Stephen John Gullick v The Information Commissioner

This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“the FOIA”). The appeal is against the decision of the Information Commissioner (“the Commissioner”) contained in a Decision Notice (“DN”) dated 6 February 2023 (reference IC-194433-V2Q2), which is a matter of public record.

Full details of the background to this appeal, the Appellant’s request for information and the Commissioner’s decision are set out in the DN. The Appellant has requested information from Cottesmore Parish Council (“the Council”) relating to a letter which has been sent to the Council.

The Commissioner’s decision is that the Council is entitled to rely on section 40(2) (personal information) of the FOIA to refuse to provide the withheld information. The Appellant now appeals against the DN. The Commissioner opposes the appeal and invites the Tribunal to dismiss the appeal.

On 28 March 2022, the Appellant made the following information request to Cottesmore Parish Council on 28 March 2022:

“I am a joint tenant of plot number 29 of the Richard Westbrook Baker Allotment Site in Cottesmore.

Please could you send me a copy of the document specified below as coming from Oldham Marsh Page Flavell.

In the minutes of the meeting of the Parish Council held on 18 ^th October 2021, it is recorded at paragraph 115/21 Matters Arising, under the heading Update on Allotments and subheading – access to site through the Jubilee Gardens open space that:

‘In view of the letter from Oldham Marsh Page Flavell it was agreed to postpone the discussion of this item until a later meeting.’

I look forward to hearing from you.”

Section 1 FOIA – entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.

General right of access to information held by public authorities. Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.

Section 41 FOIA provides that :

(1)

Information is exempt information if—

(a)

it was obtained by the public authority from any other person (including another public authority), and

(b)

the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.

As to whether a breach of confidence is actionable, the elements of the cause of action were summarised by Megarry J in Coco v A N Clark (Engineers) Limited [1968] FSR 415,419 - “ In my judgment, three elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself, in the words of Lord Greene, M.R. in the Saltman case on page 215, must “have the necessary quality of confidence about it”. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it.

Reliance on s.41 FOIA constitutes an absolute exemption by virtue of s. 2(3)(g) FOIA and is therefore not subject to a public interest test under FOIA.

However, it is a defence to an action for breach of confidence that it was in the public interest to disclose the confidential information. Therefore, the Tribunal will carry out an exercise similar to the public interest test under FOIA, except that (i) the balancing exercise starts from the presumption that confidentiality should be maintained; and (ii) purely private interests in maintaining confidentiality can weigh against disclosure (Derry City Council v Information Commissioner, IT, 8 January 2006).

Section 40(2) of FOIA says that information is exempt from disclosure if it is the personal data of another individual and disclosure would contravene a data protection principle. Section 40(2) FOIA, so far as relating to the first condition under s.40(3A) (a) FOIA, is an absolute exemption by virtue of s.2(3)(fa) FOIA, and is therefore not subject to the public interest test under s.2(2)(b) FOIA.

The Commissioner investigated the matter and held that whilst the Council cited s.41 of the FOIA as its basis for refusing to provide the requested information, the Commissioner decided the Council is entitled to rely on section 40(2) (personal information) of the FOIA to refuse to provide the requested information.

Section 40(2) provides an exemption for information that is the personal data of an individual other than the requester and where the disclosure of that personal data would be in breach of any of the data protection principles.

Section 3(2) of the Data Protection Act 2018 defines personal data as: “any information relating to an identified or identifiable living individual.”

Whilst the Council cited section 41 of the FOIA as its basis for refusing to provide the requested information, the Commissioner considered whether the Council is entitled to rely on section 40(2) (personal information) of the FOIA to refuse to provide the requested information.

The two main elements of personal data are that the information must relate to a living person and that the person must be identifiable.

In this case, the Council has withheld a copy of a letter which was sent by solicitors to the Council on behalf of their client (“the withheld information”). The Commissioner has viewed the withheld information and is satisfied that it both relates to and would identify the solicitors’ client. He therefore considered that the withheld information falls within the definition of ‘personal data’ in section 3(2) of the DPA.

The next step the Commissioner considered was whether disclosure of this personal data would be in breach of any of the data protection principles. The Commissioner has focussed here on principle (a), which states: “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”

In the case of an FOIA request, the personal data is processed when it is disclosed in response to the request. This means that the information can only be disclosed if to do so would be lawful, fair and transparent.

When considering whether the disclosure of personal information would be lawful, the Commissioner must consider whether there is a legitimate interest in disclosing the information, whether disclosure of the information is necessary, and whether these interests override the rights and freedoms of the individuals whose personal information it is.

The Commissioner considered in this case, that the Appellant is pursuing a legitimate interest, and that disclosure of the requested information is necessary to meet that interest.

The Commissioner noted that the withheld information is referenced in the minutes from a public Council meeting held on 18 October 2021. However, the Council has explained to the Commissioner that whilst it referred to the withheld information in the Council meeting on 18 October 2021, the content of the letter was not discussed. Therefore, the Commissioner understands that the withheld information is not already within the public domain.

Furthermore, the Commissioner considered that the solicitors’ client has a strong and reasonable expectation that the letter which was sent to the Council on their behalf would remain confidential to them, their solicitor and the Council.

The Commissioner determined that there is insufficient legitimate interest to outweigh the fundamental rights and freedoms of the solicitors’ client. Therefore, he considers that there is no legal basis for the Council to disclose the requested information and to do so would be in breach of principle (a).

The Commissioner’s decision therefore was that the Council is entitled to rely on section 40(2) of the FOIA to refuse to provide the requested information. The Commissioner required no further action to be taken by the Council in relation to this request.

The Appellant in his Grounds of Appeal (“GoA”) argues: - “In reaching a decision (dated 6 ^th February 2023) based solely upon section 40 (2) of the Freedom of Information Act, when the Cottesmore Parish Council had relied upon section 41 of the Act and the complaint had made representations about the relevance and applicability of section 41, the Commissioner acted unlawfully/unreasonably in that he did not notify the complainant, in advance of publishing his decision, of his intention to proceed under section 40(2) and. further, did not invite the complainant to make representations to him as to the relevance and applicability of section 40(2). Having regard to the nature of the Decision which the Commissioner was making, he acted in clear breach of the ‘audi alteram partem’ rule”.

In relation to the ‘Principles of Data Protection’, the Appellant states; “ Good practice dictates “the processing (i.e. publication) of such personal data is necessary for - - - - -- the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests:. The Commissioner in paragraph 14 of his decision accepts that I have a legitimate interest.

The Appellant then argues that while he accepts that good practice dictates that a public body should consider the impact of their processing and whether this overrides the legitimate interest it has identified. The Appellant then invites the Tribunal to consider the relationship of the public body with the individual and to consider whether any data being considered is particularly sensitive or private. The Appellant invites the Tribunal to allow the appeal and invites us to: “- - - order Cottesmore Parish Council to disclose to me the contents of the letter from Oldham March Page Flavell referred to in the Minutes of the Council Meeting held on 18 ^th October 2021, as both the initiator of the letter and the writer of the letter cannot have had any belief that either its contents of any personal data contained in it were to remain confidential. As a plot holder I have a legitimate interest (recognised by the Commissioner) in the contents of the letter and there is nothing in the letter itself nor in the principles of Data Protection which mitigates against disclosure.”

The Commissioner in Response (dated 14 April 2023) argues the Grounds of Appeal do not disturb the DN and makes the following succinct points;

a)

The Commissioner notes that the Appellant raises issues with regards to the conduct of the Commissioner’s investigation. However, FOIA does not impose any procedural duties on the Commissioner in relation to his investigation of whether a public authority has dealt with a request in accordance with the requirements of Part I FOIA. The absence of any express procedural obligations in s.50 FOIA indicates that Parliament considered a detailed procedure to be unnecessary. As Davis J noted in British Broadcasting Corporation v Sugar [2007] 1 WLR 2583, at [52], “It must have been contemplated that the Commissioner would seek, so far as possible, to act speedily and informally”.

b)

“- - the First-Tier Tribunal’s jurisdiction under s.58 FOIA is to consider whether or not the Decision Notice is in accordance with the law; it has no jurisdiction to review the conduct of the Commissioner’s investigation. This was certainly the view of the Tribunal in the case of - Carins v IC EA/2009/0119 / 0102 (at [38]): “no jurisdiction exists entitling us to regulate or review the way in which an investigation is conducted. We may review the outcome of the investigation (in the form of the Decision Notice issued at the end of it) not the process by which it is conducted.””

c)

In any event, the right to a full rehearing on the merits by the FTT under sections 58(1)(b) and 58(2) FOIA cures any alleged procedural defect or breach of natural justice in the Commissioner’s investigation: see R v Visitors to the Inns of Court ex parte Calder [1994] QB 1 per Stuart-Smith LJ at 59C: “... in my opinion an appeal to the visitors is or should be a full rehearing on the merits and as such it should cure any procedural defect or breach of natural justice on the part of the tribunal ....” . See also R (DR) v St George’s Catholic School Head Teacher [2002] EWCA Civ 1822 at [37]. The FTT is not limited to identifying errors of law in a Decision Notice: it may review any finding of fact or the exercise of any discretion on the merits. Section 58 FOIA therefore grants the FTT jurisdiction to reconsider, if it sees fit, all relevant factual matters that are in dispute, and it routinely does so: see Guardian Newspapers & Brooke v Information Commissioner EA/2006/0011 & 0013 at [14].

d)

With regards to the substantive issue of the Commissioner’s decision regarding the application of s.40(2) FOIA it was entirely appropriate for the Commissioner, as the regulator of the Data Protection Act 2018, to consider the engagement of the exemption in circumstances where the withheld information clearly engaged the exemption. The Commissioner also considered the Council and Appellant’s submissions, albeit in the context of s.41 FOIA, and therefore had sufficient information to come to his decision.

e)

The Commissioner maintains that the withheld information would identify, and represents the views of, the data subject and that there would have been a reasonable expectation that the correspondence would remain private in the context of the contentious issues regarding access to the allotments. The Commissioner maintains that there is an insufficient legitimate interest to outweigh the rights of the data subject.

f)

Accordingly, the Commissioner submits that the appeal should be dismissed for the reasons given in the Decision Notice. The Appellant has failed to set out why the Commissioner’s Decision Notice is not in accordance with the law or that the Commissioner ought to have exercised his discretion differently. Should the Tribunal disagree with the Commissioner’s findings with regards to the application of s.40(2) FOIA it would be necessary for the Tribunal to consider the engagement of s.41(1) FOIA as the Tribunal is seized of this matter (Information Commissioner v Malnick & ACBA [2018] UKUT 72 (AAC).

While the Tribunal acknowledge, accept and adopt the Commissioner’s reasoning in paragraphs 7 to 19 DN, and as set out in the Response at §23 above we have conducted a full rehearing on the merits under sections 58(1)(b) and 58(2) FOIA.

Personal data cannot be disclosed if it would contravene the data protection principles.  Those principles are set out in Article 5 of the GDPR, of which Principle (a) is relevant and sets out that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject".

For disclosure of personal data to be lawful under FOIA and EIR, the consent of the data subject must have been provided (under Article 6(a)) or it must be within the legitimate interests of any party (under Article 6(f)).

No positive evidence has been submitted from the data subject to state that it does not want the letter to be published more widely.  An indication of the data subject's wishes can be considered through the context of the request though. Here a private letter drafted by a solicitor regarding matters of a private nature regarding which the Council not only did not discuss the letter in a public forum, but cancelled discussions of the broader issues in a public forum.  The inference is that this issue is considered a private matter, or at least not a public matter. 

Article 6(1)(f) points to a three-step test for consideration when assessing a legitimate interest basis for processing: a) what is the legitimate interest in the disclosure; b) is the disclosure necessary for that purpose; and c) does the legitimate interest outweigh the interests and rights of the individual?  If the answer is "no" to any of those questions, then there cannot be a legitimate interest in its disclosure.

The legitimate interest in disclosing this material is the general requirement for transparency in public life.  At a meeting of the Council in April 2021, it was agreed that plot holders should be allowed to access the allotment site via a specific gate.  In July 2021, the Council were concerned that the procedure agreed was not being adhered to and was to be placed on the agenda for discussion at the August meeting.  There were meetings on 4 August and 16 August 2021, when it was agreed that the arrangement could continue.  The question of access via the Green Space Gate was then specifically listed for the agenda of the meeting to be held on 18 October 2021.  By virtue of its repeated reference in several Council meetings and being listed as a specific agenda item in October 2021, the issue of the Green Space Gate was evidently a matter of public concern that is or was to be discharged by examination and discussion in a public forum.

Discussion of the gate on 18 October 2021 was adjourned following receipt of the letter specifically stated to have been received from a firm of solicitors called Oldham Marsh Page Flavell and that it had been sent on behalf of a resident relating to "various issues in connection with allotment holders accessing the allotment site via the Jubilee Gardens Open Space" .  The examination and discussion in a public forum were therefore delayed and/or prevented as a result of the contents of the letter.  It is certainly arguable that disclosure of the letter is therefore necessary for the purpose of public scrutiny and transparency.  However, the argument as to public interest is starker in relation to the broader issues in play regarding the proper route of access to the allotments, rather than this narrower issue of the public interest of disclosing the contents of this specific letter.  There is clearly a lesser public interest in disclosing the disputed information – the letter.

The final issue is one of balancing the legitimate interests identified with the interests and rights of the data subject. 

Insofar as the disputed information could be said to have contained confidential information,  the reference by the Clerk to the Council in the published agenda potentially waives any such confidentiality, given that: (a) it refers to the letter having been sent by a firm of solicitors; (b) it is stated to relate to access to the site through the Jubilee Gardens open space; (c) the reference is made in the context of an ongoing discussion about the open space, the conduct of plot holders, and the relative views of the owners of properties facing the open space itself; and (d) it is of sufficient relevance to the issue under public examination that the discussion at the Council meeting needs to take into account its contents before it can usefully be undertaken.  It is difficult to foresee how the Council could refer to the letter with such specificity as to its relevance and contents in these terms, refer to it as justification for not publicly examining an item previously considered important for public examination, and continue to discharge its obligations of transparency.  This is the only route to seek disclosure of this information.

Nevertheless, and in the context here of the wider issue of the proper route of access to the allotment being of public interest and under appropriate public scrutiny, we find that, on the balance of probabilities, the balancing test falls in favour of non-disclosure of the letter on the basis that it contravenes the data protection principles.

There are clear arguments in each direction.  Public authorities must be held to public scrutiny and a level of transparency must prevail.  Neither the Council nor the data subject, or its solicitors, have sought to flag the letter more clearly in question as explicitly being of a private nature.  For example, there is no suggestion in the evidence before us that the data subject itself considered this material to be confidential.  In these circumstances, one might conclude that the natural inclination of a public authority would or should err on the side of transparency.  Nevertheless, we find the correct burden to consider here is on the balance of probabilities and we find that it is more likely than not that this letter is private, should be considered private, and that its disclosure would be a breach of the individual's privacy rights and a contravention of the data protection principles. In our view, this is what the Council have properly done.

We have carefully read the Grounds of Appeal and on the material facts and evidence before us and determine as follows;

a)

We find the Appellant has a legitimate interest in the requested information and has said that he believes he knows the data subject’s identity and wants official confirmation of it. Disclosure of the data subject’s identity would assist him to pursue his concerns about this, across multiple agencies.

b)

However, disclosure under FOIA is to the world at large. The Tribunal is of the view that data subjects have a clear and strong expectation that their personal data will be held in accordance with data protection laws (and can be presumed to have unless otherwise declared). The Tribunal considers that the data subject in this case would have a reasonable expectation that their identity would not be released to the world at large by means of an FOI request. We find that the data subject has a strong expectation of privacy relating to the requested information and in any event as disclosure is not proven necessary, the data subject’s consequent loss of privacy would be disproportionate and unwarranted.

c)

Furthermore, while the Tribunal accepts that the Appellant is pursuing a legitimate interest, we do not consider that, in this case, disclosure of the withheld information is necessary to meet that legitimate interest. There are other formal channels through which the Appellant could pursue his concerns, which would not necessitate the disclosure of the data subject’s identity to the world at large.

d)

The Tribunal therefore considers that it would be an intrusion of privacy and could cause unnecessary and unjustified distress to the individual and that there is an insufficient legitimate interest to outweigh the rights of the data subject.

e)

Further and in the alternative, the Tribunal are of the view that the disputed information is held by the requested public authority by virtue of it being contained in a document, placed in the custody of a person conducting an inquiry or arbitration, or in a document created by a person conducting an inquiry or arbitration for the purposes of the inquiry or arbitration (see [33] above). The fact that the disputed information is in a solicitor’s letter, sent on behalf of the data subject, indicates this is applicable and indicates implied confidentiality.

f)

In any event we do not accept that the absence of a formal “Private and Confidential” or such like warning statement is a condition to the standard required for such confidentiality in the circumstances pertaining in this case as set out above.

g)

The Tribunal acknowledge each case is determined on its own merits and in this case, we find the Appellant’s legitimate interest alone is insufficient to demonstrate that disclosure of the requested information would be lawful within the data protection principles.

h)

The Tribunal has therefore determined that disclosure of the data subject’s personal data would be unlawful and in contravention of data protection principle (a), as set out under Article 5(1)(a) of the UK General Data Protection Regulation.

i)

As disclosing the data subject’s personal data would be unlawful, section 40(2) is engaged. The Tribunal’s decision is therefore that the Commissioner was entitled to apply section 40(2) of FOIA in the DN and the Council are entitled to rely upon this exemption.

j)

The Tribunal find the position in relation to the UK GDPR is that it does not go to disturb the conclusion that section 40(2) of the FOIA and the data protection principles under the UK GDPR are the correct sections/regimes under which to consider whether the requested information in this instance can be properly disclosed. Further, the Tribunal finds that Articles within the Declaration and Convention, insofar as they relate to receiving a fair trial are not relevant in this instance.

k)

The Tribunal find that any disclosure of personal data under the FOIA must be in accordance with the relevant data protection principles as this is the context in which the disclosure is set rather than, for example, in criminal or civil cases where different laws, rules and considerations apply.

Accordingly, and for all the above reasons we dismiss the appeal.

We wish to thank the Appellant for his presentation at the hearing of this appeal and we accept his bona fides. In the circumstances while we are not required to consider, and do not make a finding on whether the Council can rely on the exemption provided at s.41 (information provided in confidence) of the FOIA, we comment, obiter, with a view to compliance of Rule 2 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 and the overriding objective and parties' obligation to co-operate with the tribunal in order to assist the parties in any further potential dispute. In an attempt to restrict time and costs in any such further dispute, we suggest consideration of all the reasons set out above whereby; it could be argued that the withheld information itself meets the criteria, in that: a) it does have the necessary quality of confidence about it, b) t he information was imparted in circumstances importing an obligation of confidence and c) There would be an unauthorised use of that information to the detriment of the party communicating it. Reliance on s.41 FOIA constitutes an absolute exemption by virtue of s. 2(3)(g) FOIA and is therefore not subject to a public interest test under FOIA however; it could be argued that the public interest is in favour of withholding the disputed information, as arguably for all the above reasons the balancing exercise starts from the presumption that confidentiality should be maintained and purely private interests (as discussed above) in maintaining confidentiality can, and in this case arguably do weigh against disclosure. It might also be argued; that any public interest in disclosure is minimal while the public interest in withholding because of the arguments in favour of maintaining confidentiality could be said to be significantly greater.