Des Moore v The Information Commissioner

Section 1(1) FOIA gives individuals a right to information from a public authority unless it is “exempt information”.

Section 40 FOIA provides:

Section 40(2) FOIA is an absolute exemption in relation to the first condition in section 40(3A). This means that the public interest balancing test under section 2(2)(b) FOIA does not apply.

The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be:

“processed lawfully, fairly and in a transparent manner in relation to the data subject”

Processing is lawful under Article 6(1) UK GDPR only if one of the relevant lawful bases apply, in particular:

“(f)

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”

Article 10 UK GDPR provides (in so far as relevant) that processing of personal data relating to criminal convictions and offences based on Article 6(1):

“shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects… “

Section 11(2) DPA provides:

“(2)

In Article 10 GDPR and section 10, references to personal data relating to criminal convictions and offences… include personal data relating to–

(a)

the alleged commission of offences by the data subject, or

(b)

proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.”

Section 10(4) DPA provides that section 10(5) makes provision for processing relating to criminal convictions and offences not carried out under the control of official authority. Section 10 (5) provides that:

“(5)

The processing meets the requirement in Article 10 of the GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.”

Section 40(7) FOIA provides that “personal data” has the same meaning as in Section 3 DPA, namely:

“(2)

“Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3)

“Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a)

an identifier such as a name, an identification number, location data or an online identifier, or

(b)

one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

The General Data Protection Regulation (EU) 2016/679 addresses identifiability in Recital 26 as follows:

“The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”

In NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192, Upper Tribunal Judge Jacob considered whether a patient could be identified from a list of dispensaries which had dispensed a particular medication. Having considered the relevant authorities in relation to the application of section 3 DPA and Recital 26 in these circumstances, Judge Jacob described the issue before him as:

“whether any person was identifiable from the [withheld data] when taken together with other information by someone who was motivated to identify one or more of the persons within the data using all the means reasonably likely to be used.” [paragraph 3]

Judge Jacob identified that an “inquirer” in the circumstances of Spivak might be a researcher, lobbyist or journalist, someone wanting to market a relevant product to the individual, or a family member of a patient. In other cases, this has been described as a “motivated intruder” (for example, Information Commissioner v Magherafelt District Council [2013] AACR 14) or a “determined person with a particular reason to want to identify the individual… using the touchstone of, say, an investigative journalist…” (Craigdale Housing Association v The Scottish Information Commissioner [2010] CSH 43, at paragraph 24).

Judge Jacob proposed that the test for the Tribunal to apply was not a test of “remoteness or significance or likelihood” (paragraph 21) but one of “whether it is possible to identify a specific individual solely by relying on the data available”. He went on:

“Identifying a pool that contains or may contain a person covered by the data is not sufficient. Saying that it is reasonably likely that someone is covered by the data is not sufficient. Still less is it sufficient to say that it is reasonably likely that a particular individual may be one of the pool. Linking any specific individual to the data in any of these circumstances does not rely solely on the data disclosed and other data available by reasonable means; it involves speculation.” [paragraph 22]

If a break in the chain between the information and the data subject can be bridged only by speculating or guessing, Judge Jacob concluded that the data subject is not identifiable from the information. This situation was “especially likely to arise when there is a pool of potential subjects”.

The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:

“(1)

If on an appeal under section 57 the Tribunal considers -

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.

(2)

On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.”

The Tribunal stands in the shoes of the Commissioner and takes a fresh decision on the evidence before us. The Tribunal does not undertake a review of the way in which the Commissioner’s decision was made.

The reasons for the Tribunal’s decision are set out in full below. There is no Closed Annex.Our findings were made on the balance of probabilities. The Tribunal applied the law as set out in paragraphs 16 to 31 above.

The Appellant did not dispute that the withheld information related to criminal offences nor that none of the conditions in Parts 1, 2 or 3, Schedule 1 DPA applied.

The main issue for the Tribunal was whether the withheld information was “personal data”. The Tribunal applied the law as set out in paragraphs 24 to 29 above. In particular, we applied the guidance of Upper Tribunal Judge Jacob in Spivack and asked ourselves whether any individual would be identifiable from the withheld information “when taken together with other information by someone who was motivated to identify one or more of the persons within the data using all the means reasonably likely to be used”. We noted that the test was whether it was possible to identify a specific individual solely through the available data, without guesswork or speculation.

We accepted the Commissioner’s submission that a possible “inquirer” might be a journalist investigating a particular fraud or offender, or WMP’s response to fraud or charging rates more generally. The inquirer might also be a victim of fraud, someone who had made an Action Fraud report, or someone accused of or involved in fraudulent activity, who wanted to identify the person charged with a particular offence. Alternatively, the inquirer might be someone who knew an individual charged with an offence in May 2019 who wanted to identify the type of offence, and whether the charge was the result of a NFIB report.

The Tribunal found that the means reasonably likely to be used by a motivated inquirer would include:

The Tribunal took into account that WMP is the second largest police force in the UK, policing almost 3 million people. However, we also accepted that the ease with which a motivated inquirer could identify an individual from the withheld data would depend upon the number of individuals charged. The smaller the number, the easier the task.

The Tribunal noted that other police forces had provided information in response to Request 2, even when there was only one charge in a month. This was not the issue before the Tribunal and we did not know why other forces had taken this approach. Public organisations are entitled to disclose information voluntarily beyond that which is required under FOIA, if they wish.

The Tribunal did not accept, as suggested by the Commissioner, that the Appellant had selected May 2019 because he had a particular interest in that month. There was insufficient evidence to support this, and the Tribunal noted that the Appellant had only narrowed Request 2 at WMP’s suggestion and that he had made the same request of multiple police forces.

The Tribunal concluded, taking into account all the evidence before us which included the withheld information in the closed bundle, that a motivated inquirer of the type identified above would be able to identify an individual from the withheld information, when that information was taken together with the considerable other information available about NFIB reports and WMP charges as identified in paragraph 36. An investigative journalist could combine the withheld information with information from sources, including victims of fraud and contacts of offenders, and from other public reports and FOIA requests, to identify those individuals charged in May 2019 in connection with a NFIB report. A victim of fraud or acquaintance of an offender would have personal knowledge about an offence and the relevant police investigation to combine with the withheld information.

We found therefore that the withheld information relates to an identifiable individual, and as a result, is “personal data” as defined in section 3 DPA.

The withheld information relates to criminal offences (section 11(2) DPA) and disclosure would not meet the requirement in Article 10 UK GDPR because no condition in Part 1, 2 or 3 of Schedule 1, DPA, is met. Disclosure would not be lawful under Article 6(1) UK GDPR and would therefore contravene the first data protection principle in Article 5(1)(a). The first condition in section 40(3A) FOIA is satisfied and the withheld information is exempt information under section 40(2). The duty to disclose in section 1(1)(b) FOIA does not apply and WMP were entitled to withhold the requested information.

The Decision Notice is in accordance with the law and the appeal is dismissed.