Case Reference: EA-2023-0109
Information Rights
Heard in GRC Remote Hearing Rooms, Leicester: on the papers
CORRECTED UNDER RULE 40 ON 22 NOVEMBER 2023
Before
TRIBUNAL JUDGE A. MARKS CBE
TRIBUNAL MEMBER A. CHAFER
TRIBUNAL MEMBER K. GRIMLEY-EVANS
Between
PAUL ROLLESTON
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Representation:
The Appellant: in person
The Respondent: Richard Bailey
Decision: The appeal is dismissed.
REASONS
Introduction
This is an appeal against the Information Commissioner’s decision notice IC-177886-B5H5 dated 1 February 2023. That notice set out the Commissioner’s reasons for concluding that Kent Police were entitled to refuse the Appellant’s request for information, relying on section 40(5) of the Freedom of Information Act 2000 (‘FOIA’).
Both parties agreed to the Tribunal making its decision by considering all the papers in the case. The Tribunal was satisfied that it could properly determine the issues in this case without an oral hearing.
The requests for information, internal review and responses
On 2 June 2021, the Appellant (AB) wrote to the Police follows:
‘A reference has been made to an e-mail chain of correspondence between Derbyshire Constabulary and Kent Police in arranging the arrest of [a third party, identity redacted] and out of which several disputes have arisen concerning:
a) Grounds for reasonable suspicion
b) Doubts as to the reliability of information used by the OIC
c) The necessity to arrest
d) The lawfulness of the arrest
e) The hostile attitude and behaviour of Kent Police officers in making an arrest during which I was assaulted
f) Inordinate timescale.
…
To clarify the situation, I now request details of the entire correspondence between Derbyshire Constabulary and Kent Police. The likely time period could be from March 2020 to 15th September 2020 when the arrest was made.
I also request copies of the Custody Log and explanations as to what and why certain decisions were made e.g. detention at Tonbridge Police station and the time of day to execute the arrest.
Similarly, I also request details of the ‘Disclosure’ Information.’
Kent Police responded the following day, 3 June 2021, stating that they could neither confirm nor deny that they hold the requested information, citing section 40(5A) and (5B) FOIA.
AB wrote to Kent Police on 31 July 2022 (over a year later) asking for an internal review.
Kent Police replied on 4 November 2022 explaining that the request for internal review fell well outside the 40 working day deadline of which AB had been informed in the original response. Kent Police said they would therefore not be conducting such a review.
The Commissioner’s investigation and Decision Notice
On 15 December 2022, the Commissioner notified Kent Police that a complaint had been received from AB about the handling of the request for information.
On 1 February 2023, the Commissioner issued Decision Notice IC-177886-B5H5 which in summary concluded that Kent Police correctly applied the relevant provisions of FOIA to ‘neither confirm nor deny’ that it holds the requested information.
Appeal to the Tribunal
On 27 February 2023, AB sent a Notice of Appeal to the Tribunal challenging the Commissioner’s Decision Notice.
The papers available to panel and the parties are set out in paragraph 17 of this decision.
The Law
Section 1(1) FOIA: general right of access to information held by public authorities
Public authorities’ duty to disclose information to members of the public is set out in section 1(1) FOIA. This provides that if anyone requests information from a public authority, he (or she) is entitled to be told in writing whether the public authority holds the information and if so, to have that information communicated to him (or her).
Section 40(5A) and (5B) FOIA: personal information
Section 40(5A) FOIA prohibits a public authority from providing information which is the requester’s own personal data, or even confirming (or denying) that it holds such information.
Section 40(5B)(a)(i) imposes a similar prohibition about a third party’s personal data – and also provides that a public authority cannot even confirm or deny whether it holds that personal data if to do so would breach data protection principles.
Section 3(2) Data Protection Act 2018 (‘DPA’): Personal data
Section 3(2) DPA defines personal data as ‘any information relating to an identified or identifiable living individual’.
Section 11 DPA: Special categories of personal data
Section 11(2) includes ‘the alleged commission of offences by the data subject’ as information known as ‘criminal offence data’ which is given special protection by the UK’s data protection laws.
Sections 57 and 58 FOIA: the role of the Tribunal in deciding appeals
Once the Commissioner has issued a decision notice, either the public authority or requester can appeal to the Tribunal. If the Tribunal decides that the decision notice was wrong in law, or that the Commissioner ought to have exercised his discretion differently, the Tribunal will allow the appeal or substitute another decision notice as applicable. Otherwise, the Tribunal will dismiss the appeal. When considering an appeal, the Tribunal can make its own findings of fact.
Evidence
The Tribunal has been provided with a Bundle of the parties’ written evidence and arguments comprising 197 pages including an Index.
Submissions
AB’s arguments in his Appeal Notice dated 27 February 2023
In the Appeal Notice, AB raises numerous issues which this Tribunal is unable to consider. This is because the Tribunal’s task is solely to decide whether or not the Commissioner’s Decision Notice was wrong either in law or whether the Commissioner should have exercised his discretion differently.
On those issues, in summary AB effectively says that:
The Commissioner was wrong to conclude that the requested information amounts to ‘personal data’; and
The Commissioner was wrong to conclude that the requested information is ‘criminal offence data’ such that Kent Police cannot even confirm or deny whether they hold it.
Submissions on behalf of the Commissioner in the Response dated 22 May 2023
The Commissioner argues that, in summary:
As the House of Lords decision in Common Services Agency v. Scottish Information Commissioner [2008] UKHL 47 made clear, ‘there is no presumption in favour of the release of personal data under the general obligation of FOIA’;
Whilst AB argues that the requested information is not personal data, and that information is not requested ‘about the case or identified or identifiable individuals. I know who the accuser and suspect are…’, the wording of the request makes clear that it seeks information relating to a named living individual.
As a result, were Kent Police to confirm – or even deny – that the requested information was held, that in itself would constitute personal data about that individual.
AB’s suggestion that ‘…the sensitive data could be redacted…’ and ‘personal information could be redacted, I don’t want it…’ would not get around this issue: the individual would still be identifiable because the data subject is identified in the request.
The request relates to an arrest, so any response by Kent Police would constitute information to the public about that individual’s arrest. Because of this, the requested information, if held, would amount to ‘criminal offence data’. Criminal offence data is particularly sensitive and is therefore specially protected by FOIA and data protection legislation.
Only if one of the specific conditions set out in the Data Protection Act are met can such information be disclosed – yet none of those conditions are met in this case, nor has AB identified any condition which applies.
Disclosing information in response to a FOIA request means that information becomes public: that is not the case if the information is released to an Independent Reviewer for an independent review as occurred in this case.
To avoid unintentionally revealing information in a response to an individual’s request by confirming that such information is held, section 40(5B) FOIA enables a public authority to ‘neither confirm or deny’ that such information is held. This was the exemption on which Kent Police correctly relied when responding to AB’s request.
In short, the Decision Notice was correct in law and the Tribunal should dismiss AB’s appeal.
The panel’s assessment
Turning first to the facts of this case.
The facts
Certain facts relevant to the panel’s decision are not disputed. They are as follows:
on 2 June 2021, AB requested information from Kent Police. The essence of the request is set out in paragraph 3 above;
the request identifies a living individual (redacted for the purposes of this decision as this decision will be published and therefore publicly available);
in response to AB’s request, Kent Police neither confirmed nor denied that it holds the requested information;
the requested information relates to the arrest of the identified individual;
AB states that the names of any individuals are neither wanted or needed (AB knows them already) nor is any sensitive or other personal information: as far as AB is concerned, those details can be redacted from any information provided in response to the request; and
Kent Police refused to review its original response on the grounds that AB’s request for it to do so was made too late (over a year after that response was given).
To the extent that other relevant facts are disputed, the panel has considered the parties’ evidence and arguments. The panel is satisfied that, more likely than not, the following facts are true:
the information requested relates to the arrest of an identified living individual for an alleged criminal offence;
because of this, the requested information is ‘criminal offence data’ as defined by UK legislation; and
criminal offence data can be disclosed only if one of the conditions in the legislation is met.
Error of law?
Because sections 40(5A) and (5B) FOIA (personal information) are ‘absolute’ exemptions to the duty to disclose, there is no public interest test (namely balancing whether the public interest in withholding the information outweighs the public interest in disclosing it). There is therefore no issue here of wrongful exercise of the Commissioner’s discretion.
The only issue for the panel in this case is whether the Commissioner made any error of law in his Decision Notice.
In the panel’s judgment, the exemptions in sections 40(5A) and (5B) FOIA do apply in this case and therefore the Commissioner made no error of law in the Decision Notice which reached the same conclusion.
The panel’s reasons are:
The information requested would, if held, reveal sensitive personal data about individuals.
Even a confirmation or denial that such information is held would reveal something personal about those individuals;
This is because any information provided in response to any FOIA request - or even a confirmation or denial that the information is held - is inextricably linked to the request for that information, which in this case identifies one individual and is made by another individual;
Because any response to a request for information under FOIA becomes available to the public at large, the identity of the person to whom that information relates can be deduced by referring to the original request;
It would make no difference to this reasoning if (i) the name of the individual, the requester and other identifying features were to be redacted from the information provided and/or (ii) only entirely impersonal and unidentifiable general information were to be extracted and provided to the requester;
Nor does it make any difference to the legal analysis that the name of the individual is already known to the requester or even to the public; and
Having carefully considered all the possible conditions laid down in the legislation which would enable disclosure of ‘criminal offence data’, the panel is satisfied that none of them apply in this case.
The panel senses AB’s frustration that the information sought has not been provided in response to the FOIA request, particularly as by Kent Police advised AB to make such a request. We accept that AB attaches importance to the information requested, and that AB obviously already knows the name of the individual because the individual is identified in the request. For the reasons we have already given, this does not alter the legal analysis that the law does not permit the requested information (if held) to be disclosed, nor even confirmation or denial by Kent Police that they hold such information (which in itself would reveal something about the identified individual and the requester). We appreciate that Kent Police’s ‘neither confirm nor deny’ response to AB’s request, and the Commissioner’s upholding of such response, may appear to be illogical and contrary to the spirit of FOIA.
However, the Tribunal’s task is not to critique the law as laid down by FOIA or indeed DPA but to apply the law as we have done in this decision.
Conclusion
For the above reasons, the panel is not satisfied that the Commissioner’s decision was wrong in law. Accordingly, the Commissioner’s Decision Notice is confirmed.
The appeal is dismissed.
No further directions are necessary.
Alexandra Marks CBE Date: September 2023
(sitting as a First-tier Tribunal Judge)
CORRECTED ON 22 NOVEMBER 2023 under Rule 40 GRC of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended)