Jeffery Leeks v The Information Commissioner & Anor

Any person making a request for information to a public authority is entitled —

It constitutes personal data which does not fall within subsection (1), and:

Either the first or second condition below is satisfied.

would contravene any of the data protection principles, or

would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

on a request under Article 15(1) of the [UK GDPR]4 (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

'Personal data' means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

'Identifiable living individual' means a living individual who can be identified, directly or indirectly, in particular by reference to—

The Commissioner inferred the Appellant’s s50 complaint to the Commissioner focused on his dissatisfaction with FOS’s refusal to provide the requested information to the 26 August 2021 request of “how many people in your team identified on application as gay” and not the 9 September 2021 request as this was answered in full. The scope of the DN (and this appeal) is regarding the 26 August 2021 request only. The DN upheld that FOS has correctly relied upon s40(2) FOIA to withhold the number of employees in a team identifying as gay. The Commissioner submitted that the appeal be dismissed for the reasons outlined in the DN.

In summation, the Commissioner stated, as there is no lawful basis for the information to be disclosed, disclosure will therefore be unlawful. As the first data protection principle requires all personal data to be processed lawfully, disclosure under FOIA would thus breach one of the data protection principles. As its disclosure would breach one of the data protection principles, it follows that the information is exempt under section 40(2) of FOIA.

The Appellant’s Grounds of Appeal (‘the Grounds’) are summarised as follows:

The Commissioner resisted the appeal and relied on his DN for his findings. However, in response to the Appellant’s Grounds of Appeal, the Commissioner made the following contentions.

In their Response to Ground 1 of the appeal, the Commissioner believed that the FOS were correct in their refusal notice and internal review in explaining why the information was personal data and could not be disclosed under so 40(2) FOIA. The Commissioner could not see anything in their correspondence as being deemed ‘unacceptable reasons’ – the FOS have to comply with FOIA and have provided a valid reason not to disclose the information to the world at large.

Having identified the information requested as personal data, the Commissioner in the DN went on to explain that information about a person’s sex life or sexual orientation is special category personal data. This is a category of personal data which can only be disclosed if one of a small number of conditions apply. These conditions are that the data subjects had consented to their data being disclosed or if they had manifestly made the information public themselves. The Commissioner explained in the DN that the FOS had not sought the consent of the data subjects (although this was not necessary), and there was no evidence of consent. The Commissioner also decided that there was no evidence that the data subjects manifestly made the information public themselves thus neither condition applied. The Commissioner concluded his DN by stating there was thus no lawful basis on which the FOS could disclose the information under FOIA.

In response to Ground 2 of the appeal, the Commissioner noted the Appellant asked a staff member how many of their team identified as gay. His intention was to identify the sexuality of one or more individuals. Granted, the Appellant may or may not have known the size of the team when making his request, but the DN clearly explains how the personal data of one or more individuals from a small team of 6 could be disclosed if the information was released. The Appellant has not provided any evidence to dislodge this finding. The Commissioner stated ground 2 can be dismissed.

In response to Ground 3 of the appeal, the Commissioner explained the Appellant has outlined his grievance with FOS. However, his issue with the FOS which relates to his complaint with them is outside the scope of the Commissioner and Tribunal’s jurisdiction. Under s58 FOIA the Tribunal can only overturn the Commissioner’s DN if it is decided to be wrong in law. The DN focuses on the FOS’s response to the Appellant’s request only, not the Appellant’s wider concerns with the FOS. This ground can thus be dismissed, according to the Commissioner.

In response to Ground 4 of the appeal, the Commissioner agreed that the FOS did delay in providing its internal review outcome. However, the Commissioner stated that this is not a ground that would affect the DN. . The Commissioner stated that a delay in responding to an internal review is not a breach of FOIA, it is simply non-compliance with a non-enforceable Code of Practice. The Commissioner submitted this ground can therefore be dismissed.

The FOS responded to the appeal on the 25^th November 2022. In response to grounds one and two the FOS argued, the provision of the information requested would, whatever the number is, enable a person who was motivated to identify one or more team members, and moreover, whether the team member identifies as gay or not. The means which are reasonably likely to be used to identify the natural person could include, for example, the use of internet searches, social media and the FOS’ website. The costs and time required for identification would plainly be minimal. Equally, if a person is already familiar with the team, then it would be even more straightforward to identify the team members, and their sexual orientation.

The FOS contended there is no error of law in the Commissioner’s decision. Further, that the Commissioner carefully considered whether the provision of statistical data would identify one or more individuals, and in accordance with the correct legal position, did not assume it would do so. Moreover, the Commissioner also made clear in his decision that the mere fact that the team size is small does not mean, in and of itself, that a team member would be identifiable, but it clearly makes it easier to identify one or more team members.

The FOS averred that the Commissioner’s analysis of the circumstances of the case was also plainly correct. The Commissioner was right to conclude that it would be possible for a motivated intruder to use both information in the public domain and insider knowledge to identify one or more individuals within the team.

In addition, the FOS argued that the Commissioner was correct to conclude that there would be no lawful basis for processing the special category personal data, as there was no consent, nor can the information manifestly be said to have been made public. The Appellant has not advanced any basis (let alone any tenable basis) for impugning those conclusions. The FOS invited the Tribunal to dismiss these grounds.

In response to Ground 3 of the appeal, the FOS stated this ground makes unfounded allegations of discrimination which are wholly refuted by the FOS. However, and in any event, the allegations do not fall within the Commissioner’s, nor in turn, the Tribunal’s, jurisdiction. The FOS argued Ground 3 should respectfully be dismissed.

In response to Ground 4 of the appeal, the FOS contended that this ground is a reiteration of the Appellant’s complaint that the FOS delayed in carrying out its internal review. The Commissioner noted that, although there is no statutory time limit for completing an internal review, it is good practice to carry out an internal review within no more than 40 days. The Commissioner concluded that the three months taken by the FOS was ‘poor practice’. The Commissioner’s conclusion as to the FOS’ internal review process has no bearing at all on whether the FOS was entitled to rely on section 40(2), in refusing to provide the information requested by the Appellant on 26 August 2021. Ground 4 should respectfully be dismissed.

The Appellant lodged a submission via email to the Tribunal on the 11^th December 2022. The Appellant argues that there were clear and notable delays at all stages in the FOS’ handling of the request. The Appellant contended that this data is in the public interest. The Appellant stated that two months had elapsed before his request was acknowledged. Further, that the assessor was obstructive in this instance. The Appellant referred to a parallel case in which he felt that evidence was missed. The Appellant reiterated that he felt the behaviour was obstructive.

The Appellant makes comments in his Ground 1 of appeal about "numerous and unacceptable reasons for claiming why they refuse the data requested".

The Tribunal find this is not supported by any evidence. The FOS, and then the Commissioner, in the DN, have each explained carefully, and with the necessary detail, the interaction of the rights of third parties under the DPA and the action of the FOIA. It is well recognised that the FOIA does not enable the provision of third-party personal data by the "back door" i.e., the release of personal information about individuals that would not be in compliance with the DPA. The Tribunal find both the Respondents to be correct in their interpretations, reasoning, and findings in this regard.

The decision by the Commissioner does not involve an exercise of his discretion as s40(2) is an absolute exemption and hence public interest considerations such as those put forward by the Appellant are not relevant.

In the Commissioner’s Response (para 22, 1 November 2022) and the FOS's Response (para 22, 25 November 2022) both Respondents reference the ability of a motivated intruder to identify the individuals in the Investigator team. This is clearly the case as these individuals are public facing i.e., their names and roles are made available to the members of the public whose complaints they are dealing with. Therefore, the Tribunal accept the premise that the identity of the team members taken in conjunction with the statistics that Mr Leeks has requested could be combined to reveal special category data.

See in support the Recital 26 to the GDPR (para 12 above) and as the authority provided by Common Services Agency v Scottish Information Commissioner [2008] UKHL 47 paras 26 - 27 and 44 in particular that “Statistical data can, therefore constitute personal data. If it is possible for the recipient of the statistical data to identify an individual then the information would be personal data.” (para 12 above).

The Tribunal see the essential issue in this appeal being that, whilst the Appellant appears to be focused upon the number of gay people within the team, it is in fact any information in relation to a team member’s sexual orientation (whether heterosexual/straight, Lesbian/gay or bisexual or Other - using the FOS’ categories) that is to be regarded as special category personal data for which there would need to be a clear lawful basis for it to be disclosed to the world at large.

Given, that in the absence of evidence of consent, or positive action indicating intent of such consent, by any of the team members to any such information being released to the world at large, the presumption must be any such information has been provided in confidence. Therefore, any possibility, however small, that it could be disclosed and/or revealed to the world at large in relation to an individual would need to be treated with utmost caution.

We agree with the Commissioner that with such a small team, any information about sexual orientation of some of the team could make it possible to discover the sexual orientation of other members of the team through putting together a range of sources of information. This is sometimes described as a “Mosaic” effect whereby pieces of information from various sources can be put together to reveal an identity.

The same principle would apply if the FOS were to seek team member's consent to have their sexual orientation disclosed - any partial disclosure (e.g. which individuals are gay) could reveal by exception the sexual orientation of others. It would be necessary therefore for the whole team to agree to disclosure. There is also no evidence whatsoever of this.

Similarly, we find the Public Interest Test is not relevant as the Exemption relied upon at s40(2) is an absolute exemption and not qualified by a Public Interest test.

The issue of any delay by the Public Authority herein is a matter of procedural non-compliance and not a matter to be considered in determining the substantive issues in this appeal.

Finally in relation to any allegations of obstructive conduct, or discrimination, by the Public Authority involved herein, the Tribunal find no evidence to support such allegations but again these are not substantive issues for our consideration and have no bearing on the outcome.

In all the circumstances as outlined above, and on the evidence before us, we do not find any error of Law in the DN, nor any error of Law in the exercise of any discretion by the Commissioner in the DN. Accordingly we must dismiss the appeal.