David Howard obo Lee Howard v The Information Commissioner

The Appellant’s grounds of appeal set out more context to the Request and provided the Appellant’s views regarding his legitimate interest in the Requested Information, including related to his dissatisfaction with the quality of HCPC’s investigation into a complaint which had been made on behalf of his son. The Appellant stated that, on behalf of his son, they were “seeking accountability and openness” by HCPC and the Commissioner, requiring satisfaction that the HCPC registrant featured in the complaint had acted impartially and professionally in compliance with HCPC's member regulations. The Appellant believed that the Requested Information would show otherwise.

The material points in the grounds of appeal were (in summary) as follows:

In his response to the appeal, the Commissioner generally relied on the reasons given in the Decision Notice in support of his view that the appeal should be dismissed.

The material additional points made by the Commissioner were (in summary) as follows:

The Appellant provided some background information about another decision notice issued by the Commissioner relating to the Request, covering the response provided by HCPC under the DPA. The Appellant queried why two separate decision notices were issued, but also considered that this meant that the Decision Notice and the appeal could only be addressed in a restrictive manner.

In essence, the Appellant’s reply disputed the points made by the Commissioner in his response. Whilst acknowledging all of the contents of the Appellant’s reply, the material points made by the Appellant were (in summary) as follows:

The Appellant’s reply also set out further background information regarding the background to the Request and certain concerns of his regarding HCPC.

The powers of the Tribunal in determining the appeal are set out in section 58 of FOIA, as follows:

“(1)

If on an appeal under section 57 the Tribunal considers—

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2)

On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.

In summary, therefore, the Tribunal’s remit for the purposes of the appeal is to consider whether the Decision Notices were in accordance with the law, or whether any applicable exercise of discretion by the Commissioner in respect of the Decision Notices should have been exercised differently. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notices were based and the Tribunal may come to a different decision regarding those facts.

Section 1(1) of FOIA provides individuals with a general right of access to information held by public authorities. It provides:

“Any person making a request for information to a public authority is entitled—

(a)

to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b)

if that is the case, to have that information communicated to him.”.

In essence, under section 1(1) of FOIA, a person who has requested information from a public authority (such as HCPC) is entitled to be informed in writing whether it holds that information. This is known as 'the duty to confirm or deny'. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, all of those entitlements are subject to the other provisions of FOIA, including some exclusions, exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) of FOIA provides:

“Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.

It is therefore important to note that section 1(1) of FOIA does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.

Section 2(1) of FOIA is applicable for the purposes of this appeal, as a potential exclusion of the duty to confirm or deny pursuant to section 1(1)(a) of FOIA. Section 2(1) of FOIA provides:

“Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—

(a)

the provision confers absolute exemption, or

(b)

in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information,

section 1(1)(a) does not apply.”.

The effect of the above is that some exclusions of the duty to confirm or deny which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) of FOIA explicitly lists which of those are absolute. Pursuant to that section, no other exclusions are absolute. Section 40(5B) is not included in that list.

Accordingly, in summary, the applicable exclusion for the purposes of this appeal (in section 40(5B) of FOIA) is a qualified exclusion, so that the Public Interest Test has to be applied, even if that section is engaged.

So far as is relevant for the purposes of this appeal, section 40(5B) of FOIA provides:

“The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—

(a)

giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

(i)

would (apart from this Act) contravene any of the data protection principles…”.

Section 40(7) of FOIA sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:

To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f) of the UK GDPR).

Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information by a public authority under FOIA.

The first recital to the UK GDPR is also relevant. This provides: “The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.”. The second recital to the UK GDPR also includes the following: “The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”.

The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner (Footnote: ¹):

“(i)

Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii)

Is the processing involved necessary for the purposes of those interests?

(iii)

Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.

The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be: ‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’. This last question of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.

The approach set out above in the South Lanarkshire case was subsequently reiterated in the Upper Tribunal in the case of Goldsmith International Business School v Information Commissioner and Home Office (Footnote: ²). In the Goldsmith case, Upper Tribunal Judge Wikeley also provided further helpful guidance relevant to this appeal, setting out various propositions derived from the relevant case law. We refer to those propositions in more detail below.

We should make it clear that the relevant test is not the Public Interest Test, but rather the Legitimate Interests Test - and these tests are different. As explained by Upper Tribunal Judge Kate Markus QC (now KC) in the case of Information Commissioner v Halpin (Footnote: ³):

“At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”. FOIA creates a general right to information subject to the exemptions in section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:

“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.””

The Court of Appeal confirmed in the case of Birkett v Department for the Environment, Food and Rural Affairs (DEFRA) (Footnote: ⁴) that that a public authority is entitled to rely on new exemptions/exclusions on bringing an appeal before the First-tier Tribunal. This is so even if those exemptions/exclusions have not been raised by the public authority at an earlier stage (whether in its response to a request for information under FOIA, any subsequent review of that response or in its subsequent dealings with the Commissioner when the Commissioner is investigating a complaint relating to that request).

The Tribunal read and took account of an open bundle of evidence and pleadings. The Tribunal also read and took account of some separate ‘final’ submissions which were provided by the Appellant.

In his additional ‘final’ submissions, the Appellant provided some more background information relating to the Request and set out further concerns about the conduct of HCPC. The Appellant also reiterated that the Commissioner’s documents in the appeal only referred to FOIA and not the DPA. Material additional points made by the Appellant (beyond those already raised) were, in summary, as follows:

In his further submissions, the Appellant requested that the Commissioner instruct HCPC (and onward to its registrant member) to preserve all their files.

In accordance with the remit of the Tribunal to which we have referred, the fundamental issue which we need to determine in the appeal was whether the Commissioner was correct to conclude, in the Decision Notice, that HCPC could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny whether it held the Requested Information. Only if we determine that his decision was incorrect in that regard will we need to consider the potential operation of other sections of FOIA.

We wish to start by acknowledging that there a tragic background to this case, and we understand the Appellant's interest in the Requested Information.

We feel that we should reiterate the scope of FOIA and, in turn, the scope of the appeal. In very general terms, FOIA gives persons a right (with the caveats we have mentioned) to access certain information which is held by public authorities. The legislation does not exist to deal with any concerns which individuals may have about the actions or failings of public authorities. Likewise the role of the Commissioner and the Tribunal, insofar as FOIA is concerned, is to address matters relating to compliance with that legislation and not otherwise. The remit of the Tribunal (and indeed the Commissioner) is not to investigate or determine concerns which persons may have about a public authority’s standards.

The Appellant commented in his reply to the Commissioner’s response that the Tribunal and the Commissioner appeared to have no jurisdiction over HCPC’s investigation procedures and the Appellant’s other concerns in respect of the conduct of HCPC regarding complaints it investigates. That is indeed the case. Nor is it the role of the Tribunal or the Commissioner to advise the Appellant on “whether there are other avenues that might be followed to ensure the Public Interest is properly served”, which was a question he also raised in his reply to the Commissioner’s response.

The Appellant also commented on the separate response by HCPC to the Request under the DPA and the separate decision notice issued by the Commissioner in respect of that. As noted in paragraphs 23 and 24, the Tribunal’s powers in respect of the appeal apply in respect of the Decision Notice (namely, the specific decision notice of the Commissioner which is the subject of the appeal in this case). We have no jurisdiction to consider the issue of another decision notice and accordingly our comments below focus on the application of FOIA (as opposed to the DPA) to the Request, which is the applicable subject matter of the Decision Notice.

As we have noted, even if a public authority does not rely on certain exemptions/exclusions when refusing a request for information under FOIA (or on any subsequent internal review by it), it is entitled to rely on new exemptions/exclusions on bringing an appeal before the First-tier Tribunal. This is also the case in respect of the public authority’s dealings with the Commissioner prior to the issue of the Decision Notice. Whilst we recognise the Appellant’s frustrations regarding the change in HCPC’s position, it was nevertheless lawful for HCPC to rely on new exemptions/exclusions, even at a late stage.

In considering whether personal data is involved, the relevant definitions (as we have referred to in paragraph 32) apply. In the case of the Requested Information, it is clear from the Request that some personal data would relate to the Appellant (or his son) and, as we have noted, a response to the Request was provided by HCPC under the DPA in that regard. However, the Requested Information could also contain the personal data of third parties (including, in particular, the named HCPC registrant referred to in the Request). Therefore the application of section 40(5B) is not precluded.

We do not consider it necessary to explore each of the data protection principles. In the context of the appeal and the Requested Information, we consider that the most relevant data protection principle is that set out in Article 5(1)(a) of the UK GDPR, relating to (amongst other things) personal data being processed lawfully.

In assessing whether the processing of the personal data in question would be lawful, we also consider that the most applicable lawful basis for processing (in the context of the appeal and the Requested Information) is the Legitimate Interests Basis and that the Legitimate Interests Test is applicable.

It may be helpful to reiterate the Legitimate Interests Basis. It provides: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”. Translating that language to the context of this appeal:

Accordingly, in the case of a request for information under FOIA, where the information which is requested contains the personal data of a data subject then that personal data would be processed when it is disclosed in response to the request. As we have noted, in respect of the first data protection principle, this means that the information can only be disclosed if to do so would be lawful, fair and transparent.

Those principles also apply when a public body, in response to a request for information under FOIA, confirms or denies whether it holds the information which is requested. This is because it can be possible for inferences to be drawn from an acknowledgement of the fact that information is held or not held and consequently could constitute a disclosure of personal data. Accordingly, a public authority (as we have noted) can in some circumstances refuse to confirm or deny that it holds information, as an exclusion from the general duty to confirm whether or not it holds the information which has been requested. The aim of such a response (a ‘neither confirm nor deny’ response) is to leave entirely open the position about whether the public authority holds the information which has been requested, so that no inferences can be drawn either way.

Given the legal framework which we have outlined earlier, we consider that it is helpful to address the propositions from the Goldsmith case which we briefly noted above. As mentioned, in that case Upper Tribunal Judge Wikeley listed (Footnote: ⁵) various propositions derived from case law as to the correct approach to be adopted. We set out seven of those propositions below (some of which we paraphrase or otherwise summarise) and we address each in turn with regard to the facts of this appeal. For completeness, we should mention that Judge Wikeley also referred to an eighth Proposition in the Goldsmith case, but this related to tests which were applied in relevant case law and which does not alter the other seven propositions we refer to.

Applying the propositions is not a sequential process, in that some later numbered propositions need to be considered and determined before returning to earlier numbered propositions. Moreover, some earlier numbered propositions may be superfluous after applying later numbered propositions.

Proposition 1: The three questions set out in the South Lanarkshire case (as we have addressed above – namely, the Legitimate Interests Test) must be applied. Consequently:

Proposition 2: The test of “necessity” under the second of those questions must be met before the third question can be considered. Again, this requires us to turn to Propositions 3 to 5 (inclusive).

Propositions 3 to 5 (inclusive) all relate to the concept of ‘necessity’ and so we group them together before commenting on them:

With regard to those three propositions, we note that Lady Hale, in the South Lanarkshire case, stated that the word “necessary” must be considered in relation to the processing to which it relates.

We also note that, in the Halpin case, Upper Tribunal Judge Kate Markus QC (now KC) stated (Footnote: ⁶) that: “the Goldsmith guidance…makes it clear that the question whether there are alternative measures (proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it…”. In the more recent case of Kol v Information Commissioner and Reigate and Banstead Borough Council (Footnote: ⁷), Upper Tribunal Judge Edward Jacobs stated: “If there is another way of satisfying [the requestor’s] legitimate interests without disclosing the information, then disclosure is not necessary”. This principle would apply to confirming whether or not the information is held, as well as the disclosure of the information.

It is helpful to remind ourselves of the relevant wording from Lady Hale’s judgment in the South Lanarkshire (Footnote: ⁸) case, in respect of which Upper Tribunal Judge Edward Jacobs was commenting and which is the authoritative decision on the meaning of ‘necessary’ for current purposes:

“It is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15, [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”.

We consider that these principles (together with others from additional cases cited in the Goldsmith case) are encapsulated in the three propositions (namely, Propositions 3, 4 and 5). In our view, therefore (and taking into account the above comments of Upper Tribunal Judge Kate Markus KC in the Halpin case), we need to consider all three of those propositions in assessing whether or not the potential processing of the third-party personal data (namely, disclosure by way of confirming or denying if the Requested Information was held) was necessary for the purposes of the legitimate interests being pursued by the Appellant by way of the Request.

As noted, the legitimate interests being pursued by the Appellant are, essentially, for alleged wrongdoing of a HCPC registrant and alleged failures regarding HCPC’s complaints handling to be investigated and for there to be accountability where appropriate. In the facts of this appeal, we find that it is not necessary (within the meaning outlined in all three of those propositions) for there to be confirmation or denial as to whether the Requested Information is held in order to achieve those legitimate interests. This is because, in our view, those legitimate interests are fulfilled by the existence of subject access rights under the DPA (rights which, as noted, had been exercised by the Appellant), the existence of the HCPC complaints handling process (as outlined by the Commissioner in the Decision Notice) and potential other legal action which may be open to the Appellant outside of FOIA.

In light of the Request, the Appellant’s grounds of appeal and his subsequent submissions, the Appellant evidently considers that these other means of meeting his legitimate interests are insufficient. However, as already noted, it is not the role of the Tribunal to ascertain or opine on whether or not HCPC’s complaints handling process is flawed in any way or whether or not there has been any wrongdoing by a HCPC registrant.

As we have explained, the remit of the Tribunal is to determine whether or not the Decision Notice was in accordance with the law. In this regard, we remind ourselves that when a third party’s personal data is potentially involved in respect of any request for information under FOIA:

In addition, as set out in Proposition 5 (and taken from the judgment of Lady Hale in the South Lanarkshire case): “a measure would not be necessary if the legitimate aim could be achieved by something less”. The fact that there is something less which can achieve the Appellant’s legitimate aims is a relevant point in the appeal. Again, it is not for the Tribunal to determine the merits of, or other matters pertaining to, the ‘lesser means’ by which the Appellant’s legitimate interests may be met, but rather for us to take into account in our decision making (as part of our assessment of ‘necessity’, as we have outlined) whether or not there are other means by which those legitimate aims could be achieved.

Accordingly, we agree with the Commissioner’s position that confirmation or denial as to whether the Requested Information is held is not necessary to satisfy the legitimate interests of the Appellant.

At this juncture, we should return toProposition 2. As we have noted, this requires the test of “necessity” under the second of the questions in Proposition 1 to be met before the third of those questions can be considered. Given our finding that the processing involved is not necessary for purposes of the legitimate interests being pursued by the Appellant (that is, our answer to the second question is negative) then, in accordance with Proposition 2, we do not need to consider the third of the questions in Proposition 1. In other words, as we have reached the conclusion that, for the purposes of section 40(5B)(a)(i) of FOIA, the disclosure of personal data (by way of ‘confirmation or denial’) is not necessary and therefore the Legitimate Interests Basis is not satisfied, we do not need to go on to consider the Balancing Test between the legitimate interests of the Appellant and the rights and freedoms of third party data subjects.

Proposition 6: Where there are no issues regarding an individual’s privacy rights, the question posed under Proposition 1 can be resolved at stage (ii) of the three-part test referred to (that is, the question can be resolved at the ‘necessity’ stage of the Legitimate Interests Test). Clearly, the appeal involves issues regarding the privacy rights of individuals (namely, potential third-party data subjects) and therefore Proposition 6 is not applicable.

Proposition 7: Where there are issues regarding an individual’s privacy rights, the question posed under Proposition 1 can only be resolved after considering stage (iii) of the three-part test referred to - namely, the Balancing Test. For the reasons given, this appeal involves issues regarding the privacy rights of individuals (potential third-party data subjects). However, as we have stated, given the application of Proposition 2 and our findings on ‘necessity’, we do not need to consider the third of the questions in Proposition 1. Accordingly, Proposition 7 becomes redundant in the context of the appeal.

As we have noted, section 40(5B) of FOIA is not an absolute exclusion and accordingly the Public Interest Test must be applied. In that regard, we recognise (as did the Commissioner in the Decision Notice, albeit not in the context of the Public Interest Test) that there is a general, wider public interest in transparency around how medical professionals practice. We also recognise that there are public interests regarding the adequacy of the regulation of medical professionals and, specifically in this case, any alleged failings regarding HCPC’s complaints handling regime.

However, in our view the public interest in maintaining individual’s rights to privacy, based on the legal principles we have referred to, outweighs the preceding public interests. We view the principle of the protection of privacy with respect to the processing of personal data to be paramount. In this regard, we are mindful that disclosure of information under FOIA is disclosure to the world at large, which we comment on further below.

For all of the above reasons, we conclude that section 40(5B)(a)(i) of FOIA is engaged and that the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether HCPC holds the information. Accordingly, we find that HCPC could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information. It follows that we agree with the findings of the Commissioner in the Decision Notice in that regard.

Given that conclusion, it has not been necessary for us to consider the potential application of other exemptions under FOIA.

We note, however, that the Decision Notice did not address the application of the Public Interest Test and accordingly we find that it was flawed in that regard. We therefore agree with the Appellant’s submissions, insofar as applicable to this point, that the wider public interest had been disregarded by the Commissioner. However, this does not affect the outcome of the Decision Notice given that we have reached the same ultimate conclusion.

For completeness, we now briefly address any relevant remaining issues which were raised by the Appellant.

We acknowledge the Appellant’s comments that he knew the identity of the HCPC registrant in question and that the Requested Information, if disclosed to him, would not be disseminated more widely by him. However, disclosure of information under FOIA is, effectively, disclosure to the public (in other words, to the ‘world at large’). It cannot be restricted to a particular requester. Therefore this is not a reflection on assurances the Appellant would give about dissemination of the Requested Information but is simply how FOIA operates. It is for this reason that appropriate consideration and weight had to be afforded, in the application of the Public Interest Test, to the protection of individual’s privacy rights – namely, because disclosure of information under FOIA is disclosure to the general public.

Given the nature of the Requested Information, we consider that it could not be appropriately anonymised.

We have no jurisdiction to assess or determine whether or not there was any deficient or unfairness in the Commissioner’s investigation; the role of the Tribunal is not to conduct a judicial review of the Commissioner’s actions. However, we were able to undertake a ‘fresh review’ of the Decision Notice and had the ability to consider fresh evidence in accordance with our powers outlined in paragraphs 23 and 24.

The Commissioner’s remit extends only to certain matters relating to data protection, privacy and freedom of information legislation. Accordingly, we disagree with the submissions of the Appellant that it was the Commissioner’s duty to satisfy himself as to whether HCPC complied with its general obligations and professional requirements.

We have no jurisdiction to mandate that the Commissioner instruct HCPC (or others) to preserve their files.

For all of the reasons we have given, we conclude as follows.

Whilst we consider that the Decision Notice was flawed in not addressing the Public Interest Test, this does not affect the ultimate conclusion reached by the Commissioner in the Decision Notice. This is because, for the reasons we have given, we also find that HCPC could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information.

We therefore dismiss the appeal.