Edward Williams v The Information Commissioner & Anor

Mr Williams appeals against a Decision Notice (Footnote: ¹ ) dated 28 September 2021, issued by the Information Commissioner under s.50 of the Freedom of Information Act 2000 (“FOIA”). These are our OPEN reasons and may be freely read by any person.

The Desistance and Disengagement Programme (“DDP”) is part of the government’s counter-terrorism strategy, CONTEST. Led by the Home Office and run-in conjunction with the Joint Extremism Unit and HM Prison and Probation Service, it aims to rehabilitate individuals who have been involved in terrorism or terrorism-related activity and reduce the risk they pose to the United Kingdom. Its work was described to us as follows:

On 21 September 2020 Mr Williams requested the following information from the Home Office, pursuant to s.1 of FOIA (for ease of reference we have added numbers to each point):

On 24 September 2020 Mr Williams added the following:

In its response of 5 October 2020, the Home Office confirmed that it held that information, but that it was exempt from the duty of disclosure at s.1 of FOIA. For request [1] the Home Office confirmed that the number of active participants in the DDP from April 2019 to March 2020 was 109. It refused to release the number at the exact time of Mr Williams’ request, raising the exemption at s.35(2)(c) that disclosure would be prejudicial to the effective conduct of public affairs. The public interest in maintaining that exemption, it decided, outweighed the public interest in disclosure. As to the other requests, the Home Office raised the exemption at s.40(2) that the information constituted the personal data of the relevant participants, and that disclosure would be contrary to data protection principles.

Dissatisfied with the Home Office’s response, Mr Williams complained to the Commissioner. During the Commissioner’s investigation of the complaint, the Home Office additionally relied on exemption being required for the purpose of safeguarding national security under s.24(1). It further disclosed that there were 154 participants in DDP from March 2020 to April 2021.

Having completed his investigation, the Commissioner agreed with the Home Office’s reasoning and conclusions on the initial two statutory exemptions. Having concluded that the Home Office was therefore entitled to withhold disclosure, the Commissioner declined to consider the additional national security exemption.

On 29 September 2021 Mr Williams appealed to the Tribunal on the basis: first, that he should have been provided with a current number of participants rather than an annual figure, and that the public interest lays in disclosure; second, that the information sought in questions [2], [3] and [4] could not be classed as personal data if it “had been disclosed alone”; and third, that the Commissioner was put to proof that the information requested at questions [4] and [5] constituted personal data, arguing a legitimate interest in releasing the information due to its link with extremism and terrorism.

The Commissioner provided a Response to the appeal on 9 November, to which Mr Williams provided his Reply on 10 November 2021. Having been added as a respondent, the Home Office provided a Reply on 5 January 2022 that addressed all three claimed exemptions. We shall set out the positions taken in those documents in our own consideration of the issues.

The appeal was heard by means of the Cloud Video Platform, all participants connecting remotely. The Commissioner did not attend and was not represented, having indicated in advance that he was content to rely on the case set out in his Response. The first part of the hearing was open to the public, and Mr Williams was able to participate. The OPEN documents to be considered were agreed as consisting of:

Some of the Home Office’s evidence and submissions were provided on a CLOSED basis, and not disclosed to any party save for the Tribunal and the Commissioner. After dealing with preliminary issues and hearing evidence from Ms Doherty, the Tribunal moved into a CLOSED session from which everyone was excluded except for those attending on behalf of the Home Office. During this session we heard additional evidence from Ms Doherty.

It is well-established that use of a CLOSED material procedure is to be exercised sparingly because its use derogates from the principle of open justice, which is essential in any free and democratic society: Bank Mellat v Her Majesty's Treasury (No. 1) [2013] UKSC 38 at [2]-[3], and specifically in relation to FOIA appeals in Browning v The Information Commissioner [2014] EWCA Civ 1050. Use of the procedure was previously authorised in this appeal and have we have kept that order under review. We remain satisfied that regard to CLOSED material is necessary to protect third party interests, including the interests of national security, and so that we can understand the nature of the requested information without the very purpose of the appeal being confounded by its disclosure. We have done our utmost to minimise the disadvantage to Mr Williams by disclosing as much as possible of what was said in the CLOSED session so that it could inform his submissions. We have taken the same approach to these OPEN reasons. A confidential CLOSED annexe has been provided to the respondents setting out only our reasons that cannot be disclosed, and this is subject to a direction under rule 14 of the Tribunal (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 prohibiting its disclosure to any person or body other than the respondents to this appeal and their personnel and legal representatives. Embargoed draft versions of both the OPEN and CLOSED reasons were provided to the respondents to ensure that no information was wrongly disclosed in OPEN, this did not result in any substantive changes to either document.

The OPEN hearing resumed. We heard closing submissions from Mr Moss and Mr Williams and reserved our decision. Before moving away from the hearing however, we make two further observations.

First, the Tribunal apologises for the delay in promulgating this decision. Applying the relevant principles, such as those discussed in R. (SS (Sri Lanka)) v SSHD [2018] EWCA Civ 1391, we are satisfied that it remains fair for us to decide the appeal.

Second, we wish to make an observation on the way in the hearing was conducted by remote means. Before the COVID-19 pandemic, hearings in this Chamber were conducted in-person, face-to-face. In many other courts and tribunals such a hearing is now again the starting point, a remote or hybrid hearing being the exception. Due to the nature of this Chamber and its proceedings, remote hearings are still routine. This has benefits in both efficiency and access to justice, but the overriding factor remains fairness. A party has no absolute entitlement to a remote hearing, much less to connect to a hearing in a particular way. In a recent decision, Swift v Information Commissioner & National Highways [2022] UKFTT 382 (GRC) (Footnote: ² ) , the Tribunal said this:

In the present appeal the only person to give oral evidence was Ms Doherty. Mr Williams cross-examined her, as he was entitled to do. We could not see Mr Williams, whose connection had been described to us as being “audio only”. All other participants could be seen. As Mr Williams had signposted his intention to connect in this way early in the proceedings, without objection from the Tribunal or the respondents, we took no issue. But what causes us unease, on subsequent reflection, is a final comment by Mr Williams after the conclusion of the evidence, which revealed that (unlike Mr Swift in the above example) he could see the video feed even though he could not be seen himself. Not only does this engage the concerns expressed in Gubarev, for a witness to be unable to see her questioner when he can see her risks being unduly oppressive.

We make no criticism at all of Mr Williams. Until now he has never been put on notice that his preferred method of connection is anything other than entirely acceptable. Nor has the issue had any adverse consequences in this particular appeal. But in future, permission to join hearings by audio only should be sought in advance. If a party does not have the required facilities – a modern tablet, smartphone, or computer and webcam, together with a suitable place to use it – then any inability to obtain or access it should be explained and evidenced. There are further alternatives, such as the Tribunal arranging for the party’s local court or tribunal centre to provide a video booth or indeed holding the hearing face-to-face at a convenient location, that the Tribunal may well require to be addressed before permission is given. All applications will, of course, be fact-specific and dealt with according to the overriding objective to the Procedure Rules including any request for reasonable adjustments.

The Tribunal’s approach to an appeal under s.58 of the Freedom of Information Act 2000 was confirmed by the Upper Tribunal in Information Commissioner v Malnick and Anor [2018] UKUT 72 (AAC) at [45] and [90]. Section 58(2) of FOIA provides that the Tribunal may review any finding of fact on which the notice in question was based. This means that the Tribunal exercises a full merits appellate jurisdiction, making any necessary findings of fact and then deciding for itself whether the provisions of FOIA have been correctly applied. But it does not start with a blank sheet: the starting point is the Commissioner’s decision, to which the Tribunal should give such weight as it thinks fit in the particular circumstances. The issues are to be decided as of the date of the public authority’s response, in this case 5 October 2020, but subsequent events can be considered when deciding on any substituted decision notice: Montague v Information Commissioner and DIT [2022] UKUT 104 (AAC).

As well as the exemptions at s.36 and s.40, the Home Office relies upon s.24, being that exemption is required for the purpose of safeguarding national security. In his closing submissions Mr Williams argued that there was no case for him to meet on s.24, given that it was not considered within the Decision Notice under appeal, and that we should not consider that exemption.

As confirmed in Birkett v DEFRA [2011] EWCA Civ 1606 at [24]-[28], subject to the Tribunal’s case management powers a public authority is entitled to invoke additional exemptions at any point during the proceedings. We consider it appropriate to permit the Home Office to do so here. First, s.24 was raised in the Home Office’s ‘Revised Response’ to Mr Williams dated 5 August 2021, as well as a letter to the Commissioner on 4 August 2021. The Commissioner declined to address the exemption, having already found others applied. That decision was out of the Home Office’s control. The exemption is then squarely raised in the Home Office’s rule 23 Response to Mr Williams’ appeal, albeit ‘in the alternative’ to the other exemptions. It is directly addressed in Ms Doherty’s witness statement and Mr Moss’s skeleton argument provided on 8 June 2022. At the date of hearing Mr Williams had been on notice that the exemption would be claimed, and (insofar as is possible) the way in which it would be argued, for nearly a year. He has had a fair opportunity to deploy his own evidence and argument in response. While it must be said that the exemption’s prominence in the Home Office’s submissions has increased as time has gone by, so that it now stands as its primary argument, it is still appropriate and fair to consider it.

Having considered the evidence and submissions on the three exemptions, they are best dealt with in the following order:

The first two exemptions will only apply if the Tribunal considers that the public interest in maintaining it outweighs the public interest in disclosing the requested information. The third is an absolute exemption but incorporates its own balancing exercise.

The Home Office’s evidence relates to all three exemptions. It was principally given by Ms Doherty, the Head of Prevent Intervention Programmes within the Prevent Directorate, part of the Homeland Security Group within the Home Office. She has held that role since August 2021 and her responsibilities include case management policy and interventions for DDP.

The Home Office has argued that disclosure of the information requested by Mr Williams risks ‘mosaic’ identification of participants in DDP. It aims to release annual figures as to the total number of participants over that year. This differs from a snapshot of participants and their characteristics at any one time, which can be more readily compared with other contemporaneous sources of information to identify participants such as conviction statistics and media reports, as well as successive FOI requests. Ms Doherty gave a fictitious example of two snapshots being able to show that the number of participants with a particular characteristic has increased by one following a terrorism case being reported in the media, meaning that person is likely involved. To show that such successive FOI requests are made, Ms Doherty referred to two subsequent FOI requests made by Mr Williams himself, for the respective numbers of Islamist and far right participants both at 31 December 2021 and for the whole of that year. Inevitably the identity of a minority of participants is reported in the media, or at the very least can be hypothesised for analytical purposes from a particular conviction or the making of a particular type of order. Coupled with characteristics such as age and gender, mosaic identification by a so-called motivated intruder is a real potential outcome of snapshot identification.

For some participants, DDP may be a mandatory condition of release from prison on licence after a terrorism-related offence, of a Terrorism Prevention and Investigation Measure (“TPIM”), or of re-entry to the UK under the terms of a Temporary Exclusion Order (“TEO”). Some participants come to DDP voluntarily following referral, for example a serving prisoner about whom prison authorities have concerns.

Ms Doherty states that the programme is most successful when the participant willingly engages with the intervention, even where participation is mandatory. A possibility of being identified would, she said, risk reducing that engagement. Participants (or those mis-identified as participants) in the programme may face harassment and serious harm. They may be viewed as ‘traitors’ and ‘spies’ by their previous affiliates or those that have sought to radicalise them, and face stigma and distrust in their community. Identification as a participant might also risk difficulties such as media intrusion or problems with education and finding employment. Most participants subject to a TPIM or TEO have already been granted anonymity by the High Court when the measure or order was made, with identification potentially punishable by contempt proceedings. Identification of some participants, such as serving prisoners, could identify them as vulnerable targets for radicalisation or recruitment by other extremists.

Risk, Ms Doherty states, is not restricted to programme participants. The DDP engages Intervention Providers (“IPs”). This might be a practical mentor, giving the participant community and practical support, or an ideological or theological mentor. Mr Williams provided the Tribunal with an example of the role being publicly discussed, from the Chief Coroner’s Action to Prevent Further Deaths Report (Footnote: ³ ) following the inquests into the deaths in the 2019 Fishmonger’s Hall Terror Attack perpetrated by Usman Khan:

Ms Doherty described IPs as specialists in their field, subject to robust recruitment and training processes. They are required to meet directly with individuals, which itself carries risks. Care is taken to ensure IPs feel protected, and to safeguard their confidentiality. Many IPs go to great lengths to conceal their work for DDP, and the programme has encountered several instances of mentors receiving malicious messages. If identified, some mentors and their families could be exposed to a risk of harm from extremists and other hostile actors. They are advised not to discuss their IP role on social media or to the media in general, or to comment on government counter-terrorism policy. If an IP’s confidence in the Home Office’s ability to protect confidentiality is diminished, Ms Doherty stated, then their work for DDP may be threatened. IPs are already a scarce resource, and recruitment is difficult and time-consuming. Identification of participants in the programme risks identifying IPs, due to the need for the mentor to have regular contact and involvement in the participant’s life.

Ms Doherty described the risks of disclosure to the programme’s administration and effectiveness in general terms. A hostile actor might use snapshots and characteristics to identify operational and resourcing practices. A participant might use that information to assist in ‘feigned compliance’. If an individual is identified, then this requires an operational response that diverts resources away from maintaining the programme’s effectiveness. A case-by-case approach to snapshot FOI requests would likewise be resource-heavy in ensuring that a particular snapshot did not risk identification, insofar as this was even practicable.

In his robust and thorough cross-examination, Mr Williams did not specifically challenge Ms Doherty’s evidence as to the potential consequences for a participant or IP identified through disclosure. He did question the claimed likelihood of mosaic identification. He referred Ms Doherty to an article in the Guardian entitled ‘Extremists living in UK under secretive counter-terror programme’, published on 5 April 2019 (Footnote: ⁴ ) . Ms Doherty acknowledged that figures had been given to the Guardian that went beyond those which the Home Office now say is appropriate for disclosure. She was unable to say why this was considered appropriate as it pre-dated her involvement in DDP.

Mr Williams also questioned whether the Home Office truly intended to publish annual information as it claimed in its response of 5 October 2020, pointing out that DDP had been launched in 2016 and had still – even at the date of this hearing – never published annual statistics. Ms Doherty stated her understanding that in the early days of the programme when the number of participants was still low, there had been concerns over identification even from annual figures. While this was no longer the case, annual publication remained a “work in progress”. Annual figures had been released in response to FOI requests but not in any form of report published online. Ms Doherty acknowledged that this was “not ideal” and arose from prioritising other matters. The programme had been under significant operational strain over the past two or three years, due to the work connected with terrorist incidents including (but not limited to) those at Fishmonger’s Hall and the February 2020 attack in Streatham, as well as the pandemic – but it did remain the Home Office’s intention to publish annual figures. The overall responsibility for this was not hers, but the head of the Prevent Directorate.

Ms Doherty also gave evidence in the CLOSED session. To assist the Tribunal in achieving a fair procedure, and as suggested in Browning at [35], at our request Mr Moss prepared a narrative setting out as much as possible of what transpired. Following amendment and approval by the Tribunal, the following was provided to Mr Williams:

In his closing submissions, Mr Williams asked us to “think carefully” about whether Ms Doherty should be considered as a reliable witness, given what he described as an implausible account of why no annual figures had yet been published by DDP despite years spent claiming an intention to do so. After carefully considering the evidence, we have concluded that Ms Doherty was an honest and reliable witness who did her best to answer Mr Williams’ questions. Her knowledge was focussed, understandably, more on DDP’s operational demands and the potential risks to participants and IPs, upon which she was well placed to give evidence, than schemes for publication of information. Mr Williams’ consequent argument that the Home Office had “provided the wrong witness” reflects the relative importance he places on the discrete issue of annual publication. In addressing the actual issues that arise in the appeal, we consider Ms Doherty to have been an entirely appropriate person to give evidence. We found her evidence to be thoughtful, sincere and reliable. We have no hesitation in accepting her evidence, while recognising that the application of the exemptions and the balance of the public interest in disclosure is for the Tribunal to decide. We shall discuss the genuineness of the Home Office’s intention to publish annual figures later in these reasons.

In approaching this exemption, the Upper Tribunal in FCDO v Information Commissioner & Williams [2021] UKUT 248 approved six principles. We summarise them as follows:

Mr Moss put forward that the risk of identification can be divided into five strands: identification of a particular participant; mis-identification of a particular person as a participant; a chilling effect on voluntary enrolment and individual engagement; a chilling effect on recruitment and retention of IPs; and finally that release of characteristics might show how resources are divided between different groups and increase the opportunities of participants to avoid the programme or to feign compliance. In relation to identification of individuals, he put forward Ms Doherty’s evidence on successive snapshots and other publicly available information. We take all her evidence into account, without repeating it. Mr Moss also relied on the fictitious example given in the Home Office’s rule 23 Response:

The same could be said of a person sentenced to an immediate custodial sentence, as their release date (and therefore likely entry on to the programme) could be calculated. The Response contains a second example, by reference to request for the age of the youngest participant. If the age were to change between two successive FOIA requests then this could be connected to an individual whose age had been publicly reported, as is common and would be even more likely if conspicuously young. Furthermore, sometimes the Home Office was required to release details in response to other events. An example was the Fishmonger’s Hall inquests. These are unforeseeable. The Response also cites Subject Access Requests as a further source of information. While they are not publicly available, there is nothing to prevent the recipient publishing the data or being the motivated intruder themselves.

Mr Williams argued in response that the risk of mosaic identification had been overblown. At best someone might guess at someone’s identity, he argued, which was not the same as positive identification. He also asserted that most participants would share many personal characteristics such as to make individual identification unlikely, and that many of the triggers for inclusion on DDP – such as the making of a TEO – were not usually put in the public domain. As for the specific example given above, he argued that the non-British, non-Islamist female exemplar was extremely unlikely to arise in the real world.

Having carefully considered the parties’ submissions, and without repeating all of them, we find that there is a high risk of mosaic identification of individual participants if any of the requested information is disclosed. This arises from the low number of participants overall, the chance of participants having a high media profile or being associated with a high-profile incident, and conviction for certain offences or the making of a TPIM or TEO often being a trigger for participation. Mr Williams’ points above are defeated by both the low number of total participants and reliance on his own assumptions as to the characteristics of a typical participant. Even if many do share the same characteristics, then it becomes easier to identify those who do not, and the same can be said about those for whom conviction or the making of an order is the subject of publicity. Even if someone were only able to make an educated guess as to a participant’s identity, without identification being conclusive, it might still be thought sufficient by a hostile actor to justify action.

We are satisfied that the risk of identification can arise even if only question [1] of Mr Williams’ request is answered, its effect being to enable something close to real time tracking of the number of participants by multiple requests and which can be compared to other information in the public domain.

Rather like a traditional logic grid puzzle, the risk increases greatly with each characteristic then added to disclosure. Indeed, one of the factors put forward by Mr Williams in support of the public interest in disclosure is knowledge of the level and type of threat posed by particular extremist movements. In his closing submissions he expressed his disbelief of (what he says have been) comments by senior police officers that white supremacists pose a bigger threat to public security than Islamist extremists; he also said that his request for the age of the youngest participant related to identifying grooming “by Islamism, or perhaps by Extinction Rebellion.” We will turn to the public interest in due course, but Mr Williams’ intended use for the requested information illustrates its real potential to be cross-referenced to other sources about particular groups and particular individuals. Mr Williams may, as he told us, see his purposes as journalistic. But someone else could undertake the same exercise with hostile intent.

We therefore consider the risk of mosaic identification to be high for any of the individual questions, and as rising exponentially when combined with others. In reaching that finding we have placed no reliance on SARs as a source of information. The point was not pursued in Mr Moss’s oral submissions, and no particular details are given as to how this might operate in practice.

We also accept that identification of a participant may risk identification of the IP. For example, the involvement of an individual in a participant’s life might become known to friends and family, without them being aware that this is done as a practical mentor under the DDP. Upon the participant being identified as involved in the DDP, so too might the mentor.

Do the potential consequences of identification risk adversely affecting national security? The starting point is the purpose of the DDP, as set out at paragraph 2 above, being to reduce the risk of terrorist activity posed by its participants. It does so as a core part of the government’s wider counter-terrorism strategy. We apply the fifth and sixth principles set out in FCDO v Information Commissioner & Williams [2021] UKUT 248 to that context and have no hesitation in finding that the DDP’s effectiveness has a direct causal link with safeguarding national security.

We find that all five strands of identification risk argued by Mr Moss are established. Mr Williams made no argument against the individualised risk to participants and IPs that can arise from identification. We accept Ms Doherty’s evidence that identified participants can face a real risk of serious harm, stigma and reprisals, practical difficulties and vulnerability to further radicalisation. More directly relevant to the present exemption, we also accept the potential chilling effect on voluntary participation and engagement in the programme. The risks of this are self-evident, given that the programme’s entire purpose is to rehabilitate individuals who have already shown themselves to pose a risk to national security. The potential risk to national security posed by a breakdown in individual IP arrangements, or a chilling effect on recruitment and retention of IPs in general, is amply illustrated by the Fishmonger’s Hall report.

Under s.2(2)(b) of FOIA, this exemption will only apply if the public interest in maintaining it outweighs the public interest in disclosing the information. The Tribunal balances all relevant factors against one another, and applies the specific principles already set out at paragraph 34 above.

There are factors that support disclosure. There is a public interest in openness and transparency, as supporting accountability and democracy. This factor is apt to carry weight in all cases and does so here. More specifically, and as acknowledged by the Home Office, disclosure of some information may enhance public understanding of how the risk posed by those who have engaged in terrorist-related activity is managed. We would further add that the disclosure of the annual number of participants informs the public as to scale of this part of the government’s counter-terrorism measures and its relative importance to others, as well as the size of the problem it seeks to address. We cannot see, however, how the public would be better informed in this way by release of snapshot numbers rather than annual figures; the nature of the DDP’s intervention is rehabilitative rather than short-term urgent measures.

Mr Williams put forward two other potential factors. First, as already noted, he wishes to test claims by senior police officers as to the relative risk posed by different forms of extremism. We do not know whether such claims have been made, but we accept in general terms that there is a public interest in knowing which ideologies and forms of extremism are most likely to pose a risk of terrorism such as to justify state intervention. This enables the public to assess the effectiveness and proportionality of the state’s expenditure of resources and its use of investigatory and intrusive powers.

Second, Mr Williams cited the Fishmonger’s Hall report as establishing his conclusion that DDP has neither been effective nor represented value for money. The report does no such thing of course, far more information would be required before such a conclusion could be drawn, but we take Mr Williams’ broader argument as being that public understanding of the successfulness and effectiveness of DDP is a weighty consideration in favour of disclosure. Were the requested information relevant to that understanding, we would agree. It is not. Snapshot numbers shed no more light on DDP’s effectiveness than annual numbers, and nor does the information on individual characteristics sought in the other questions.

The factors in support of the public interest in maintaining the exemption have already been set out. We are satisfied that disclosure of information in response to any of the six questions has a real risk of causing an adverse effect on national security, in the ways described by Ms Doherty and as we have found at paragraph 44. We conclude that they wholly outweigh the factors in favour of disclosure. We therefore conclude that the requested information is exempt, pursuant to s.24(1).

Given our primary conclusion, we can express our conclusions on the remaining exemptions more briefly.

In the present appeal, this exemption will apply if disclosure would, or would be likely to, prejudice the effective conduct of public affairs. It was previously the Home Office’s primary reason for refusing disclosure, on the basis recorded in the Decision Notice:

The Home Office’s argument above is, taken at face value, a good one. We agree that premature disclosure of statistics by a public authority, including internal consultation over their accuracy and suitability for release, may in some cases divert staff resources away from pre-planned publication that would serve a similar purpose.

Our concern in this case is the lack of any evidence that, at the time of the response on 5 October 2020, there was any coherent or set timetable to be disrupted. Ms Doherty’s evidence was that annual publication of total numbers was intended as a matter of aspiration, but the resources to do so were simply not available. While she was able to point to other events that got in the way, such as the Fishmonger’s Hall and Streatham attacks, and the restrictions arising from the pandemic, their effects would have all been well known by the time of the response. When pressed, she was unable to identify any actual schedule or timetable. While answering FOI requests undoubtedly diverted resources away from policy and operational work in general, the evidence before us does not establish that there was any publication plan of sufficient coherence to be disrupted. The requests also appear to be the only way in which annual figures were ever obtained, despite the Home Office accepting in principle that they should be released. It is difficult to see why the total annual figure for April 2019 to March 2020 could be given to Mr Williams in an FOI response which it was known would be published online (Footnote: ⁵ ) , but that figure could not be published on gov.uk in the usual way.

In fairness to Ms Doherty, we should re-emphasise that she does not have overall responsibility for publication of data. As argued by Mr Williams, there may have been a better explanation of this point available from someone else in the Home Office. So far as the actual evidence before us is concerned, however, we are unable to accept the applicability of this exemption on the basis claimed in the 5 October 2020 response.

The way in which this exemption is argued has, however, evolved. While we are tasked with deciding the appeal on the basis of facts as they stood on 5 October 2020, we are entitled to consider new arguments on those facts. The Home Office Response, and Mr Moss, make what we consider to be three key points. First, the request is for snapshot information rather than annual figures. We have set out Ms Doherty’s evidence that clearing snapshot figures for release would be resource-intensive, requiring consultation with stakeholder agencies and individuals to ensure that each snapshot would not identify a participant. Because this work might require engagement with risk factors specific to individual participants, and perhaps even the individuals themselves, it would be undertaken by operational staff who would be diverted from their usual work. Second, Mr Moss repeats the Home Office’s case on national security as also showing that disclosure would have prejudice to the effective conduct of public affairs in a general sense and consequent to any identification through disclosure. Third, disclosure might reveal the resourcing of DDP in a way that would enable others to undermine its effectiveness.

Based on our findings as to the likelihood of identification that would arise from disclosure, we accept the first of Mr Moss’s arguments in the above paragraph. We would ordinarily be reluctant to accept that s.36 could be engaged by the need to reallocate resources to comply with FOI requests. Compliance with FOIA is a legal obligation, and such a proposition risks promoting a lack of resources to a blanket defence. The situation here is qualitatively different. Fulfilment of a request for disclosure of a snapshot figure would, in effect, require a full risk assessment of what information would be disclosed and how likely it might be to identify an individual. This would involve more than the expense of time usually seen in responding to FOI requests, such as searching through records, redaction, and so on, which we would not accept as engaging this exemption. It would instead require direct operational work and potential liaison with individuals that itself might have a chilling effect on participation and engagement.

We further accept the second of Mr Moss’s reasons, on the basis of our findings on the adverse effect upon national security that identification could cause. To those can be added increased operational work following any incident of inadvertent identification, and the potential for damage to the relationship between the Home Office and its Intervention Partners.

The prejudice required for s.36 to apply is accordingly established on those first two bases, subject to the balance of the public interest. On the OPEN evidence, we cannot accept the third argument. While we can see its logic, the causal link described by Ms Doherty and recorded at paragraph 29 above is not self-proving and requires further explanation.

We carry forward our findings on the balance of the competing public interests in relation to s.24. Those in favour of disclosure are described at paragraphs 46 to 48 above. We find that the most prejudicial factors on the other side of the scales are the diversion of operational resources to risk-assess snapshot figures, and the actual and chilling effects of the risk of identification upon the relationship with IPs and their recruitment and retention. We consider the balance to lie strongly against disclosure, given the real risks to the effective running of the DDP programme that would arise from disclosure of snapshot figures and in dealing with the consequences of identification. The information is additionally exempt from disclosure pursuant to s.36(2)(c) of FOIA.

Again, we have reached the above findings with regard to only the OPEN evidence. The content of the CLOSED evidence substantially reinforces them.

Insofar as applicable in this appeal, s.40(2) provides an exemption if the requested information both constitutes personal data and its disclosure, otherwise than under FOIA, would contravene any of the data protection principles.

The meaning of personal data is given by s.3 of the Data Protection Act 2018 (“DPA”):

In NHS Business Services Authority v Information Commissioner and Spivack [2021] UKUT 192 the Upper Tribunal held that the section defines personal data according to a binary test: can a living individual be identified, directly or indirectly? The test is applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated intruder. That intruder is described in Information Commissioner v Miller [2018] UKUT 220 as being a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so, the touchstone being an investigative journalist.

The test under this exemption is not the same as the test under s.24, where not only a very unlikely possibility might suffice if its consequences were severe, as indeed might misidentification. Here, a positive answer is required. The Commissioner accepts that the answer is “not clear cut” in relation to questions [2], [3] and [4].

Based on the OPEN evidence alone, we find that the probability identified under s.24 is sufficiently high to provide an affirmative answer here. Viewed in isolation, each of the six questions might seem unlikely to identify an individual. But each must be seen alongside the making of other FOI requests seeking additional information, or the same at other times, as well as access to the external sources of information already discussed. By an admittedly narrow margin, we consider the risk of identification to be sufficiently high to justify the response to each individual question being classed as personal data.

“Special category data”, defined by Article 9 GDPR, is particularly sensitive and attracts more stringent protection. Both respondents argue that the request includes special category data as “some of it relates to” the data subject’s religious beliefs. We agree, but solely in relation to question [6] that specifically requests the religious identity and sex of the youngest person on the programme. Insofar as either respondent also argues that question [2] engages Article 9, we disagree. Given the requirement to interpret the Data Protection Act 2018 and GDPR compatibly with the European Convention on Human Rights, we interpret religious belief in accordance with the authorities concerning Article 9 ECHR. To be protected, a belief must be consistent with basic standards of human dignity or integrity: R. (Williamson) v Secretary of State for Education and Employment [2005] UKHL 15; held to apply to Article 9(1) ECHR in Bull & Bull v Hall & Preddy [2012] EWCA Civ 83 at [45]. Nor can we see that underlying faith and extremist beliefs are severable when the former informs the latter.

Special category data may only be disclosed where one of the exceptions at Article 9(2) GDPR applies. Those considered in the Decision Notice are (a) (explicit consent from the data subject) or (e) (data made manifestly public by the data subject). We agree that neither applies, and nor has Mr Williams argued otherwise.

Mr Williams puts forward the exception at (g):

Part 2 of Schedule 1 to the Data Protection Act 2018 provides that reliance on the exception requires one of 23 potential conditions to be met. Mr Williams relies on condition no. 13. This, so far as might be relevant in this appeal, requires that processing: is for the purposes of journalism; is necessary for reasons of substantial public interest; and is carried out in connection with the commission of an unlawful act by a person, other seriously improper conduct of a person, mismanagement in the administration of a body or association or a failure in services provided by a body or association.

Mr Moss argued that Mr Williams is not a journalist. Mr Williams’ reply was that the term is not defined by the Act, the FOIA response would be posted online, and it was not for the Home Office to choose who is and is not a journalist.

Processing must be for the sole purpose of journalism, or the condition will not be met. In Buivids v Datu valsts inspekcija [2019] EUECJ C-345/17 at [52], the Court of Justice held that journalistic purposes include the disclosure of information, opinions and ideas to the public; there is no requirement for the requester to be a professional journalist. Mr Williams’ sole purpose being journalism is a fact that he is required to establish, by evidence. He did not give evidence before the Tribunal, and even taking an inquisitorial and informal approach to his skeleton argument and oral submissions there is insufficient material upon which to base such a finding.

We are satisfied that the information sought at question [6], insofar as it concerns religion, is special category personal data and its disclosure would be contrary to data protection principles. It is exempt from disclosure under s.40(2).

Processing, such as disclosure, must be lawful, fair and transparent. As to lawfulness, Article 6(1) GDPR provides a list of situations where processing will be lawful. The only one put forward as relevant in this appeal is provided by Article 6(1)(f) of UK GDPR:

This provides a three-part part test: whether the request pursues a legitimate interest; whether disclosure is necessary to meet that legitimate interest; and whether the legitimate interest outweighs the interests and rights of the data subject.

In the FOIA context, necessity is established; disclosure under FOIA is the context of the exercise. We take the legitimate interests as being equivalent to the factors in favour of the public interest in disclosure we have already identified. In particular, the principles of transparency and accountability stand as a legitimate interest.

We turn to the balance between the legitimate interests in disclosure and the data subject’s interests, first repeating our findings as to the potential adverse consequences of identification. Further relevant is the reasonable expectation of the data subject, at the time and in the context of the collection of their data, as to how that data would be used. Participation in DDP is on an explicitly confidential basis, and it may be sensibly assumed that this was a relevant factor behind some voluntary participants’ decision to enrol. The protection of data subjects’ private life also carries weight: Nowak v Data Protection Commissioner [2017] EUECJ C-434 at [57].

Balancing the above factors in the context of data protection, we are compelled to the same conclusion as reached in relation to the other exemptions. The legitimate interests in disclosure identified by Mr Williams fall far short of outweighing the interests of a data subject who would be identified. Disclosure of personal data in response to any of Mr Williams’ six questions would be contrary to data protection principles. The exemption at s.40(2) FOIA applies.

Above, we have found each of the exemptions to be established solely on the basis of the OPEN evidence and submissions. Our conclusions are substantially reinforced once we take into account the CLOSED evidence, broadly on the basis set out in Mr Moss’s OPEN skeleton argument. In particular:

We find that the information is exempt from disclosure pursuant to all three exemptions. The Decision Notice is therefore treated as being in accordance with the law and the appeal is dismissed.