Iseabail Howat v The Information Commissioner

Whilst the email in which the request is made does not identify the appellant’s landlords by name, the Landlords can be identified from other information in that email, namely that it is the appellant’s landlords, known to the appellant and others living nearby, and the reference to location (Portchullin Bridge).

The Commissioner accepted in his decision notice that the appellant has a legitimate interest in confirmation or denial that the requested information is held and did not dispute Network Rail’s acceptance that confirming whether it holds the information in question is necessary to meet a legitimate interest. The Commissioner accepts that there are no less intrusive means of the appellant obtaining confirmation or denial that the information in issue is held.

The appellant argues that when balancing the legitimate interests, the Commissioner should have weighed into the balance “…actual wrongdoing when Network Rail contracted only with the landlords and not all the lawful owners which would have included the crofters. Network Rail failed to get lawful permission to use the road”.

The Tribunal is not able to decide upon whether there has or has not been any wrongdoing on the part of Network Rail. In any event, a simple confirmation or denial that the disputed information is held would not meet such a legitimate interest.

The appellant further argues that: “When a publicly funded company fails to take account of primary legislation which resulted in a group of people being denied the rights the legislation was put in place to protect and caused them losses it is more likely than not to be a matter of public interest. Positive changes could result from this to ensure other crofting communities…are protected from the same thing happening to them”.

The Commissioner maintains that whilst there may be a legitimate interest of the appellant and a small number of others living nearby in confirmation or denial that the disputed information is held there is not a sufficiently wider interest in such a confirmation or denial to outweigh the interference with the data subject(s)’ interests or fundamental rights and freedoms. The Commissioner considers that it would be disproportionately intrusive to reveal personal data by confirming or denying to the public as a whole whether the disputed information is held.

The appellant states that complaints have also been made to Network Rail and the Landlords by non-crofting households. None of the households along the road have had mail delivered since the road was damaged. Access time to a defibrillator has been extended. Emergency response times (for vehicles that can get under a low bridge) will be delayed. This is of concern to the whole community. All residents are happy to contribute towards repairing the road with an appropriate financial contribution from those who gained financially or from those responsible for the condition the road was left in.

The appellant submits that no-one who lives along the road was asked about the state the road was being left in when the contract with the Landlords was signed off. It was signed off only with the agreement of those who stood to gain financially from public funds at the expense of the crofters and their neighbours. Network Rail used the private road to access the Bridge without obtaining the consent of the crofters whose consent they required specifically. Network failed to engage with the crofters and all those who need to use the private road to access their property to discuss the weights they intended to carry over it contrary to their own published policy.

It is submitted that the road is a piece of infrastructure (like outbuildings and fencing) which was built by the crofters in the early 1970’s with financial assistance from the then Crofters Commission (now the Crofting Commission). At this time the then landlord agreed to the road being laid over the common grazing that was owned by him and is now owned by the Landlords. A basic interpretation of the legislation by crofters is that they own what is built on the common grazing (unless the landowners built it), they just do not own the land it sits on. The appellant submits that this shows that in not involving the crofters in what should have been a new tri-party contract as opposed to an extension to an existing contract with the landowners only that this would meet a ‘suspected wrongdoing’ test.

It is submitted that the appellant received an email from the Landlords indicating repairs were to be done by Network Rail who subsequently said their contract and business relationship with the Landlords ended 3 months before the date of this email (Appendix 5). This appears to show monies had been allocated either by Network Rail or the Landlords towards repairs to the road (Network Rail did say that there was nothing specific in the contract relating to the road). The appellant submits this is further evidence of ‘plausible wrongdoing’.

The appellant submits that the existence of a contract extension has been shared with the appellant by both Network Rail and the Landlords. It is reasonable to assume a payment was made given the contract extension. The amount paid was not shared. It seems clear that a financial contribution towards road repairs is somewhere, just not with the crofters or their neighbours.

The appellant submits that the crofters had a legal right to have been party to any contract concerning using their road and therefore they as well as the Landlords would have been provided the value of any proposed contract. This is further evidence supporting a suspicion of wrongdoing.

The appellant submits that the intent behind the Agricultural Holdings (Scotland) Act 1991 cannot be that Landlords would obtain payment from public funds for allowing, without the crofters’ consent, work to be undertaken by a third party which then caused significant damage to the infrastructure. Infrastructure that the burden of repair falls on the crofters (with support in the case of Portchullin from the non-crofting households). The road provides access to homes, was relied on for health and postal services and by the crofters to carry out their crofting duties.

It is acknowledged that the community is small, but it is an entire crofting community at Portchullin, plus the other crofting communities living on the final 15 miles of the Inverness to Kyle of Lochalsh railway line (at Strathcarron, Ardnaff, Portchullin, Plockton, Duirnish, Erbusaig and Badicaul), and any crofting communities between Inverness and Strathcarron or any crofting communities on the West Highland or North Highland railway. This would meet a wider public interest test.

The appellant submits that providing the information will allow the appellant to hopefully negotiate with the Landlords an appropriate amount of the public funds they are likely to have received as a contribution to the road repair.

The Environmental Information Regulations 2004 were original derived from European law and applied the provisions of Directive 2003/4/EC of the European Parliament and the Council on public access to environmental information. (Footnote: ³) The relevant parts of reg.13 are:

Regulation 13(5) EIR materially provides that:-

“(5A) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that –

(a)

The condition in paragraph (5B)(a) is satisfied or …

(5B) The conditions mentioned in paragraph (5A) are –

(a)

Giving a member of the public the confirmation or denial –

(i)

Would (apart from these Regulations) contravene any of the data protection principles , …”

A response neither confirming nor denying whether such information exists is referred to in this decision as a NCND response.

There is a presumption in favour of disclosure under the EIR under reg. 12(2). The result is that the threshold to justify non- disclosure is a high one.

Personal data is defined in s 3(2) of the Data Protection Act 2018 (DPA) as:

The definition of "personal data" consists of two limbs:

Whether the data in question "relate to" a living individual and

Whether the individual is identified or identifiable, directly or indirectly, from those data.

‘Identifiable’ means a living individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data (NHS Business Services Authority v Information Commissioner and Spivak[2021] UKUT 192 (AAC)).

The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA [2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.

In Durant, Auld LJ, giving the leading judgment said at [28]:

“Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.”

In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:

“It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.”

The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider:

“(2)

Does the data "relate" to an individual in the sense that it is "about" that individual because of its:

(i)

"Content" in referring to the identity, characteristics or behaviour of the individual?

(ii)

"Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?

(iii)

"Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)?

(3)

Are any of the 8 questions provided by the TGN applicable?

These questions are as follows:

(i)

Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller?

(ii)

Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession?

(iii)

Is the data 'obviously about' a particular individual?

(iv)

Is the data 'linked to' an individual so that it provides particular information about that individual?

(v)

Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?

(vi)

Does the data have any biographical significance in relation to the individual?

(vii)

Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?

(viii)

Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)?

(4)

Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?”

Article 5(1) UKGDPR provides that personal data shall be:

In order to be lawful, one of the lawful bases of processing in article 6(1) UKGDPR must apply. The only potentially relevant basis here is article 6(1)(f):

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:

We read an open and a closed bundle. The closed bundle contains information that would undermine the Council’s NCND response and therefore it is necessary for this information to be withheld from the appellant otherwise the purpose of the appeal would be defeated.

The issues under regulation 13 are:

The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

It is not in dispute that the EIR is the appropriate regime, and that would have been our conclusion in any event.

When considering what information would be revealed by an NCND response, we must take account of information that would be revealed either by a confirmation or by a denial.

The request is for the amount that was paid to only the Landlords on the ‘extension part of the contract’. We find that the information that would have been revealed by a confirmation that the requested information was held (‘the revealed information’) would have been:

We should note here that Network Rail may have issued a denial, but we have to take account of the consequences of either type of response. References below to the ‘revealed information’ should be read with that in mind, i.e. that it cannot be assumed on the basis of our decision that there was, in fact, any amount paid to the Landlords.

Although the existence of some sort of contract between Network Rail and the Landlords is already publicly known (since the work could not have proceeded without an agreement of some variety), we find that the revealed information is not in the public domain.

The appellant argues that the revealed information is not personal data given landlord/crofter duties and responsibilities and because the appellant should have been invited to be one of the parties to a contractual agreement. This argument is also relevant to the Landlord’s reasonable expectations of privacy, and we deal with it below.

The question of whether or not the revealed information is personal data is determined by asking if the information relates to an identified or identifiable living individual.

Data can 'relate to' the identifiable living individual, whether in personal or family life, business or profession. We do not accept that the statutory background of landlord/crofter duties and whether the appellant should have been a party to the contract are relevant to whether or not the revealed information is personal data. In our view the question of whether or not an amount was paid to the Landlords is clearly about the individual landlords.

The Landlords would, in our view, be identifiable from contextual information in the request, information publicly known by the local community and information released to the world by Network Rail in response to other freedom of information requests by the appellant.

For those reasons we find that the revealed information would be personal data.

When we consider the question of the legitimate interest in confirmation or denial, we accept that confirmation or denial acts as a gateway to the information itself, if held. For those reasons we consider it is also legitimate to take account of the legitimate interests in the information itself, if held.

The appellant submits that there is a legitimate interest in knowing the fee that was paid to the Landlords because:

We accept that all these amount to legitimate interests, without having to make any ruling on whether or not Network Rail were guilty of any wrongdoing, which is outside our jurisdiction.

We can understand that the appellant would like to have the information to use as a ‘negotiating lever’ in her discussions with the Landlords, and it is understandable that the crofters do not wish to incur additional expense in seeking a legal remedy. We do not accept that it is reasonably necessary for the appellant to know if the Landlords received a fee, and if so, what that fee was, for the purposes of seeking or negotiating a fair contribution to the costs of repair. The crofters can do this without that knowledge. The fee for a contract is not the same as compensation for damage. We accept that knowing the fee might add to the crofters’ ammunition, but it is not, in our view, reasonably necessary. For those reasons it is also not reasonably necessary to achieve the legitimate interests of getting the road repaired. The road can be repaired without this knowledge.

The crofters might wish to avoid the costs of legal proceedings, but if they are correct that their rights have been breached, then it is likely that legal avenues would be available to them. Those legal avenues a likely to include provision for disclosure of relevant documents whether pre-action or during the proceedings. The appellant or the crofting community are not prevented from enforcing their legal rights by not having access to the requested information.

Further, if there has been wrongdoing by Network Rail, they can be made accountable for this through other avenues.

For example, at the relevant time the appellant was pursuing a complaint to the independent complaints assessor who was able to consider whether Network Rail should review the relationship between crofting legislation and common law and the implications for any future works on land used by crofters. Although the outcome of that complaint was not available at the relevant time, we note that the assessor was also able to make a recommendation that Network Rail ask its own lawyers to undertake that review, and that Network Rail had confirmed that it would do so.

Another avenue pointed out to the appellant by Network Rail is that it is open to the crofters to make a claim for compensation against Network Rail, if they have damaged a road owned by the crofters. There are likely to be other legal avenues available if the crofters’ legal rights have been breached.

In contrast, we find that revealing publicly whether or not Network Rail paid these particular Landlords a fee for this contract contributes very little, if anything, to Network Rail’s accountability for any wrongdoing and contributes very little, if anything to transparency in relation to any wrongdoing. We find that disclosure would not be reasonably necessary for those purposes.

For those reasons, whilst we accept that there are a number of legitimate interests, we do not accept that disclosure is reasonably necessary for the purposes of those interests.

For that reason, subject to the next paragraph, confirming or denying that the information was held would have contravened one of the data protection principles.

We note that Network Rail accept that confirming whether or not they hold the requested information would be reasonably necessary for the specific narrow interest of the public investigating whether, if a fee was paid under this contract, that public money was spent responsibly. They accept that confirming or denying would be reasonably necessary for those purposes because there is no other means for the public in general to know whether a fee was paid and if so, what that fee was. This is not a legitimate interest relied on by the appellant. However, we accept that there is a legitimate interest in general transparency in relation to any spending of public money, and for that legitimate interest in relation to this specific expenditure we find that it is reasonably necessary to know whether that money was spent and how much money was spent.

Because we have found that disclosure is not reasonably necessary for most purposes, we do not need for those purposes to go on to consider if the legitimate interests are overridden by the fundamental rights and freedoms of the data subjects. If we had had to consider this issue, we would have concluded that they were overridden. In summary, this would have been for the following reasons.

We note in particular the following:

Taking all that into account, we would have concluded that the Landlords would have had a reasonable expectation that their personal data would not have been made public. In addition, we find that there is some risk of distress for the reasons set out in the closed annex.

Given the limited value of the revealed information and the requested information, if held, in serving the legitimate interests, we would have found that those legitimate interests were overridden by the fundamental rights and freedoms of the data subjects.

We turn now to the general interest in transparency in relation to the spending of this particular amount of public money, in relation to which we have accepted that confirmation or denial is reasonably necessary. We take account of the limited impact of confirming or denying on the wider public interest issues. Further, we note that the public has the ability to scrutinise the spending of public money more broadly through Network Rail’s Annual Report and Transparency pages and that Network Rail’s spending is scrutinised by the Regulator.

Taking into account the factors set out above in paragraphs, we find that the legitimate interest in transparency in relation to the spending of an isolated sum of money in relation to one particular contract is overridden by the fundamental rights and freedoms of the data subjects.

For those reasons, we find that confirming or denying that the information was held would have contravened one of the data protection principles and we find that Network Rail was entitled to give an NCND response.