Peter Wailes v The Information Commissioner

Peter Wailes (“Mr Wailes and/or the Appellant) made a request pursuant to the Freedom of Information Act 2000 (“FOIA”) to be provided with the name of the person at Doncaster Metropolitan Borough Council (“the Council”) who made a certain drawing (“the Request”).

The information sought is personal data by section 3(2) Data Protection Act 1998 (“DPA”).

Responding to the Request by processing the Personal Data in this case would contravene the Data Protection Principles as set out in Article 5(1)(a) of the General Data Protection Regulations (“GDPR”) because it would not be necessary for the pursuit of a legitimate interest required by Article 6(1)(f) GDPR.

The Tribunal considered an open bundle for this appeal consisting of 174 pages. Page 23 appeared to be out of place and contained two questions numbered 5 and 6. We concluded they were not intended by the Appellant to be part of his appeal but that even if we are wrong about this, they would not have altered the outcome of this appeal.

On 18^th February 2022 Mr Wailes wrote to the Council and made the Request pursuant to section 1 (1) FOIA in relation to a drawing of a proposed cycle route. He asked “Could you please tell me who drew this drawing?”

There were two other questions raised in the Request but the parts of the Decision Notice which relate to them were not appealed.

There was correspondence concerning response times but in any event on the 21 April 2022 the Council responded to the Request (“the Council’s Reply”). The Council’s position was that the information requested was exempt from disclosure under section 40(2) FOIA because “Disclosure would contravene one of the data protection principles”

The Council expanded on this by saying:- “The details you have requested regarding council officers are personal data. Disclosure of the information would contravene the requirement of principle 1 that personal data must be processed fairly and lawfully. As an employer the Council owes a duty of confidence to employees and the employee has not consented to the disclosure of this information. Disclosing details without the consent of Officer would breach that duty of confidence and be unlawful. We therefore are unable to provide the requested information at this time”

On the 30 April 2022 Mr Wailes wrote asking for an internal review of the Council’s Reply. In summary he said that he had found many other examples of drawings produced by the Council in a short period and in each the creator had been identified in the title block of the drawing; that the Council would not be able to show that all these had given permission or had been asked for permission to have their names shown and that if the Council’s argument was valid there would be “prima facia evidence of breaches of GDPR rules in (at least) 96 cases…” He described the claim that a draftsman’s name (in itself) is personal data as being “… simply nonsense”.

By email of the 1 July 2022 the Council provided Mr Wailes with the outcome of its internal review (“the Internal Review”). The Internal Review contained the reasoning of the Council’s Reply but in addition that “The drawings are put together using information, designs etc from several officers. The officer putting together the final drawing is not responsible for the project in its entirety and it is therefore not necessary to provide those details. You have previously been provided with contact details for senior members of staff should you wish to raise any issues regarding this matter”

Mr Wailes referred the matter to the Information Commissioner (“the Commissioner and/or the Respondent”) by section 50 FOIA. On the 7^th November 2022 the Commissioner issued the Decision Notice by which it concluded that the Council was entitled to rely on the exemption provided by section 40(2) FOIA.

On 4^th December 2022 Mr Wailes appealed the Decision Notice (in so far as it related the one remaining question) to this Tribunal by section 57 FOIA. The Commissioner provided a response (“the Commissioner’s Response”) on 10^th January 2023 to which Mr Wailes replied on the 23 January 2023 (“the Appellant’s Reply”).

FOIA provides that any person making a request for information to a public authority is entitled to be informed in writing if that information is held (section 1(1)(a) FOIA) and if that is the case to have that information provided (Section 1 (1)(b) FOIA).

These entitlements are subject to exemptions. The exemptions relating to the provision of information can be absolute by Section 2(2)(a) FOIA or qualified by section 2(2)(b) FOIA. Where an exemption is qualified it is subject to what is known as the public interest balancing test set out in section 2(2)(b) FOIA which is that “in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information”.

Section 40(2)(b) FOIA provides that any information to which a request for information relates is exempt if one of the three conditions in subsections (3A), (3B) or (4A) of section 40 FOIA applies.

Section 40(3A)(a) FOIA sets out the first of these three conditions. This makes the provision for personal data to be exempt if “disclosure of this information to a member of the public otherwise than under this Act (a) would contravene any of the data protection principles…”

By Section 2(3)(fa) FOIA if the exemption relates to this first condition in section 40(3A)(a) FOIA it is an absolute exemption and therefore does not require consideration of the public interest balancing test.

Section 3(4)(d) DPA defines processing as “disclosure by transmission, dissemination or otherwise making available”.

The Data Protection Principles are set out in the GDPR. Article 5(1) GDPR provides that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject….”

By Article 6(1) (f) GDPR processing of personal data is only lawful if and only if and to the extent that it is “necessary for the purposes of the legitimate interests pursued by….a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of the data subject which require protection of personal data….”

In the Bundle we see reference to the Environmental Information Regulations 2004 (“the EIR”). In our view the request for the name in this appeal is not included in the definition of “environmental information” in the EIR. In our view FOIA is applicable to this appeal and not the EIR.

The Appellant in his Grounds of Appeal raises several concerns. In summary he says:-

He concludes by saying that he wants to appeal based on four questions: -

The Commissioner’s Response asks that the Appeal be dismissed for the reasons set out in the Decision Notice. We summarise their position taken from the Decision Notice and the Commissioner’s Response as being: -

The Appellant’s Reply concludes with four questions.

The Bundle contained amongst other things correspondence passing between the Commissioner and the Council and the Appellant. We noted a letter from the Council to the Commissioner dated 27 October 2022 and a letter from the Appellant to the Commissioner received on the 24 September 2022.

In the Council’s letter reference was made to certain alleged concerns about the manner of the Appellant’s dealings with the Council and its staff. In the Appellant’s letter to the Commissioner he refers to a verbal exchange with an officer from the Council in which the Appellant reports that this officer accused him of “harassing his staff” and “being aggressive”.

Apart from these letters there was no relevant evidence on this point before us. While a Tribunal’s role is to be inquisitorial as the concerns raised did not form part of the Decision Notice we did not go further into what had been said and it does not form part of our Judgment.

By Section 58 FOIA the Tribunal’s role is to consider whether the Decision Notice is not in accordance with the law or if the Commissioner should have exercised a discretion differently. If the Tribunal determines the Decision Notice was not in accordance with the law or that a discretion should have been exercised differently it can allow the appeal or substitute a different Notice that could have been served by the Commissioner but unless these apply the Tribunal shall dismiss the appeal.

In this Appeal, which deals with the processing of personal data and the section 40(2) exemption, the Tribunal is not called upon to carry out a qualitative review of the process by which the Commissioner produced the Decision Notice nor seek to determine if the Council had some other motive for withholding the information requested as suggested by the Appellant.

The Commissioner’s position is that the information sought is personal data. In correspondence with the Commissioner the Appellant suggested that he did not seek personal data as he only wanted to know who created the drawing. In the Appellant’s Reply he asks “how can the publication of a name (alone) in connection with a piece of work, be unlawful?”

We note however in his Grounds of Appeal he says “Paragraphs 9 through 11 basically confirm that someone’s name is personal detail. I don’t dispute this; how could it be otherwise”.

Section 3(2) DPA defines personal data as “any information relating to an identified or identifiable living individual” and Section 3(3) DPA defines an identifiableliving individual as “a living person who can be identified directly or indirectly by reference to – (a) an identifier such as a name…”

Although the Internal Review refers to the drawing being the work of more than one person it does appear to us that ultimately in this case one identifiable living person could be said to be responsible for putting together the final version of the drawing concerned.

We are satisfied that the name sought is personal data.

The Appellant questions whether the act of releasing the name does constitute the processing of personal data. We are satisfied that a disclosure of personal data following a FOIA request for information would be transmission, dissemination or otherwise making it available and is therefore processing for the purposes of the GDPR by section 3(4)(d) DPA.

Responses to requests for information under FOIA are published and, as such, are available for the whole world to view; they are not exclusive to the Requester. Thus, while we note that the Request was to “…please tell me…” any information (including any personal data) provided in response to such a request is published to the world and not just the requester.

It follows that the exemption in Section 40(2) FOIA is engaged. This provides that a Public Authority is exempt from the requirement to publish personal data in response to a FOIA request if to do so would not be in accordance with the Data Protection Principles.

By Article 5(1) GDPR processing is to be carried out lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1)(f) GDPR provides that processing of personal data is lawful

“only if and to the extent that one of the following applies….

(f)

processing is necessary for the purposes of the legitimate interests pursued by……a third party except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject which require protection of personal data….”

Legitimate Interest

In the Decision Notice the Commissioner concluded that there is there is a legitimate interest in the accountability and transparency of the Council as regards the Council’s implementation of cycle lanes and its management of the cycle lane project.

In the Request, Grounds of Appeal and Appellant’s Reply Mr Wailes refers to concerns relating to the waste of time and public money and the performance of the Council on projects relating to cycle paths and drawings. He refers to a concern about concealment of information and argues that finding out the name allows there to be accountability and would prevent the concealment of “ineptitude and the waste of public money”.

We make no findings about Mr Wailes’ opinions on this subject. We do however accept that these concerns do amount to a legitimate interest held by Mr Wailes (and potentially others) and accordingly, we conclude that the Request is made in the pursuit of a legitimate interest.

To be lawful in accordance with Article 5(1) GDPR publication must be necessary in the pursuit of the legitimate interest. The Respondent referred us to the following decisions among others: -

Legal propositions taken from these decisions are reviewed in the decision of the Upper Tribunal in Goldsmith International Business School -v- The Information Commissioner and the Home Office [2014] UKUT 0563 (ACC) and relevant for this appeal include these: -

In the Internal Review the Council says that “The drawings are put together using information, designs etc from several officers. The officer putting together the final drawing is not responsible for the project in its entirety…..”.

We also see in an email from the Council to the Appellant of the 9 March 2022 that “A number of officers have input at various stages to the development and management of such highways schemes…”, The email continues “In relation to specific names of officers I don’t believe it appropriate to provide officers names who undertake relatively minor aspects of project development”.

The writer who signs off as “Head of Service Major Projects and Strategic Infrastructure” says he is happy to provide his name and that he has a greater knowledge and overview of the project and the strategic objectives”.

The Appellant in correspondence says “Someone drew the drawing and was responsible for the technical details therein. The information request was about who drew the drawing not who was involved in discussions about the project as a whole”

The Decision Notice (para 18) makes reference to the provision of the name of the senior person and says that this “has already fulfilled the legitimate interest…”

We do not know the name of the person who drew the drawing. We do not have evidence as to their actual level of seniority, their role or job description. We do not know if they do or do not have authority to place their name on such a drawing. We have no clear evidence as to how far they influenced the final version. We do know from the Council’s Reply that the person is an employee.

However, we conclude the person concerned was not a senior person at the Council or at least not as senior as the person whose name was provided to the Appellant. We also conclude their role with the production of the drawing was more akin to that of a compiler rather than creator.

While we have the Appellant’s opinion as regards the drawing, we do not know whether or not his opinion is shared by the person’s manager or more formally by the Council. Even if the Appellant’s opinion is shared by the Council (on which we have no evidence) we do not know whether the person whose name is sought is responsible for any errors especially as we conclude that the person concerned was carrying out more of a collating rather than a creative role.

We have no evidence to assist us on whether the person was asked to provide their name and refused or was not asked. Further we have no evidence as to what employees or at least this employee of the Council was told about the likelihood of their name being published as part of their role.

We do accept that it appears to be the case that plans and drawings such as these often do have a name added. As far as we know that might be the usual practice. We do not know why it is not the case here. It may have been an oversight or omitted on purpose or that as a matter of formality the person concerned was not in a senior enough role for them to have their name on the drawing.

In particular in light of Goldsmith at para 39 we take note of the provision to the Appellant of the name of the Head of Service. We have concluded that the Head of Service is in a more public facing role and more senior and would be better placed and able to assist the Appellant and others with the pursuit of the legitimate Interest than the person whose name is sought by the request. Provision of his name is an appropriate alternative measure which would meet the needs of any legitimate interest pursued.

For the reasons set out above we conclude that publication of the name of the person would not be necessary in the pursuit of the legitimate interest and therefore processing the personal data requested would not be lawful.

If we had found that processing by publication was a necessity, we would then have needed (1) to consider whether the interests or fundamental rights or freedoms of the person whose name is sought should override the necessary disclosure for the pursuit of a Legitimate Interest and then potentially (2) needed to consider the questions of fairness and transparency.

Our conclusions already reached about necessity would have been relevant here and we would have concluded in favour of the Respondent.

The Appellant suggests that consideration should have been given to schedule 2 DPA. He refers to the circumstances in which this schedule provides exemptions from GDPR. Schedule 2 DPA provides

However, the provisions of Schedule 2 DPA do not apply to the appeal because they refer specifically to the processing of data for a function listed in the Table in schedule 2 whereas in this appeal the processing would be specifically in response to a FOIA request.

For the reasons set out above, this appeal is dismissed.