Ralph Timms v The Information Commissioner

This appeal concerns the following request made on 25 August 2021 by Mr Timms:

“Please may I have:

1.

Full Minutes of the Extraordinary Meeting held on Mon 27 April 2021 (Footnote: ¹)

There may have been a reason to withhold details at the time, but not, as I understand it, after a criminal charge has been made against an individual which was then rejected by the police. Parishioners have a right to know how such a charge could have been brought and what information was disclosed at the time to support the charge.

2.

Staff Salary and Terms & Conditions of Clerk's appointment

In the minutes of the PC Meeting held on 4 May it is stated: "Amount withheld due to confidentiality".

There is absolutely no reason for the clerk's salary to be withheld. He is a public servant paid for by Nocton Council Tax payers, who have a right to know on what T&C he was appointed. It is clear that his travel expenses are going to be excessive and unprecedented and now that there are no Covid restrictions, he should not normally be allowed to attend Parish Council meetings by Zoom or other on-line method.”

The tribunal refers to the two parts of the request as ‘part 1’ and ‘part 2’ in this decision. This appeal relates only to part 1 of the request.

As stated above, only part 1 of the request is in issue in this appeal.

On 29 August 2021 the Council responded to the request and withheld the information. It relied on section 41 (confidential information) in relation to part 1 of the request. It relied on section 40(2) (personal data) in relation to part 2 of the request. The Council upheld its position on internal review.

Mr. Timms referred the matter to the Information Commissioner on 15 September 2021.

The Commissioner was satisfied that the requested information was personal data as the information related to X who had an allegation of a criminal offence made against them, and the Parish Clerk, and both those individuals were identifiable.

In relation to the information requested in part 1 of the request, the Commissioner concluded that the information was criminal offence data. The Commissioner considered that there was no lawful basis for disclosure because X who had an allegation of a criminal offence made against them had not consented to the disclosure.

In relation to part 2 of the request, the Commissioner concluded that Mr. Timms was pursuing a legitimate interest and that disclosure of the Parish Clerk’s salary and terms and conditions of employment was, to some degree, necessary to meet that legitimate interest.

The Commissioner considered that the Parish Clerk had a strong and reasonable expectation that their salary and terms of employment would remain confidential to them and their employer. Furthermore, the Parish Clerk had expressed concern at the disclosure of the requested information stating that they had not given the Council permission to disclose their salary or terms of employment in response to the request.

The Commissioner determined that there was insufficient legitimate interest to outweigh the fundamental rights and freedoms of the Parish Clerk. Therefore, he considered that there is no legal basis for the Council to disclose this information and to do so would be in breach of principle (a):

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”

The Commissioner concluded that the Council was entitled to rely on section 40(2) of the FOIA to refuse to provide the requested information.

The grounds of appeal relate solely to part 1 of the request. Mr. Timms is no longer pursuing part 2 of the request.

In summary, the grounds of appeal are (numbering inserted by the tribunal):

Mr. Timms makes a number of criticisms of the procedure adopted by the Commissioner but these are outside our remit and, as this is a full merits appeal, any such errors will be corrected by our fresh reconsideration of the matter.

The Commissioner begins by addressing part 2 of the request. In the light of Mr. Timms’ indication in his grounds of appeal that he is not appealing this aspect, it is not necessary for the tribunal to set out this part of the response.

In relation to ground one, the Commissioner submits that the whole of the information requested relates to the personal data of X.

In relation to ground two, it is submitted that it is not necessary for the Commissioner to obtain ‘proof’ that X did not consent to the minutes being published. It is enough for him to rely on the word of the Council.

Further the Commissioner submits that even if the information is not special category personal data, it is still the personal data of X and the distress disclosure would cause and X’s rights and freedoms far overrides any legitimate interest in disclosure.

The Commissioner submits that the remaining issues raised by Mr. Timms are outside the tribunal’s jurisdiction.

Mr. Timms begins by addressing the Commissioner’s response in relation to part 2 of the request. As there is no appeal against this aspect of the decision notice, the tribunal does not need to set out this part of the reply.

In relation to part 1 of the request Mr. Timms makes a number of points, all of which the tribunal has taken into account. The main points are:

The complaints made by Mr. Timms in section C are outside the tribunal’s remit and therefore do not need to be set out here.

We read an open and a closed bundle.

The closed bundle contained:

It is necessary to withhold the above closed information from Mr. Timms because it either consists of the withheld information or refers to the content of the withheld information, and to do otherwise would defeat the purpose of the proceedings.

The relevant parts of section 40 of FOIA provide:

Personal data is defined in section 3 of the Data Protection Act 2018 (DPA):

This is in line with the definitions in the UK General Data Protection Regulation (UK GDPR). The tribunal takes the view that the recitals to the GDPR 2016/679 are a useful guide to the interpretation of the UK GDPR. Recital 26 to the GDPR is relevant, because it refers to identifiability and to the means to be taken into account:

The definition of "personal data" consists of two limbs:

Whether the data in question "relate to" a living individual and

Whether the individual is identified or identifiable, directly or indirectly, from those data.

The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA [2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.

In Durant, Auld LJ, giving the leading judgment said at [28]:

“Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.”

In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:

“It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.”

The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider:

“(2)

Does the data "relate" to an individual in the sense that it is "about" that individual because of its:

(i)

"Content" in referring to the identity, characteristics or behaviour of the individual?

(ii)

"Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?

(iii)

"Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)?

(3)

Are any of the 8 questions provided by the TGN are applicable?

These questions are as follows:

(i)

Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller?

(ii)

Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession?

(iii)

Is the data 'obviously about' a particular individual?

(iv)

Is the data 'linked to' an individual so that it provides particular information about that individual?

(v)

Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?

(vi)

Does the data have any biographical significance in relation to the individual?

(vii)

Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?

(viii)

Does the data impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)?

(4)

Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?”

The data protection principles are set out Article 5(1) of the UK GDPR. Article 5(1)(a) UK GDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UK GDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.

The only potentially relevant basis here is article 6(1)(f):

“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows

Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:

“27.

... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “

Article 10 UK GDPR provides:

“Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.”

Section 11(2) DPA provides:

“In Article 10 of the GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—

(a)

the alleged commission of offences by the data subject, or

(b)

proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.”

Section 10 DPA provides:

“10 Special categories of personal data and criminal convictions etc data

(1)

Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—

(a)

point (b) (employment, social security and social protection);

(b)

point (g) (substantial public interest);

(c)

point (h) (health and social care);

(d)

point (i) (public health);

(e)

point (j) (archiving, research and statistics).

(2)

The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.

(3)

The processing meets the requirement in point (g) of Article 9(2) of the UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.  

(4)

Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5)

The processing meets the requirement in Article 10 of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.”

Schedule 1, Part 3, Paragraph 29 DPA provides:

“Consent

This condition is met if the data subject has given consent to the processing.”

Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The issues for the tribunal to determine are:

Does the information relate to an identified or identifiable living individual?

Is any or all of the requested information criminal offence data in that it relates to criminal offences or alleged criminal offences by the data subject(s)?

In relation to any criminal offence data:

In relation to personal data which is not criminal offence data:

As stated above, the complaints made by Mr. Timms in section C of his appeal are outside the tribunal’s remit.

Mr. Timms complains that the Commissioner reached his decision in the absence of the withheld information. The tribunal had before it and took account of the content of the withheld portion of the minutes when reaching its decision. There is additional closed reasoning on this in the closed annex.

The question for us to determine is whether the withheld information is the personal data of an identifiable living individual or individuals.

In our view, the entire confidential section of the minutes are the personal data of X who was the subject of the ‘staffing matter’ discussed in the confidential part of the meeting on 26 April 2021. The minuted discussions focussed entirely on the actions or alleged actions of that individual and the Council’s past or future conduct in relation to those actions.

The minutes are biographical in a significant sense, in that they go beyond the recording of X’s involvement in a matter that has no personal connotations for that individual. The matter in question had extremely significant personal connotations for that individual. Given the serious nature of the alleged misconduct, it is clearly a life event in respect of which X’s privacy would be compromised by disclosure.

The focus of the minutes is the conduct of that individual or the Council’s action in relation to that conduct either past or future. The minutes are obviously about that conduct or the Council’s actions in relation to that conduct. Looked at as a whole the minutes are obviously about that individual and their activities, they are clearly linked to that individual. The minutes provide particular information about that individual and the way in which their conduct was handled by the Council. The central theme of the minutes is the conduct or the Council’s action in relation to that conduct.

The individual is named in the minutes. Even if the name were redacted, given the number of staff employed by the Council and the information that is evidently in the public domain about this incident, we find, on the balance of probabilities, that a motivated individual would have been able to identify X from the minutes and other information likely to be known by at least a section of the public.

We accept that Mr Timms has a legitimate interest in the disclosure of the minutes. There is a legitimate interest in transparency and holding the Council to account in relation to decisions taken by the Council. This is particularly so where there is a suggestion where the Council may have acted inappropriately in the action it took in relation to this particular individual.

We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interests. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least intrusive means of achieving the legitimate aim in question, because it would not be reasonably necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subjects.

There is no public record of the motions passed in the confidential part of the meeting, nor is there any public record of the discussions that lead to those motions. For that reason we accept that disclosure is reasonably necessary for the purposes of the above legitimate interests.

In assessing the consequences of disclosure we have taken account of the particular nature of the personal information. The information is personal and sensitive. It contains details of alleged serious misconduct and details of the actions the Council proposed to take in relation that that particular individual. There is additional reasoning on this in the closed annex.

There is no evidence before us to suggest that X would consent or has consented to the publication of the minutes, or that X would expect the minutes to be published. We conclude that disclosure would not have been within the reasonable expectations of X, because they are contained in part of the minutes clearly marked confidential and relate to a matter which had, at the time of the request, been concluded.

We find that there is clear potential for harm and distress given the serious nature of the allegations against X and on the basis of some additional closed reasoning in the closed annex.

Taking all the above into account, we conclude that the legitimate interests were overridden by the interests or fundamental rights and freedoms of X.

In the light of our conclusions above it is not necessary for us to consider whether the information amounts to criminal offence data.

For the above reasons we conclude that the Council was entitled to withhold the requested information under section 40(2) FOIA.