Shamir Ahmed Ali v The Information Commissioner

The Tribunal apologises for the delay in promulgating this Decision.

This Decision concerns the Mr Ali’s appeal against the Information Commissioner’s Decision Notice dated 4 November 2022, in which the Information Commissioner found that the public authority (Birmingham City University - “BCU”) was entitled to rely on s40(1) and (2) Freedom of Information Act 2000 (“FOIA”) to withhold the the requested information.

The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“GRC Rules”)

The Tribunal considered an agreed open bundle of evidence comprising pages 1 to 37. The Information Commissioner only submitted an Open Hearing Bundle. He did not submit an application in accordance with the May 2012 Practice Note and Rule 14(6) of the GRC Rules to file a closed material bundle comprising the disputed information. We have not therefore seen the disputed material.

On 21 February 2022 Mr Ali wrote to BCU with the following request:

On 11 March 2022 BCU responded with the following information:

On 11 March 2022, Mr Ali wrote to BCU as follows:

On 16 March 2022, BCU responded to Mr Ali. the relevant part of BCU’s response is as follows:

On 16 March 2022, Mr Ali complained to the Information Commissioner. The Information Commissioner’s decision dated 4 November 2022 was that BCU were correct to withhold information under s40(2) FOIA.

Mr Shamir now appeals against that decision on the grounds that BCU have not answered the questions he has raised. He alleges that the Information Commissioner is biased against him because of his racial, religious, and sexual characteristics. He alleges that BCU are covering up incompetence, failings, and malicious practises.

In his response, the Information Commissioner submits that Mr Ali does not state why the Information Commissioner’s Decision Notice is not in accordance with the law nor how the Commissioner should have exercised his discretion differently. The Information Commissioner also strongly refutes the allegations of bias.

In his reply, Mr Ali says:

In his 4 November 2022 Decision Notice, the Information Commissioner decided that BCU were entitled to withhold information relating to staff suspensions from Mr Ali under s40(2) FOIA. This was on the basis that the information was (i) personal data, and (ii) that disclosure would contravene principle (a) of the data protection principles.

The Decision Notice went on to decide that Mr Ali’s request about details of why BCU undertook disciplinary measures against Mr Ali himself, was a request for personal data, which is exempt from disclosure under s40(1) FOIA.

The Decision Notice does not address BCU’s refusal to answer the requests in relation to the period 2010 to 2018 on the grounds that the information “is not readily available in recorded form”.

“Principle (a)” of the data protection principles is set out in Article 5(1)(a) UK GDPR (“GDPR”) as follows:

Article 4 GDPR defines personal data as follows:

“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Further amplification of this definition is found in Recital 26 GDPR:

The guiding principle to Recital 26 is “data should be such as not to allow the data subject to be identified via ‘all’ “likely” and ‘reasonable’ means”, and “clearly sets a very high standard”.

Personal data is a relational concept: data in the hands of one individual may not be personal data, where in the hands of another individual holding additional relevant data, it would be personal data: per Cranston J. in Department of Health v Information Commissioner [2011] EWHC 1430 (Admin).

When considering identifiability in the context of FOIA it must be borne in mind that FOIA disclosure is disclosure into the public domain (“the world at large”).

Thus the “identifier” presumed by the GDPR may be any other person in the public domain, not just the requester. This could plainly include complete strangers to the data subject but also friends, family, colleagues, and enemies to the data subject.

In regards this latter category, the Upper Tribunal has previously utilised the concept of the “motivated intruder” to assist in consideration of means likely to be used by a third party to seek to identify data subjects, who would have a number of routes and tools to do so (per Information Commissioner v Magherafelt District Council [2012] UKUT 263 and Miller v Information Commissioner [2018] UKUT 229).

The correct question formulated by Judge Markus in Miller (adopted and approved in NHS Business Services Authority v. Information Commissioner & Spivack [2021] UKUT 192) was: “Whether a person can be identified taking account of ‘all means reasonably likely to be used’?”.

In Miller the key issue was whether public authority was permitted to redact “small numbers” data concerning a few individuals from within a larger data set. Paragraph [28] of Miller holds that the threshold for the likelihood of indirect identification was “greater than remote.”

It is apparent from the responses given by BCU to Mr Ali that there were 15 suspensions since 1 January 2019, seven of which involved individuals who subsequently returned to work. We find that it is more likely than not, given the small number of individuals that have been suspended by BCU since 1 January 2019, that BCU were correct to state that if they provided the reasons for those individuals’ suspensions, those individuals would be capable of being identified.

However, the fact that the individuals in question are capable of being identified does not of itself mean that the information is exempt from disclosure under s40(2) FOIA. For the information to be exempt, BCU (and the Information Commissioner when making his decision) must go on to consider the three gateway questions: (i) whether there is a legitimate interest in disclosing the information, (ii) whether disclosure of the information is necessary, and (iii) whether these interests override the rights of the individuals whose personal information it is. They must then weigh the answers to those questions against the fundamental rights and freedoms of the individuals.

In this case, the Information Commissioner went on to ask himself these gateway questions. Whilst the Information Commissioner was satisfied that Mr Ali had a legitimate interest in the disclosure of the information, namely to show whether BCU had followed its own policies and procedures in this case, he found that disclosure was not “necessary”, as there were alternative and less intrusive means available to Mr Ali of achieving his legitimate aim. Further, disclosure under FOIA is disclosure to the world at large (and not just to the requestor), and would be equivalent to BCU publishing personal disciplinary data on all media platforms and websites. This led the Information Commissioner to reach the conclusion that disclosure would be unlawful, and in contravention of Article 5(1)(a) GDPR, therefore he did not go on to consider whether disclosure would be fair and transparent. He found that BCU were correct in applying the exemptions in s40(2) FOIA.

The Information Commissioner determined that there is insufficient legitimate interest to outweigh the fundamental rights and freedoms of the individuals in this case. The Information Commissioner considered that there is no legal basis for BCU to disclose the requested information, and it would thus be unlawful to do so. In summary the Commissioner supported BCU’s entitlement to rely on section 40(2) FOIA to refuse to provide the requested information.

Section 40(1) FOIA provides that:

In his Decision Notice, the Information Commissioner decided that Mr Ali must obviously know whether he had been subject to suspension or disciplinary action, and that details of why BCU took any disciplinary action against him would be Mr Ali’s own personal data. Requests relating to personal data must be made under the Data Protection Act 2018 as a subject access request. In summary the Commissioner supported BCU’s entitlement to rely on section 40(1) FOIA to refuse to provide the requested information.

The Information Commissioner’s Decision Notice did not address the refusal of BCU to provide relation to the period 2010 to 2018 on the grounds that the information “is not readily available in recorded form”.

The rights of persons under FOIA relate to requests for “information” of a public authority. “Information” is defined in s84 FOIA as “information recorded in any form”.

Section 12(1) FOIA provides that a public authority is not obliged to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit. The relevant appropriate limit to this case is £450 (see the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulation 2004 (SI 2004 No 3244)). This exemption was not cited in BCU’s response.

Mr Ali’s grounds of appeal are that the Information Commissioner is biased against him because of his racial, religious, and sexual characteristics. He alleges that BCU are covering up incompetence, failings, and malicious practises.

However, Mr Ali does not particularise in what way the Information Commissioner is biased, or why the decisions set out in the Decision Notice are wrong in law. There is nothing in the Decision Notice or other material that suggests any bias on the part of the Information Commissioner and his staff, and there is nothing in his decisions (insofar as they relate to the exemptions in s40 FOIA) that would suggest that they are wrong in law. As regards Mr Ali’s complaint as to why his request for information has been denied, we find that the reasons are set out in the Information Commissioner’s Decision Notice.

For the above reasons we determine that the Information Commissioner was right to conclude that the public authority was entitled to withhold the requested information insofar as it relates to information created on or after 1st January 2019. We have concluded that it would not be lawful to disclose the information to the world at large and that the exemptions at section 40(1) and 40(2) FOIA have been appropriately applied.

The only error that is apparent to us in relation to the Decision Notice relates to the absence of any decision relating to the refusal by BCU to provide information created prior to 1 January 2019. In claiming exemption from disclosure on the grounds that

We conclude that there is an error of law in the Decision Notice for this reason. To this extent, the appeal succeeds in part (although not in relation to grounds advanced by Mr Ali).