Janna Linde v The Information Commissioner & Anor

Among many others, the Second Respondent (‘the University’) offers courses in social work.

The Appellant, Ms Janna Linde, who describes herself as being of Eastern European descent, has experience of working with the University’s social work students as a ‘Practice Educator’ (‘PE’). First-year and final year students undertake placements with Placement Providers (‘PPs’) lasting 70 and 100 days respectively. During their placements they are each allocated to a PE, who may be ‘on-site’ at the PP or ‘off-site’. PE’s may be assigned more than one student at a time.

Ms Linde approached the University with a view to undertaking PE work in the academic year beginning in October 2021, but no offer was forthcoming. It appears that she suspected that discrimination based on her racial or national origins was in play.

On 20 October 2021 Ms Linde sent a request to the University for certain information pursuant to the Freedom of Information Act 2000 (‘FOIA’). As already mentioned, the request was broken down into Part A (five elements) and Part B (seven elements). Part A was concerned with selection of PPs and Part B with selection of PEs.

The University responded on 24 November 2021, providing some of the information requested but declining the remainder, citing FOIA, s40(2) (personal information).

Following an internal review, the University notified Ms Linde on 30 December 2021 that it maintained its position.

On 4 January 2022 Ms Linde complained to the First Respondent (‘the Commissioner’) about the way in which her request had been dealt with. An investigation followed.

By a Decision Notice dated 14 September 2022 the Commissioner determined that the University had properly applied FOIA s40(2) to the disputed information.

By her undated Notice of Appeal Ms Linde challenged the Commissioner’s decision on a number of grounds. Her central contention was that the information requested did not constitute third party personal data.

An inordinate delay followed, apparently resulting from some insurmountable difficulty in delivering the notice of appeal to the Commissioner.

By an exceedingly brief Response dated 8 April 2024 the Commissioner resisted the appeal on the ground that it brought no new point or issue to the proceedings.

By an Order of Judge Hazel Oliver dated 10 August 2024 the University was joined as Second Respondent. The University resisted the appeal, although we do not appear to have been shown a formal response.

The appeal came before us in the form of a final hearing, held by CVP. Ms Linde attended, as did Ms Mitchison, the University’s General Counsel. The Commissioner did not attend, preferring to rely on his written case.

FOIA, s1 includes:

The general right under s1 is subject to a number of exemptions. By s40 it is provided, so far as material, as follows:

The data protection regime under the Data Protection Act 2018 (‘DPA 2018’) and GDPR applies to this case.

DPA 2018, s3 includes:

GDPR, Article 5 sets out the data protection principles. It includes:

Article 6, so far as material, provides:

The appeal is brought pursuant to the FOIA, s57. The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

Unlike the general run of information rights cases, the starting-point for the purposes of s40 is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded. At para 7 he commented:

It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, ‘necessary’ means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing exercise, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.

It is legitimate to consider at the outset the first part of (what is now) the Article 6 test (lawful processing), before addressing (if need be) the further elements of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20).

In current Guidance on Requests for Personal Data about Public Authority Employees (Footnote: ³), the Commissioner states (p13):

When the hearing began, the areas of contention were restricted to Requests A5 and B4, B5 and B7. However, following a useful exchange with the Tribunal, Ms Mitchison, rightly in our view, withdrew her resistance to the appeal in so far as it related to Requests A5 and B5. We agree with Ms Linde that there was no basis for the Commissioner’s finding that disclosure of this information was liable to result in any individual’s identity (or other personal data) being revealed. Accordingly, without objection from Ms Mitchison, we allow the appeal in relation to Requests A5 and B5, holding that the exemption under FOIA, s40(2) is not engaged.

As to Requests B4 and B7, we see the matter quite differently. B4 asks for the number of off-site PEs offering to take students in the year commencing October 2021 and the ethnicities of the students taken. B7 seeks the number of students allocated per off-site PE and the ethnicities of the PEs. Ms Linde’s simple argument that neither request asks for the identities of the individuals concerned misses the point. It is common ground that the numbers are small. In our judgment it is very clear that disclosure of this disputed information would enable the relevant students and PEs to be identified and would thus involve disclosure of their personal data. Accordingly, s40(2)(a) is satisfied.

Turning to s40(2)(b), it was not in question that the applicable data protection principle was that contained in GDPR, Article 5, para 1, read with Article 6, para 1(f). As we have noted, the duty of ‘lawful’ processing imports the requirement of ‘necessity’. In our judgment, there is no question of the processing of the personal data of third parties being ‘necessary’ in relation to the B4 and B7 Requests. We have two main reasons for our view. In the first place, Ms Linde has (as she told us) already come into possession of all the information which she has sought, some through material supplied pursuant to her request, some through disclosure in Employment Tribunal (‘ET’) proceedings brought by her against the University. In the circumstances, we are satisfied that her legitimate interest in access to all information sought by her Requests for the purpose of inquiring into and testing the University’s adherence to sound equality and diversity practices (Footnote: ⁴) has already been fully met notwithstanding the fact that she is constrained as to the use which she is free to make of the ET disclosure documents. The simple point is that the information has all been disclosed to her, one way or another. Secondly and in any event, we are satisfied that it could not possibly be said that any residual legitimate interest not yet satisfied could only be met by processing the personal data of third parties (see the Halpin case cited above). There is no need (meaning reasonable need) for any request in pursuit of Ms Linde’s legitimate interest to trespass upon the privacy rights of third parties. Rightly, she did not so argue.

The statutory bias favouring privacy rights over information rights makes this a very clear case in relation to the B4 and B7 Requests. The processing of personal data for which the Appellant contends would plainly be unlawful. Accordingly, these requests are for information which is exempt and the Commissioner was right to dismiss the complaint in respect of them.

It follows that the appeal must be allowed to the extent stated, but otherwise dismissed.