Michael David Worssell v The Information Commissioner

The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of this Chamber’s Procedure Rules. 

The Tribunal considered an agreed open bundle of evidence comprising pages 1 to 177. The Tribunal also considered a closed bundle, comprising pages 1 to 4. For the benefit of the Appellant, we ‘gist’ the closed evidence as being the withheld information and correspondence which is revelatory of the withheld information.

This appeal concerns the Appellant’s request for information about the doctor who authorised his late mother’s cremation. This doctor was acting on behalf of Rushmoor Borough Council (‘RBC’), which is the relevant public authority for the purposes of the Freedom of Information Act 2000 (‘FOIA’) (Footnote: ¹). The Appellant explained that he needed these details in order to make a complaint to the GMC about the doctor’s conduct in authorising the cremation, which he regarded as non-compliant with the relevant rules and guidance.

The Appellant made his request to RBC on 26 July 2021 in the following terms:

RBC refused to provide the requested information initially on 15 November 2021 and, after an internal review, again on 22 July 2022, in reliance upon section 40 (2) of the Freedom of Information Act 2000 (‘FOIA’). The Appellant complained to the Information Commissioner.

The Information Commissioner issued a Decision Notice on 1 March 2023, upholding RBC’s reliance upon s. 40 (2) FOIA in refusing to disclose the requested information. The Appellant appealed to the Tribunal.

The Decision Notice concluded that the requested information was personal data because it related to and would identify a living individual. This meant that it was defined as personal data by s. 3 (2) of the Data Protection Act 2018 (Footnote: ²).

Having concluded that the information requested constituted personal data, the Decision Notice considered whether there was a lawful basis for processing it under article 5 GDPR, in particular with reference to principle (a): ‘lawfulness, fairness and transparency.’ The Decision Notice considered, in compliance with article 6 (1) (f) GDPR, whether there was a legitimate interest in the information requested, whether disclosure was necessary to meet that legitimate interest, and whether the individual’s data protection rights should outweigh those factors. It concluded that, although there was a legitimate interest in the information requested, this was a personal interest and not a wider public interest. It also considered that the doctor in question did not consent to the disclosure of the personal data. It observed that disclosure under FOIA is disclosure to the world at large, equivalent to putting the doctor’s details on its website. The Decision Notice weighed these factors and concluded that there was no lawful basis for RBC to disclose the information requested.

The Decision Notice also found that RBC had breached s. 10 (1) FOIA due to its delay in responding to the Appellant’s request. It required no steps to be taken.

S. 40 FOIA provides (where relevant) as follows:

Any information to which a request for information relates is also exempt information if—

the first, second or third condition below is satisfied.

would contravene any of the data protection principles, or

GDPR provides (where relevant) that:

S.40 FOIA is an absolute exemption so the public interest balancing exercise under s. 2(2) (b) FOIA is not a relevant consideration in this appeal.

The powers of this Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:

The burden of proof in satisfying the Tribunal that the Commissioner’s decision was wrong in law or involved an inappropriate exercise of discretion rests with the Appellant. The relevant standard of proof is the balance of probabilities.

The Appellant’s Grounds of Appeal dated 9 March 2023 rely on submissions that he has a legitimate interest in the requested information, and that disclosure is necessary because he cannot make a complaint to the GMC unless he can supply the doctor’s name and registration number.

The Respondent’s Response dated 2 May 2023 relies on the correctness of the Decision Notice. It is submitted that the Appellant could ask for the GMC registration number from the doctor directly and could complain to the GMC if they refused to give it. It is submitted that the doctor does not occupy a public-facing role and that their data protection rights outweigh the public interest identified by the Appellant.

The Appellant has submitted evidence in the form of a letter from GMC dated 25 July 2022 (bundle page A13), which confirms that he would need to supply a name and registration number in order to make a complaint to the GMC.

The Decision Notice correctly identifies that the requested information is personal data and carries out the relevant balancing exercise under GDPR article 6 (1) (f). However, we find that it reached an erroneous conclusion for the following reasons. Firstly, the consent of the data subject is a relevant consideration under article 6 (1) (a) but is not ordinarily also a relevant factor to be weighed into the balance under article 6 (1) (f). We note that the ICO’s own (non-binding) Guidance states that Public Authorities may consult the third-party data subject and that "If an individual has expressed concern about the disclosure of their personal data, you should carefully consider their reasons. You should weigh these against the identified legitimate interest in disclosure." However, the Decision Notice does not refer to any reasoned expression of concern, only that consent had not been given, so we find that it was erroneous to weigh the lack of consent into the article 6 (1) (f) balance in this case.

Secondly, we find that the Information Commissioner’s approach to the Appellant’s evidence of the GMC’s requirements was inappropriately dismissive, involving speculation about the likely conduct of the GMC which should not have been regarded as carrying more weight than the Appellant’s evidence.

We conclude that the doctor occupies a senior role for RBC which, whilst it may not be public facing, carries with it significant responsibility and that there is a public interest in transparency and accountability in relation to that role. We disagree that the Appellant’s interest was personal only. We therefore find that the Appellant had a legitimate interest in the requested information.

We also find that it was necessary to disclose the requested information for the purposes of enabling the Appellant’s complaint to the GMC. We accept the Appellant’s evidence in this regard. We have concluded that these factors should outweigh the doctor’s data protection rights in these circumstances.

Thus, we find that there is a lawful basis for processing the data by disclosing the information requested. In all the circumstances, we consider that the Decision Notice includes an error of law and accordingly, that this appeal should be allowed. We now make the substituted Decision Notice above.

We have also directed the joinder of RBC to this appeal. We do so pursuant to rule 9 of the GRC Rules (Footnote: ³). It is fair and just to do so because it enables us to direct the outcome set out in the substituted Decision Notice. It also confers on RBC the right to apply for permission to appeal.