NCN: [2023] UKFTT 00634 (GRC) Case Reference: EA.2019.0361
Information Rights
Determined, by consent, on written evidence and submissions.
Considered on the papers on 9 May 2023 and 19 July 2023.
Before
TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Rosalind Tatam
TRIBUNAL MEMBER Naomi Matthews
Between
Jonathan Hayes
Appellant
And
The Information Commissioner (1)
The Chief Constable of Leicestershire Police (2)
Respondents
Decision: The appeal is Allowed
Substituted Decision Notice: A substituted decision notice is made as described in paragraph 35 below.
REASONS
MODE OF HEARING
The parties and the Tribunal agreed that these matters were suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.
The Tribunal considered an agreed open bundle 230 pages of evidence and submissions, and further submissions and a witness statement on behalf of the Chief Constable of Leicestershire Police (Leicestershire Police) following the adjournment of the consideration of the appeal.
BACKGROUND
On 24 January 2019, the Appellant made a request to the Leicestershire Police for information, and the Leicestershire Police relied upon s12 FOIA to decline to provide the information. The Commissioner agreed with the Leicestershire Police, and the Appellant appealed that decision.
The First-tier Tribunal (FTT) struck out the Appellant’s appeal on the basis that it had no prospect of success on 13 November 2019. The FTT refused permission to appeal on 31 December 2019 and the Appellant renewed his application before the Upper Tribunal (UT). Permission to appeal was granted by the UT on 27 July 2020.
On 22 February 2021 the UT directed that the Leicestershire Police be made a party to the appeal. Upper Tribunal Judge (UTJ) Mitchell allowed the appeal on 23 March 2022 concluding, in summary, that there were two potential interpretations of the Appellant’s request, and it was an error of law for the FTT to have not considered the narrower interpretation: Hayes -v- the Information Commissioner & Leicestershire Police Force Case no: GIA/817/2020 / UA-2020-001600-GIA.
That narrower interpretation could have had a material bearing on the outcome and the FTT should have given sufficient reasoning as to why it adopted the wider interpretation of the request ([57]) and see below.
Explaining the background more fully, the Appellant’s request in full was as follows:-
…the Professional Standards Department of the Leicestershire Police Force has said between the 12th of October 2018 and the 23rd of October 2018 “faults causing blank emails to be received and the wrong date stamp to be applied were identified within the Force’s ‘Openscape’ system”, see the attached letter…and I believe these to be associated with the contact Us email contactus2@leicestershire.pnn.police.uk. In light of this and in accordance with the Freedom of Information 2000 [sic], please provide me with the total number of emails this happened to, the number of senders of emails this happened to and how many of these senders were external to the Force, the total number of emails received by the Force within the above period and then let me know whether this sort of fault has ever occurred before or after the period and if they have let me know the number of times it has occurred and the number of senders it happened to.
The UTJ explained that:-
It can be seen that Mr Hayes’ request for information encompassed a number of sets of information:
the “total number of emails this happened to” during the period of the request (i.e. the numbers received as blank with an incorrect date stamp);
the “number of senders of emails this happened to” during the period of the request, which should have been the same as the total number of emails (unless at least one sender sent two or more emails during the period to which the request related);
how many of the “senders of emails this happened to” were external to Leicestershire Police Force;
the total number of emails received by the Force during the period of the request;
whether this “sort of fault” had occurred before 12 October 2018 or after 23 October 2018;
if so, how many times and ‘the number of senders it happened to’.
In response, Leicestershire Police informed the Appellant that on 5 February 2019 a software fault caused received emails to display as blank, although “emails are displaying correctly in the back end system”. The fault only affected “customers using Microsoft client products”. Leicestershire Police were unable to provide details of the number of ‘users’ affected because “it’s impossible to know what client an individual uses to send email”. The Appellant could be given “detail around quantities of emails received during this time, but again it’s not filterable to those affected as they would appear with full text and correct time stamps from the back end system”. Leicestershire Police also informed the Appellant that their digital desk operators had not reported any other instances of this fault having occurred.
The Appellant’s written reply to the Leicestershire Police expressed doubt that the fault had only affected emails sent using Microsoft client products because he had not used such a product, criticised the technical explanation given for the fault, and argued that, if the Leicestershire Police were unable to quantify the scale of the fault by defining the number and senders of emails affected, the Force could not be considered “fit for purpose”.
It is convenient to adopt the UT description of the Commissioner’s decision notice as follows:-
Mr Hayes complained to the Information Commissioner and it seems that this prompted the Police Force to conduct an internal review of their response to Mr Hayes’ request. The outcome of that review was communicated to Mr Hayes in writing on 17 May 2019. The Force relied on section 12 of FOIA, namely that the costs of complying with the request would exceed FOIA’s cost limit. Seeking to identify the number of emails affected would be “incredibly time consuming” and impractical. The Force informed Mr Hayes that there was no further information that they could provide “in relation to your request”.
The Information Commissioner considered Mr Hayes’ complaint against the Force’s response to his request for information. The Police Force’s submissions to the Commissioner included the following assertions:
the Force sent and received over 100,000 emails every day so that more than one million emails fell within the period of Mr Hayes’ request;
since it was impossible to ascertain which senders used Microsoft client products without manually reviewing each email, more than one million emails would need to be checked in order to comply with Mr Hayes’ request.
The Commissioner’s decision notice shows that she understood the Police Force’s case to be that, in order to comply with Mr Hayes’ request, it would be necessary for the Force to ‘manually review’ over “one million records”. Such an exercise would exceed the appropriate cost limit under section 12 of FOIA. No sampling exercise was required “given the volume of records and the investigations and assurances of Leicestershire Police which were based on advice from its IT specialists”.
The Commissioner also considered whether the Police Force had complied with its duty to provide advice and assistance to Mr Hayes under section 16(1) of FOIA. The Force appeared not to have considered this, which was itself a breach of section 16(1). However, given the Police Force’s representations, the Commissioner’s decision notice “did not order any steps” to rectify this breach. The decision notice indicates that the Commissioner believed compliance with Mr Hayes’ request would have involved police staff viewing some million emails. On that basis, the Commissioner had no doubt that the appropriate costs limit would be breached no matter what advice and assistance were given to Mr Hayes. Mr Hayes appealed to the First-tier Tribunal.
As explained above the FTT struck out the Appellant’s appeal, but the UTJ decided that this entailed an error of law and explained as follows:-
In my judgement, there were two possible readings of Mr Hayes’ request. Mr Hayes either sought information restricted to the ‘contactus’ email address referred to in his request (narrow reading) or he sought information related to all emails received by the Force during the period of his request, whether from internal or external senders (wider reading). In my judgment, both readings were tenable. The former due to the way in which Mr Hayes introduced his request that is by describing a particular ‘contactus’ email address, and the latter due to that part of the request which referred to senders external to the Police Force. I shall not express any view as to which reading I prefer since this case is to be remitted to the Tribunal.
Under the narrow reading of Mr Hayes’ request, that is limited to the ‘contactus’
email address, it was surely implausible that over a million items of data fell within the scope of Mr Hayes’ request. It could not reasonably be supposed that Leicestershire Police Force would receive some 100,000 emails daily at an email address that must have been created as a means for members of the public to contact the Police Force. Had the Tribunal approached the strike-out application on that narrow reading of Mr Hayes’ request, there must have been a significant chance that it would not have concluded that the appeal had a realistic prospect of success.
In my judgment the Tribunal overlooked a relevant consideration namely that, were the narrower reading of Mr Hayes’ request correct, the Police Force’s claim to
have received 100,000 emails daily could not have been plausible. By proceeding on the basis that the wider reading applied, as the Tribunal seems to have done, the Tribunal failed to address the point that, if the narrower reading applied, the Police Force’s reported receipt of 100,000 emails daily could not have been correct. An alternative analysis is that the Tribunal failed to give adequate reasons for approaching Mr Hayes’ appeal on the basis that the wider reading of his request for information was correct. Either way, the Tribunal’s decision involved an error on a point of law. I should, however, add that I very much doubt the Tribunal would have struck out Mr Hayes’ appeal if it had been informed that, if Mr Hayes’ request were limited to the ‘contactus’ email address, it could have been complied with without exceeding the section 12 FOIA costs limit. The Police Force’s failure to inform the Commissioner that, on the narrower reading, the request would not exceed the section 12 cost limit almost certainly led the Tribunal to make an error that would not otherwise have been made.
CONINUATION OF THE APPEAL IN THE FIRST TIER TRIBUNAL (FTT)
Thus, the case was returned to the FTT for the appeal to continue (and is now considered by us). On 9 December 2022, a judge in the FTT made directions that:-
The appeal will decide the following issues:
Did s.12(1) of FOIA entitle Leicestershire Police to refuse to comply with the request, on either:
the wider interpretation of the request considered in the Decision Notice of 24 September 2019; or, applying s.16(1)
the narrower interpretation set out in the decision of Upper Tribunal Judge Mitchell of 23 March 2022?
If not, can Leicestershire Police now provide such information as FOIA required it to disclose?
If the answer to (b) is no, why?
Should the appeal be allowed and, if so, what substituted decision notice should be made?
In response to these directions, both the Commissioner and the Leicestershire Police proposed a solution to bring proceedings to an end.
The Commissioner said:-
…in light of the developments during the course of the Upper Tribunal proceedings, the Commissioner would now consent to a substituted Decision Notice that should have required Leicestershire Police to seek clarification of the request pursuant to s.1(3) FOIA, and provide the following reasonable advice and assistance to the Appellant:
a) Explain to the Appellant that the email issue had only affected emails in relation to the “contact us” email address
b) Confirm that a narrowed request focusing on the ‘contact us’ email address could have been responded to (at the time of the request - see below comments on whether the information is still held).
In its submissions for this FTT, the Leicestershire Police said that:-
…is prepared to concede that, given the ambiguity of the phrasing of the request, it would have been prudent to make a request for clarification and/or advise that the fault was only known to manifest in the ‘contactus’ mailbox and that, had it been, it is likely that the limited ambit of the request could have been identified and, had that occurred before the 13th February 2019 when the issue ceased to manifest (and not the 23rd October 2018, as erroneously stated in previous submissions), it would theoretically have been possible to comply with the request
Leicestershire Police initially proposed the following substituted decision notice:-
The Decision Notice is substituted to have recorded that the Second Respondent should have initially sought clarification of the Appellants request pursuant to s.1(3) FOIA, and provided reasonable advice and assistance under s.16 FOIA explaining that that the email issue had only affected emails in relation to the “contact us” email address.
However no steps are now required as the Second Respondent has confirmed it is not able to identify the affected emails given that the error which caused the issue has been fixed.
In an email dated 9 February 2023, the Commissioner agreed with this formulation. The Appellant was not happy to agree to such a solution.
However, the Commissioner also raised in submissions the issue as to whether the Leicestershire Police still held the requested information and said:-
…the Commissioner notes the reference made by Leicestershire Police in its submissions to the Upper Tribunal that it no longer holds the relevant data from 2018. The Commissioner invites Leicestershire Police to explicitly confirm whether the information sought in the request for information, on a narrow interpretation, is still held.
In fact, it does not seem that the important issue as to whether the Leicestershire Police still held the information was referred to in the UT decision, although (as mentioned) the Commissioner says that the matter was raised by the Leicestershire Police in submissions.
The Leicestershire Police dealt with the issue in this way in its submissions for this FTT as follows:-
The Second Respondent [the Leicestershire Police], in order to release capacity on its Storage Area Network, in October 2021 deleted email server backups prior to September 2021 and e-mails related to the ‘contactus’ e-mail address prior to March 2021;
By e-mail to the Second Respondent dated the 24th August 2022, the Appellant suggested that it would be possible to identify affected e-mails by searching for e-mails which had been sent to the senders of those e-mails notifying them that no content was showing.
The Second Respondent concedes that, post 13th February 2019, it may have been possible to identify affected e-mails by searching for e-mails sent to the senders of e-mails which appeared blank, but that was not possible by the 24th August 2022.
That was the state of the submissions when the Tribunal first considered the appeal on the papers on 3 May 2023. At that time the Tribunal was concerned about two matters at in its consideration of the appeal.
Firstly, looking at the chronology (as set out above), it can be seen that permission to appeal was granted by the UT on 27 July 2020, and on 22 February 2021 the UT directed that the Leicestershire Police be made a party to the appeal. Nevertheless, in October 2021, while the appeal was still live before the UT (it was determined in March 2022), the Leicestershire Police deleted the information which could have been disclosed to the Appellant if the narrow interpretation of the Appellant’s request had been adopted, and had also deleted the information that would have been required to prove their s.12 FOIA case under the wider interpretation (i.e. the total emails in their back up storage).
The Tribunal was concerned that the deletion meant that there would be no further practical steps that the Tribunal could require if it allowed the appeal and substituted a decision notice as proposed by the respondents. The Tribunal was troubled as to how information was deleted when it formed the subject matter of a live appeal in the UT to which the Leicestershire Police were a party.
Further, the Tribunal was surprised by the proposed wording put forward by the Leicestershire Police (and agreed by the Commissioner) for a substituted decision notice. This states that the Leicestershire Police ‘has confirmed it is not able to identify the affected emails given that the error which caused the issue has been fixed’. However, this did not seem to align with the reasons put forward by the Leicestershire Police in its submissions, that the affected emails could have been identified, but were deleted in October 2021. Thus the Tribunal made directions to obtain clarification on these matters.
FURTHER SUBMISSIONS AND EVIDENCE
Leicestershire Police filed a witness statement from Steven Morris who is the Head of Information Management for Leicestershire Police. In relation to the retention of the information sought by the Appellant, Mr Morris explained that ‘in the course of preparing this statement, I have consulted with our Head of Information Technology to provide assurance regarding our email deletion process’.
In relation to what happened in February 2019, Mr Morris says that:-
If clarification had been sought and a narrower interpretation had been applied before the 13th February 2019, manual searches of the mailbox in question may have allowed us to comply with the request within the FOI cost limit, thus negating our reliance on a Section 12 exemption.
We note of course that, as the request had two tenable meanings (as the UT found), it was the responsibility of the Leicestershire Police to seek that clarification from the Appellant, but that was not done. Mr Morris goes on to say:-
With regards to email retention from any mailbox received in our Force we previously utilised a system called CommVault which stored and logged all deleted emails. However, during the Beck and Janner Public Inquiries it was identified that this system was not fit for purpose and it was decommissioned. This occurred many months prior to Mr Hayes FOI request being received.
Without the CommVault system, the Force relies on Microsoft Exchange for the storage of e-mail and our Force retention policy for emails has been explained above. Our current Force processes ensure even where a user intentionally deletes an email, it will be logged and stored on our wider Force ‘back-up’ dataset.
The main purpose of these back-ups is part of our Microsoft Exchange Disaster recovery process and is about restoring the server rather than an individual mailbox.
The back-ups for the emails referenced in Mr Hayes FOI request (October 2018) were stored and held in Force until October 2021. In October 2021 the Force was upgrading its network to a more reliable hybrid Cloud environment, as opposed to the outdated ‘on-premise’ network that was originally in place. This on-premise network was running low on storage capacity that affected the day to day running of policing operations and critical police infrastructure. Examples of issues being experienced at the time include, but are not limited to:
Slow performance of operational databases, including system crashes that affected day to day policing operations
Servers going offline or acting irregular causing time and expense to investigate and resolve the issues.
Storage capacity being reached in critical business areas reducing the speed of operations but also the amount of new data that could be stored.
Our I.T Department recently estimated that to extend our on-premise infrastructure to meet the needs of the Force and maintain good stability and performance would cost approximately 3.2 million pounds, whereas a hybrid environment would cost less than half of this.
The network issues being experienced at the time of the deletion in October 2021 subsequently became overseen by a Gold Group chaired by a Ch Supt and it currently meets monthly to track and monitor the situation, such was the scale of the issue at the time.
The further submissions filed by the Leicestershire Police confirm that, in October 2021:-
Due to the urgent nature of the issue, the decision to delete data which was considered non-critical, such as general e-mail correspondence, was taken without reference to any ongoing proceedings before the Upper or First Tier Tribunal.
The Second Respondent now manages the process of data management through the agency of a Gold Command Group chaired by a senior officer, to ensure that proper measures are in place to ensure that data related to, for example, legal proceedings is appropriately identified and preserved.
In the circumstances, the Second Respondent concedes that any revised Decision Notice should reflect the fact that relevant data was deleted while proceedings were still extant.
In response the Appellant has provided further submissions, which we have considered in full. He referred to the National Police Chief’s Council “National Guidance on the minimum standards for the Retention and Disposal of Police Records”, and to the Commissioner’s guidance and retention and destruction of requested information, (Footnote: 1 ) which states that:-
You should be cautious about deleting any information that is subject to an information request as you may be legally obliged to communicate that information to the requestor.
You should preserve any information you identify as falling within the scope of an information request to prevent its deletion or amendment. The ICO recognises this is not always possible. If you fail to do so, you will leave yourself open to accusations that you have committed a criminal offence.
The exact information you need to provide may depend on whether a request has been submitted under FOIA or the EIR.
If you are following good records management practices, you should have a disposal schedule. It should identify and describe the records which you can dispose of in accordance with a defined timetable. Having a defined, consistently followed, policy is the best way to avoid committing a criminal offence.
On 29 June 2023 the Commissioner confirmed that no further submissions would be filed.
DISCUSSION
It is not our role to carry out enforcement action in relation to the FOIA, and that is a matter for the Commissioner. As the Commissioner’s guidance explains (as indeed does the Appellant) it can be an offence under section 77 FOIA to delete requested information ‘with the intention of preventing disclosure’. There is no evidence of an intention to prevent disclosure in this case, but s77 FOIA shows just how seriously the issue of deleting should be taken.
However, we are surprised that in this case the Commissioner has not expressed more concern about the deletion of information by Leicestershire Police which was the subject matter of an extant FOIA request, and an appeal before the UT for which permission had been granted and Leicestershire Police made a party.
Leicestershire Police’s explanation is simply that as the need to delete information was urgent, no consideration was (apparently) made of ongoing FOIA appeals or requests. It asserts, without giving details, that systems are now in place – in the form of a Gold Group monthly management meeting - to ensure that this does not happen again, but it is uncertain from what is said how this monitoring would prevent a recurrence. The Commissioner has made no indication as to whether or not he has taken steps to ensure that he is satisfied that appropriate systems are in place, and we are surprised by that, especially as the Tribunal offered an opportunity for the Commissioner to respond to the additional evidence of the Leicestershire Police.
We are also surprised that the Commissioner has had nothing further to say about his initial agreement with the Leicestershire Police that a substituted notice should state that the information is no longer held because an error has been fixed, rather than that the information had been deleted prior to the determination of the appeal, as has now been accepted by the Leicestershire Police.
This is an unsatisfactory situation. Be that as it may, we are satisfied that the information is no longer held and there is nothing that the Tribunal can do to reverse it. We accept Leicestershire Police’s view on this and that it would not be possible to use Microsoft Exchange now to recover the bulk deletion of October 2021 ‘as part of the deletion of general correspondence stored within our email servers’ as described by Mr Morris at paragraph 20 of his evidence.
For the reasons set out in the UT judgment there are two tenable interpretations of the Appellant’s request, and the scope of it should have been clarified by the Leicestershire Police. Both the Commissioner and the FTT approached the matter on the basis that only the wider interpretation could apply and, as the UT found, that involved an error of law (for our purposes) by the Commissioner. This Tribunal also notes the two interpretations. In its view the request is indeed ambiguous in its meaning but does not otherwise feel it appropriate to express at this time any further view as to which reading is to be preferred, as it accepts that in any event the information on either interpretation is no longer held, and cannot now be disclosed.
The appropriate substituted decision notice will read that:-
The Decision Notice is substituted to have recorded that the Second Respondent should have initially sought clarification of the Appellant’s request pursuant to s.1(3) FOIA, and provided reasonable advice and assistance under s.16 FOIA explaining that that the email issue had only affected emails in relation to the “contact us” email address.
However no steps are now required as the Second Respondent has confirmed it is not able to identify the affected emails as they were deleted in October 2021 at a time when the Second Respondent had been made a party to an appeal to the Upper Tribunal (for which permission to appeal had been granted) which related to the information requested.
Recorder Stephen Cragg KC
Sitting as a Judge of the First-tier Tribunal
Date: 24 July 2023
Date Promulgated: 28 July 2023