will necessitate the consideration of different circumstances dependant on the public authority to whom the request has been made. The respondent is correct to point out that the decisions of DVLA and the ICO about Mr Williams’ requests for information have been made according to the differing circumstances and the exemptions applicable to them as a public authority. FOIA may require one public authority to disclose that which another may not.

We then turn to consider the material withheld in appeal 0110; the material redacted from the audit report when it was previously disclosed to Mr Williams. We have considered the unredacted version of the withheld material provided to us in the CLOSED material. We would observe, without trespassing on the withheld content of the report, that the vast majority of the audit report was already disclosed to the appellant and it is only a small proportion of the redacted information that is now withheld due to being personal data, we shall term this the “remainder” of the withheld information. Moreover that remainder does not affect the sense or reasons for the conclusions therein which he has seen.

Having considered the three step test, as to that remainder of withheld information in appeal 0110 we are satisfied that the exemption in s31 is engaged. We have concluded that disclosure of the “remainder” of the withheld information would be likely to lead to prejudice to the exercise by the ICO of its functions for the purpose of ascertaining whether any person has failed to comply with the law, or is responsible for any conduct which is improper. An audit performed by the regulator upon an organisation that it regulates falls squarely within the parameters of s 31(2)(a) and (c), the conduct of the entity being audited is being scrutinised in order to determine whether they have complied with the law and/or they are responsible for improper conduct and we can see no arguable basis on which it can be suggested otherwise.

There is a clear causal relationship between disclosure and prejudice in these circumstances. We have decided that the prejudice to the interests of the ICO would be significant. Disclosure would make public authorities less willing to comply with audits and this would have an adverse effect on the ICO’s ability to perform its regulatory function which relies on a regulator’s ability to engage effectively with those it regulates in a constructive and collaborative way. If those who the ICO regulate are concerned that the information they provide will be made public prematurely or inappropriately they will be more reluctant to provide information. Disclosure of the information would be likely to have the effect of fewer data controllers agreeing to such audits or in voluntarily providing relevant information. These are real and not hypothetical risks.

In this case we have concluded that the public interest factors in disclosing the information are as follows

The factors in favour of maintaining the exemption and withholding the information are as follows

We have concluded having considered all of the evidence and submissions that the public interest in maintaining the exemption as regards the remainder of the information in appeal 0110 outweighs the public interest in disclosing it.

Turning to appeal 0086, the heart of the dispute in that appeal, is about the legal advice that forms part of the withheld material in this case.

An investigation to ascertain whether a data controller is in breach of the GDPR should not be rushed. The serious potential consequences for a data controller of an adverse conclusion means that any regulator should ensure that their investigation is thorough albeit it should not be allowed to drift. We recognise that such investigations will include not only the investigation into the facts but also a consideration of the appropriate regulatory response. In this case the investigation in issue was complicated by a new statute, DPA18 and the GDPR. These were significant changes in the law and in our view it is right for the ICO, as regulator, in these circumstances to have taken time to consider whether any view they previously held remained valid in the context of the new legislative framework which included new regulatory enforcement tools.

In submissions we noted that Mr Williams expressed his views of what should have been done, or how the ICO should have approached an issue. The ICO is the regulator tasked by Parliament to perform the functions given by statute. Whether they could have or should have undertaken those functions differently or more swiftly is not a question for us in this appeal. We find that the ICO investigation was still ongoing at the time of their response to the request; we draw that conclusion from all the documents we have seen.

We have considered whether the letters produced by Mr Williams assist us in our decision making. Theses are the documents he obtained from the DVLA. Mr Williams’ submission that the correspondence demonstrates that there have been a “number of casework complaints” made to the ICO as to the lawful basis on which data is being processed by the DVLA, is a correct interpretation of the ICO letter (undated but clearly from June 2019), addressed to the Head of Data Protection Policy at the DVLA. The letter says so in the third paragraph of page 2 but that letter goes on to make clear that those complaints had not yet been investigated. The response to the ICO is a detailed explanation of the DVLA position.

Mr Williams may not agree with that position but these pieces of correspondence do not permit an inference that millions of data subjects have had their data unlawfully processed. He is quite right that such a situation would be a cause for concern but it is not for us to determine whether or not such unlawful processing is or was happening. The letters show that in the middle of 2019 the investigation was not concluded and indeed the complaints received had not been considered by the ICO. This is consistent with our reading of the documents and conclusion that the investigation was ongoing at the time of the request.

The letters were obtained as a result of a FOIA request to the DVLA but as we have pointed out in this decision, FOIA must be applied to each request by each public authority. The release by the DVLA says nothing about factors to be considered in this case or the interests of the ICO as they arise under s31. The fact that Mr Williams has obtained them is irrelevant to our decision making.

We agree with the Commissioner that receipt of legal advice does not mean an investigation is complete. Legal advice may be taken at other stages of an inquiry; a regulator would be wise to do so where the law is complex, in transition, and to take account of developments in their investigation.

Having considered the withheld material in 0086 and all the submissions in that regard and applied the three step test, we have concluded that the exemption in s31 is engaged. Disclosure of the withheld information would be likely to lead to prejudice to the exercise by the ICO of its functions for the purpose of ascertaining whether any person has failed to comply with the law, or is responsible for any conduct which is improper. The prejudice caused would be directly related to the disclosure. It would be likely to prejudice future ICO investigations and that prejudice would be significant as data controllers would be less likely to comply if they thought there would be disclosure of information before the completion of the investigation. In response to the Tribunal’s question as to why voluntary compliance mattered given that the Information Commissioner has enforcement powers, the response to the question identified that

In this appeal the public interest factors in favour of disclosing the information are as follows

The public interest factors in maintaining the exemption are as follows

Having considered all of these factors we have taken the decision that in appeal 0086, the public interest in maintaining the exemption (ie withholding the information) outweighs the public interest in disclosing it, and the information is exempt from disclosure under s31(1)(g) FOIA.

Furthermore, although in the light of our decision above, we need not go on to decide any other matters such as the engagement of other exemptions, but we would observe that in this case it is clear to us that s. 42(1) FOIA is engaged in respect of some of the withheld information and there are no compelling reasons to override the inherently strong public interest in maintaining the exemption from disclosure of legally privileged material. The public interest in the maintenance of the exemption outweighs the public interest in transparency.

For the reasons set out above we dismiss both these appeals.