Stephen Campbell v The Information Commissioner & Anor

On 16 December 2020, Mr Campbell made a request to His Majesty’s Treasury (“HMT”) for information, pursuant to the Freedom of Information Act 2000 (“FOIA”). In full, it reads:

HMT’s response dated 18 January 2021 stated that the Review team was independent, and not part of HMT. While HMT had seconded staff to the Review team, that was a separate role. It further referred Mr Campbell to the terms of the review, providing that all the evidence it received would be destroyed at its conclusion. The document he sought would therefore no longer exist in any event. Mr Campbell requested an internal review, observing that the response was inconsistent with those in other related requests (Footnote: ¹). HMT maintained its position, so Mr Campbell complained to the Commissioner.

During the Commissioner’s investigation, HMT also sought to rely on section 12 of FOIA, which exempts a public authority from complying with a request if it estimates that doing so would exceed the relevant cost limit of £600.

In a Decision Notice (Footnote: ²) issued on 8 November 2022, the Commissioner agreed that HMT was able to rely on s.12. HMT’s case was summarised as follows:

The Commissioner noted that costs “other than staff time” could only be included in the estimate if it would be reasonable to do so. The Commissioner considered that inclusion of this cost to be reasonable in this case, because HMT “does not have any business need to access the mailboxes other than for the purpose of responding to this particular information request”. The actual cost of the work by the external contractor was not revealed, the Commissioner agreeing with HMT that it is commercially sensitive information, but it was confirmed to be in excess of £600.

As the Commissioner agreed that HMT had been entitled to rely on s.12, no consideration was given to the original basis of refusal.

Mr Campbell appealed to the Tribunal. Subsequently, HMT wrote to state that it had now located the requested information. Two files had been found dated 4 December 2019, one “time stamped” at 18:20, the other at 18:33. The draft reports they contain are identical. On 10 February 2023 it wrote to state that one or other of the documents was more likely than not the document that was provided as a hard copy to HMRC officials on 9 December 2019, so provided both. This was without prejudice to its position in this appeal that disclosure was not required under FOIA.

Mr Campbell was not satisfied with this disclosure. The two documents provided were not the original files, rather newly created PDF files: their metadata showed them to have been created on 8 February 2023 using the application “Acrobat PDFMaker 19 for Word”. Mr Campbell argued that his request had been for the original Word files, and requested that they be disclosed in unaltered form. In its reply on 24 February 2023, HMT refused to do so. It considered that provision of the PDF had satisfied the terms of Mr Campbell’s request, and gave further reasons why it did not consider it appropriate to disclose the Word files.

The appeal was heard by CVP, all participants connecting remotely. No adverse technical issues were encountered, and we are satisfied that the appeal was as fairly and effectively heard as if it had taken place entirely within a physical courtroom. Mr Campbell attended in person. Neither of the respondents were represented or in attendance, having previously confirmed that they were willing to rely on their written evidence and submissions. The documents to be considered were agreed to comprise:

HMT’s bundle contained two emails to the Commissioner, each of which specified the amounts that would be charged by the IT contractor. The figures are redacted on the basis of commercial sensitivity. A closed bundle had been provided to the Tribunal containing versions of the emails without that redaction. On 28 April 2023 a direction had been made under rule 14(6) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 that the Tribunal would hold that evidence without it being disclosed to any person other than the respondents. The reasons given for that order misdescribe the contents of the evidence, which we confirmed to Mr Campbell were as previously stated in this paragraph. Given that confirmation, and our agreement that the figures were indeed over £600, Mr Campbell was content that he did not need to see the actual figure. Applying the principles in Browning v Information Commissioner [2014] EWCA Civ 1050, we are satisfied that non-disclosure of the actual figures to Mr Campbell causes no unfairness and that withholding them is appropriate given their commercial sensitivity. For the purposes of this appeal, all that matters is that they are above the relevant limit.

We heard evidence and submissions from Mr Campbell and reserved our decision. The Tribunal extends its sincere apologies to the parties for the subsequent delay, arising from judicial workload.

In its correspondence of 24 February 2023 disclosing the PDF files, further reasons for refusing to disclose the Word files were given by HMT. They appear to be very contentious, and are extensively discussed in the parties’ written submissions. We cannot, however, see that they are relevant to the actual issues that arise in this appeal. The Tribunal’s role is described in Information Commissioner v Malnick and Anor [2018] UKUT 72 (AAC) at [45] and [90]. The question for us to decide is whether the provisions of FOIA have been correctly applied. In the respondents’ rule 23 Responses and subsequent written submissions, the sole basis upon which the duty to disclose does not apply is the exemption at s.12. That issue will be determinative. The initial claim not to hold the information has fallen away, as HMT now accepts that it has held the requested information throughout.

The dispute as to the provision of the PDF files will be relevant, however, to the terms of any substituted decision notice if the appeal is allowed, see Montague v Information Commissioner [2022] UKUT 104 at [76]. If providing the PDF files complied with the request, then no further steps need to be specified. For that reason, we do consider it appropriate to decide whether the terms of Mr Campbell’s request require the original Word file(s) rather than the (digital) printout he has received.

FOIA does not oblige a public authority to comply with a request for information if it estimates that the cost of compliance would exceed the appropriate limit. The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 set that limit at £600. The public authority’s estimate must be reasonable, in the sense of being sensible, realistic and supported by cogent evidence. Under regulation 4(3), it may only take account of the following activities:

The regulations then provide, at regulation 4(4), that:

So, in practice, the cost limit will be exceeded by over 24 hours’ estimated time spent on regulation 4(3) activities.

As held in Kirkham v Information Commissioner [2018] UKUT 126 (AAC), the test is subjective to the public authority but then qualified by an objective element. The Tribunal first makes findings as to the nature of the estimate made by the public authority. These will be related to the way in which the public authority holds the information; FOIA does not impose any particular record-keeping practices. The Tribunal may next remove from the estimate any amount which it considers unreasonable, either on account of the nature of the activity to which it relates or its amount. In performing its assessment, the Tribunal recognises that the statute’s use of the word ‘would exceed’ likely indicates a higher degree of certainty than if read ‘may’ or ‘might’.

At the time of its response to the request, and when the appeal was lodged, HMT considered that if the requested information existed anywhere, then it must be in the email mailboxes of the personnel who had worked for the Review team. An email to the Commissioner (our version is undated) states:

As already noted, we have been shown the unredacted version of this text and are satisfied that the cost would be in excess of £600. The signatory of the email has been redacted, even from our closed version, but in the email signature their job title is given as Head of Information Rights, Corporate Centre Group, HM Treasury.

HMT also relies on a second email from the same unidentified person, sent to the Commissioner on 11 August 2022. This responds to questions for more detail, and we set it out that part of the email in full:

This explanation was accepted by the Commissioner in his Decision Notice.

Since the appeal was lodged, HMT has discovered that it additionally held the requested information elsewhere. This is explained in its rule 23 Response of 27 February 2023 as follows:

None of the Commissioner’s submissions need setting out separately, and we shall record Mr Campbell’s submissions, so far as necessary, within our own consideration.

We find that s.12 is not engaged, for each of the following discrete reasons.

The work of the IT contractor must be estimated at £25 per hour

First, we consider that regulation 4(4) applies to the work to be done by HMT’s outsourced IT department. It must therefore be estimated at £25 per hour. The Decision Notice refers to it as “costs other than staff time”. But the wording of regulation 4(4) does not restrict itself to staff, employees or civil servants, rather to “persons undertaking any of the activities mentioned in paragraph 3”. Here, the day rate to the contractor would be paid to locate, retrieve and extract the requested information. It involves a human being sitting at a computer undertaking regulation 4(3) activities. The Commissioner’s relevant guidance (Footnote: ³) states that:

In the Decision Notice, the Commissioner appears to have treated the IT contractor as akin to an off-site storage facility. This is, we find, a misapplication of the regulations and the Commissioner’s own guidance. The cost of an outsourced IT contract no doubt increases with the types of work that come within its scope. The customer must carefully balance the risk of paying a greater up-front cost for services it might then not need, against the risk that out-of-scope work does later become necessary and incurs extra cost. Here, HMT chose to enter into an outsourcing contract that failed to include recovering old mailboxes and (although this is far from clear) may have forced it to then let the contractor do the rest of the job as well, being searching through the mailbox and extracting the data. This was work which could quite foreseeably have been necessary to comply with FOIA requests, especially if (as was again a decision taken by HMT) mailboxes were to be configured to become inaccessible to internal HMT staff upon the conclusion of the review.

We can further illustrate our reasoning on this issue by reference to a hypothetical public authority that outsources its entire FOIA function in return for a fixed annual cost. The operation of regulation 4(4) would be unaffected, the work being done by the contractor’s personnel “on behalf of the authority”. The public authority might be able to agree a lower annual cost with the contractor if it agrees that work on some particular types of requests, unlikely to arise in practice, will attract an extra hourly charge. That is a commercial risk on both sides. If it does arise, and the public authority is then charged by the contractor at £50 per hour, then the regulation 4(4) rate of £25 would doubtless still apply: the contractor’s personnel are still doing regulation 4(3) work on behalf of the public authority. Turning to the present situation, HMT claims to have arranged its affairs such that when the present circumstances arose, virtually all the regulation 4(3) work could only be done by outsourced IT personnel, in its own words – “administrative tasks associated with mailbox access and permissions are currently actively carried out by the Treasury’s IT service provider” – and at more than £25 per hour. We see no principled basis to distinguish this from the former, hypothetical, situation. There being no evidence before us to justify a finding that fulfilling the request would take the contractor over 24 hours, it therefore falls below the cost limit.

Finally, part of the Commissioner’s reasoning on this point was that “it is reasonable to include the cost, on the basis that HM Treasury does not have any business need to access the mailboxes other than for the purpose of responding to this particular information request”. Neither the regulations nor the guidance provides that a separate business need must be identified before the rate at regulation 4(4) applies.

For the above reasons, the comparison with retrieval from an off-site storage site is inapt. The estimate is comprised of activity done by human beings on the public authority’s behalf and which falls squarely within regulations 4(3) and 4(4), and which at the rate of £25 per hour would not exceed £600. This element of the appeal must be allowed on that basis.

The quote for accessing the mailboxes was misconceived

Second, and in the alternative, we accept Mr Campbell’s criticisms of the following passage from the HMT email of 11 August 2022:

But the “minimum charge of [redacted] set out previously” was not a minimum charge levied by the contractor for all bespoke work. It was the minimum estimated cost for searching for and retrieving the information. There is nothing in the earlier email on which the estimated cost was based, or elsewhere in the evidence, to justify a finding that simply granting another user access to an active mailbox would either fall outside the contractor’s non-chargeable obligations or attract a minimum charge of 1 day’s work. The mailboxes were still in existence even if their original users could not log in to them; in the words of the email, “[i]t would seem that a request was not raised to have the mailboxes deleted”. Granting another user access to an email mailbox is a very commonplace IT requirement in any workplace, and it is easy to think of some examples: compliance with FOIA requests frequently involves searching other users’ emails, for which access must be given; many managers will have had the experience of being given access to the email of a suspended or ill employee; and likewise, investigation of disciplinary proceedings and grievances will often require such access.

As observed in HMT’s further written submissions at paragraph 10(3), the degree of evidence required to prove a fact is a matter for the Tribunal. We agree with Mr Campbell that it would be extremely surprising if the mere granting of access to another user’s mailbox would be separately chargeable in a large government department, let alone in a sum that exceeds £600. The Tribunal would require clear evidence in order to reach such a finding. There is none before us. The contractor was never asked to grant access HMT staff access to the mailboxes, it was asked to search through them and retrieve the information. The cost of simply granting access to the mailbox was never obtained, even if it were chargeable in the first place.

While neither party has made the argument, we also wonder at the absence of any exploration of whether the mailboxes could have been exported by the IT contractor (for example as .pst files). These could then have been searched by HMT staff. While our conclusion does not rest on this point, the apparent failure by HMT to ever consider it does serve as a further illustration of the lack of care with which the estimate was reached, and the overall absence of any cogent explanation for why it was to be the IT contractor that did the searching and extraction.

There is no evidence that retrieving the information from the document library would be in excess of £600

While we acknowledge HMT’s compliance with its duty of candour by disclosing the existence of the ‘repository’ when it was subsequently found, we reject its argument that it does not affect our consideration of the appeal.

The repository is also described in the documentary evidence as a ‘depository’ or a ‘document library’, but it is clear that it was hosted on Microsoft SharePoint. We shall describe it as a document library. HMT argues in its further written submissions that this had not been identified at the time of the request because access was restricted to a small number of IT managers with high level access, and it was not part of their function to comply with FOIA requests. We cannot see how this assists HMT: first, the reasonableness of the estimate is plainly affected by an alternative source having been omitted; second, in virtually all FOIA requests the information is not directly held by FOIA compliance officers – it is their job to find it.

We agree with Mr Campbell that the document library should reasonably have been included as a possible source when estimating the cost of compliance. The document “Framework for interaction between the Independent Loan Charge Review, HM Treasury and Revenue & Customs during the review” dated 24 September 2019 stated:

Even if the use of a document library not been emblazoned on that document, we consider that any reasonable estimate in the present case would have taken into account whether a document library exists. It was ultimately found when one of the “high-privileged managers … ran an enterprise-wide search which identified the repository.” If that could be done now, it could and ought to have been done then. If it could not be done then because of the prevailing contractual arrangements, then this was outsourcing of the regulation 4(3) task of determining whether information was held and locating it, as already explained above. Insofar as HMT argues that only those high level managers could detect ‘segregated’ document libraries – the Review’s documents being segregated from others within HMT – we consider that this possibility ought reasonably to have been taken into account in forming the estimate and enquiries made.

As this panel can legitimately take notice, document libraries (whether on Sharepoint / Teams from Microsoft, or on its competitors’ equivalents) are now the routine way of storing information belonging to a particular team or project. The failure to take reasonable steps to determine whether there was a document library, and to then take it into account to produce an estimate, was unreasonable.

In its rule 23 Response and its further written submissions, HMT asserts that the cost of retrieval from the document library would, in any event, have been the same as was quoted in relation to the mailboxes. Even were reliance on the mailboxes not undermined for the reasons we give above, we would reject this entirely unevidenced and unexplained assertion. We are unable to simply make such an assumption in the absence of HMT providing (or, we infer, having themselves had regard to) any contractual, technical or other evidence that would support it. It is entirely plausible that the information could have been provided using the document library without exceeding the cost limit, and the failure to consider this fatally undermines the basis of HMT’s estimate.

For completeness, we also reject the unevidenced assertion that the “high level managers” would be unable to provide access to the contents of the document library to other internal HMT staff to conduct the actual searching and extraction, or that the external IT contractor could not have given such access, and must have done everything itself.

The public authority’s estimate must be reasonable, in the sense of being sensible, realistic and supported by cogent evidence. For each of the above reasons, HMT’s estimate is none of those things. Taking matters as at the time of HMT’s response to the request, we find that s.12 did not exempt it from compliance with s.1(1). The Commissioner’s Decision Notice to the contrary was therefore in error of law, and we allow the appeal.

While the Tribunal must decide the appeal based on the situation at the time of HMT’s response, when next considering what substituted decision notice to make (if any), regard can be had to the up-to-date position. If the requested information has now been provided then no substituted decision is necessary.

HMT first argues that the PDF copies it has provided fulfil Mr Campbell’s original request “asking for the electronic version of the document draft [that produced the hard copy]”. If Mr Campbell had requested an electronic version we might agree, but his request refers to the electronic version. It is clearly a reference to the Word file that was itself printed for the purpose of the meeting he mentions, even before the surrounding context of the request is taken into account. It is not enough to produce a different electronic version, really amounting to a photocopy in digital form, as providing the PDFs has done.

HMT’s next objection gives us more pause, being that it is “not willing to disclose the Word version in order to protect the personal details of other public officials who have accessed and worked on the document.” This concern arises, at least in part, from the way in which Mr Campbell had already used the metadata contained in the PDF files provided to him. We need not resolve the factual arguments between the parties, as our greater concern is that this part of HMT’s case really amounts to claiming that part of the requested information additionally attracts one of the exemptions at s.40 of FOIA concerning personal data. Yet HMT’s submissions do not acknowledge this, and it has never sought to formally rely upon a new exemption. While minor issues of redaction can be adjudicated upon when making a substituted decision notice, HMT appears to be arguing that disclosure is entirely inappropriate due to disclosure of the names concerned. That should have been be a freestanding ground for opposing the appeal, yet it has never been identified as such. Applying the overriding objective, and the treatment of this issue in Birkett v DEFRA [2011] EWCA Civ 1606 at [27] and [28], we do not consider it appropriate at this late stage, and without the issue having been properly raised, to decide a further exemption.

During the hearing, the panel explored with Mr Campbell whether the Word file could (in a technical sense) be disclosed while concealing the names of those who had worked on it. He did not think it could, because changing the metadata has the effect of changing one of the dates that he wishes to inspect. We asked whether he would be satisfied with all the metadata from the Word file being disclosed (for example by screenshot or by being exported to another file) and names redacted. He would not, because he does not trust HMT.

Our conclusion rests on the entitlement at s.1(1) being to have information communicated, rather than to inspect how it is held. If a person were to request a letter held in physical form, then a photocopy would usually suffice. It communicates all the information that the physical letter contains. FOIA does not entitle the requester to inspect the original letter. Yet even a physical letter might have a type of metadata. The requester might say “this is a black and white photocopy, and I need to know whether the letter was printed on white or blue paper”. In some circumstances, the colour of the paper may well be information about the letter itself and the requester would be entitled to have it disclosed. The entitlement is still only to the information however, and would be satisfied in those circumstances by providing a colour photocopy (or even by just telling the requester what colour the paper is). The information would have been communicated within the meaning of s.1(1)(b).

Nothing in s.1(1) entitles a requester to additional information in order to satisfy themselves that the information has been communicated honestly. The Information Commissioner and the Tribunal each have statutory powers to satisfy themselves that a public authority has complied with its obligations under FOIA, where they consider it appropriate to undertake that enquiry. Therefore, the only remedy available to a requester who believes that the information given is not the information actually held is to make a complaint to the Commissioner.

Applying those principles to the Word file(s) in question, s.1(1) only entitles Mr Campbell to the information it contains. It does not entitle him to the file itself. If Mr Campbell has the information contained in the Word file specified in his request communicated to him, including all its metadata unaltered from the time specified in his request, then HMT will have complied with s.1(1). The information can be communicated in any suitable format provided that it does communicate the information. It is a matter for HMT whether any of that information engages an exemption under FOIA, and should be redacted or even (which we anticipate will be unlikely) such as prevent any disclosure at all.

If Mr Campbell does not believe that any exemption has been correctly applied, or that the information given is false or misleading, then his remedy is to make a further s.50 complaint to the Commissioner: Smith v Information Commissioner (Information rights - Freedom of information - public authority) [2022] UKUT 261 (AAC). The Commissioner can then investigate that complaint to the extent he considers appropriate, and issue a Decision Notice against which there is a further right of appeal.