Andrew Sheldon v The Information Commissioner & Anor

The relevant material points raised in the Appellant’s grounds of appeal were (in summary) as follows:

The Appellant’s grounds of appeal also stated that the decision notices cited by the Commissioner (in paragraph 35 of the Decision Notice) did not provide support for his conclusion in the Decision Notice.

In his response to the appeal, the Commissioner generally relied on the reasons given in the Decision Notice in support of his view that the appeal should be dismissed.

The Commissioner also provided some further background information in his response to the appeal, to the effect that the Appellant was the former leader of the Council and that, by virtue of that position he was aware of information that may not otherwise be publicly available.

The material additional points made by the Commissioner were (in summary) as follows:

In its response to the appeal, the Council gave more details on the background relating to the Appellant, stating that he was an elected member of the Council between 2010 and 2022 and that he was the leader of the Council from May 2021 but lost his seat at the local elections in May 2022.

The Council’s position was, in essence, that the Decision Notice was correct for the reasons set out in it.

The Council acknowledged that the Request, if it was read in isolation and without regard to any wider context, did not explicitly seek disclosure of information about disciplinary proceedings relating to officers of the Council. However, it considered that the “motivated intruder” test applied (from the perspective of a “determined person with a particular reason to want to identify the individual”) and accordingly that it was necessary to consider that person’s background or prior knowledge.

The Council submitted that the Appellant, by virtue of his position as the former leader of the Council, has a great deal of background and prior knowledge which he could use to work out whether or not disciplinary proceedings had been instigated against specific, identifiable officers of the Council. The Council’s position was therefore that the Commissioner was correct to conclude that compliance with the Duty to Inform would result in the disclosure of personal data.

The Council also submitted that the Commissioner was correct in deciding that only the Legitimate Interests Basis provided a relevant lawful basis for disclosure and that the remaining lawful bases in Article 6(1) of the UK GDPR were not applicable. In respect of the Balancing Test, the Council’s view was that the Commissioner was correct in concluding that the balance came down in favour of protecting the legitimate interests and fundamental rights and freedoms of the data subjects, even though the Commissioner did not expressly deal with the arguments raised by the Appellant as to the effect of the statutory code in Part VA of the LGA (Footnote: ²) in his consideration of the Balancing Test.

Elaborating on its submissions in respect of the Balancing Test, the Council argued that:

The Council also submitted that the Council’s compliance with duties under the LGA was outside of the remit of both the Commissioner and the Tribunal, and accordingly that the Appellant’s reliance on the statutory code in Part VA of the LGA was overstated and would not affect the overall outcome of the Balancing Test.

In his reply to the Commissioner’s response, the Appellant:

In essence, the Appellant considered that:

The Appellant re-asserted that:

In his reply to the Council’s response, the Appellant accepted that the Legitimate Interests Basis would apply but stated that it must be in the legitimate interests of the Council to release the Requested Information, given that the Council was required by law to release it under the LGA.

The Appellant submitted that factors which must be considered in the Balancing Test included:

The Appellant disputed that releasing the Requested Information, or complying with the Duty to Inform, would reveal whether any one individual had been subject to disciplinary proceedings. The Appellant asserted that, even if it did, it would only be releasing information which the Council was required to publish in accordance with its publication scheme and the LGA.

With respect to the safeguards referred to by the Council regarding the privacy of individuals (see paragraph 25.d), the Appellant contended that there was no difference between publication or inspection under the Council's publication scheme or under the LGA and release under FOIA. The Appellant submitted that it would produce an “absurd result” if release under FOIA was a breach of the UK GDPR in circumstances when release of the same information under the publication scheme or LGA is not.

The powers of the Tribunal in determining the appeal are set out in section 58 of FOIA, as follows:

In summary, therefore, the Tribunal’s remit for the purposes of the appeal is to consider whether the Decision Notice was in accordance with the law, or whether any applicable exercise of discretion by the Commissioner in respect of the Decision Notice should have been exercised differently. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts.

Section 1(1) of FOIA provides individuals with a general right of access to information held by public authorities. It provides:

In essence, under section 1(1) of FOIA, a person who has requested information from a public authority (such as the Council) is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, these entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) of FOIA provides:

It is therefore important to note that section 1(1) of FOIA does not provide an unconditional right of access to any information which a public authority does hold, nor an unconditional right even to be told if the information is held by the public authority. The rights contained in that section are subject to certain other provisions of FOIA, the relevant aspects of which we address below.

Section 2(1) of FOIA addresses potential exclusions to the Duty to Inform. That section provides:

Accordingly, where any exemption in Part II of FOIA applies then it negates the duty of a public authority to confirm or deny whether or not it holds information which is requested. This means the public authority is permitted to neither confirm nor deny that it holds the requested information.

Pursuant to the provisions of section 2(1) of FOIA, some of the exemptions to the Duty to Inform set out in Part II of FOIA are absolute and some are subject to the application of a public interest test. Where an applicable exemption is not absolute and the public interest test applies, this means that a public authority may neither confirm nor deny whether or not it holds requested information under that exemption if the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether it holds the information (this being the ‘Public Interest Test’ referred to in this decision).

Section 2(3) of FOIA explicitly lists which exemptions in Part II of FOIA are absolute. Pursuant to that section, no other exemptions are absolute. For the purposes of this appeal, the relevant exemption is contained in section 40(5B) of FOIA and that section is not included in that list.

Therefore the relevant exemption referred to in the Decision Notice (section 40(5B)(a)(i) of FOIA) is subject to the Public Interest Test.

So far as is relevant for the purposes of this appeal, section 40(5B) of FOIA provides:

Section 40(7) of FOIA sets out applicable definitions for the purposes of section 40, by reference to other legislation. For the purposes of this appeal, the relevant points are as follows:

With regard to the First Data Protection Principle, for any processing of personal data to be lawful, it must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…” (Article 6(1)(f) of the UK GDPR).

Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA, meaning that the Legitimate Interests Basis can be taken into account in determining whether the First Data Protection Principle would be contravened by the disclosure of information by a public authority under FOIA.

Certain recitals to the UK GDPR, set out below, are also relevant.

The first recital to the UK GDPR provides:

The second recital to the UK GDPR states:

Recital 26 to the UK GDPR includes the following:

The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner (Footnote: ³):

The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be: ‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’. This last question of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.

The approach set out above in the South Lanarkshire case was subsequently reiterated in the Upper Tribunal in the case of Goldsmith International Business School v Information Commissioner and Home Office (Footnote: ⁴). In the Goldsmith case, Upper Tribunal Judge Wikeley also provided further helpful guidance relevant to this appeal, setting out various propositions derived from the relevant case law. We refer to those propositions in more detail in our discussions below.

We should perhaps make it clear that the relevant test in this context, the Legitimate Interests Test, is different to the relevant public interest test arising under FOIA. As explained by Upper Tribunal Judge Kate Markus QC (now KC) in the case of Information Commissioner v Halpin (Footnote: ⁵):

In the case of O’Hanlon v Information Commissioner (Footnote: ⁶), it was held that the public interest test under FOIA (for the purposes of this appeal, the ‘Public Interest Test’) required the following three-step approach:

The public interest test under FOIA is applied as at the time when the public authority refused disclosure of requested information; it cannot be re­assessed later, in the event of an appeal to the First-tier Tribunal, by reference to any public interest which has subsequently arisen (see, for example, the case of Maurizi v Information Commissioner and another (Footnote: ⁷)).

The Upper Tribunal case of The Information Commissioner v Miller (Footnote: ⁸) considered the case law on the question of whether an individual is capable of being identified indirectly. In that case, dealing with the question of whether personal data was ‘anonymised’, Upper Tribunal Judge Kate Markus QC (as she was then) helpfully summarised the relevant authorities as follows (Footnote: ⁹):

The Tribunal read and took account of an open bundle of evidence and pleadings. We also read and took account of a closed bundle and some final written submissions from the Appellant. The Tribunal also received, during the hearing, a separate bundle of authorities from the Council together with an article from a law firm regarding statutory officer disciplinary investigations.

We heard oral submissions from the Appellant and from Mr Lewin on behalf of the Council. The submissions from the Appellant and Mr Lewin generally addressed and elaborated on the points raised in the grounds of appeal and the response to the appeal, respectively.

A separate closed session (without the Appellant in attendance) was also briefly held, where certain submissions were made by Mr Lewin on behalf of the Council. A gist of the separate closed session was subsequently prepared by the Council and provided to the Tribunal and the other parties.

In accordance with the remit of the Tribunal to which we have referred, the fundamental issue which we needed to determine in the appeal was whether the Commissioner was correct to conclude, in the Decision Notice, that the Council could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny whether it held the Requested Information.

This means we needed to determine:

In considering whether personal data is involved, we remind ourselves (with regard to the relevant definitions referred to in paragraph 45) that ‘personal data’ means “any information relating to an identified or identifiable living individual” and that an ‘identifiable living individual’ means “a living individual who can be identified, directly or indirectly…”.

The fact that personal data includes information relating to someone who can be identified “indirectly” is a pertinent point in the appeal. The Commissioner and the Council have both referred to the ‘motivated intruder’ test. As we have noted, the applicable principles of that test have been confirmed in case law. Those principles essentially relate to the possibility that a person (the ‘motivated intruder’) would be able to identify individuals to whom any disclosed information relates, including a determined person who will use additional means to try to identify the individual. As referred to in recital 26 to the UK GDPR:

Summarising the above, where a person could, using means which are reasonably likely to be used (taking into account all objective factors), identify an individual to whom any information relates, then that information will constitute personal data.

Hypothesising that the Requested Information is held by the Council and that there are individuals which are the subject of it, we find that the Appellant would be able to identify those individuals. This is because of his particular knowledge as a former leader of the Council and the proximity of his holding of that position and the dates applicable to the Requested Information (the Requested Information covering a two-week period in August 2022, with the Appellant being a leader of the Council until May 2022). In that regard, there is no need to consider further means (with regard to the ‘motivated intruder’ test) which the Appellant could use to identify the individuals. In other words, we find that the ‘motivated intruder’ test is easily satisfied in the current circumstances, taking into account the Appellant’s previous role and the associated knowledge that he has.

We accept that the Request did not expressly refer to information about disciplinary proceedings relating to officers of the Council. However, we find that the Appellant would have relevant background knowledge as to the timings of when such disciplinary proceeding were likely to have taken place and when they were likely to be subsequently reported to relevant committees. This would mean he could ascertain whether or not disciplinary proceedings had been instigated against individual officers of the Council.

Given our finding that the Appellant would be able to identify the relevant individuals from the Requested Information, it follows that we must find that the Requested Information comprised personal data (as per the definition of ‘personal data’).

We also find that the act of pursuing a disciplinary process would itself have the potential to reveal personal data, regardless of the outcome of that process (namely, whether or not any identifiable individual was ultimately disciplined or exonerated). It follows that if no disciplinary process was instigated then this would also be capable of revealing personal data (in the sense of showing that no disciplinary action was taken against an identifiable individual). Consequently (and taking into account that any applicable individuals would be identifiable because of the Appellant’s knowledge), we find that confirming or denying that the Requested Information was held would disclose personal data.

Therefore we find that the application of section 40(5B) is not precluded in respect of the Request and that that section is therefore capable of being engaged.

We do not consider it necessary to explore each of the data protection principles. In the context of the appeal and the Requested Information, we consider that the most relevant data protection principle is the First Data Protection Principle, relating to (amongst other things) personal data being processed lawfully.

In assessing whether the processing of the personal data in question would be lawful, we also consider that the most applicable lawful basis for processing (in the context of the appeal and the Requested Information) is the Legitimate Interests Basis. This is because the relevant data subjects have not consented to the processing of their personal data in connection with the Request and it is obvious that no other lawful basis would apply.

It may be helpful to reiterate the Legitimate Interests Basis. It provides: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”. Translating that language to the context of this appeal:

Accordingly, in the case of a request for information under FOIA, where the information which is requested contains the personal data of a data subject then that personal data would be processed when it is disclosed in response to the request. As we have noted, in respect of the First Data Protection Principle, this means that the information can only be disclosed if to do so would be lawful, fair and transparent.

The above principles also apply when a public authority, in response to a request for information under FOIA, confirms or denies that it holds the information which is requested. This is because it can be possible for inferences to be drawn from an acknowledgement of the fact that information is held or not held and consequently that could constitute a disclosure of personal data. Accordingly, a public authority (as we have noted) can in some circumstances refuse to confirm or deny that it holds information, as an exclusion of the Duty to Inform. The aim of such a response (a ‘neither confirm nor deny’ response) is to leave entirely open the position about whether the public authority holds the information which has been requested, so that no inferences can be drawn either way.

As the applicable lawful basis of processing of the relevant personal data is the Legitimate Interests Basis, the Legitimate Interests Test must therefore apply.

Given the legal framework which we have outlined earlier, we consider that it is helpful to address the propositions from the Goldsmith case which we briefly noted above regarding the Legitimate Interests Test. As mentioned, in that case Upper Tribunal Judge Wikeley listed (Footnote: ¹²) various propositions derived from case law as to the correct approach to be adopted. We set out seven of those propositions below (some of which we paraphrase or otherwise summarise) and we address each in turn with regard to the facts of this appeal. For completeness, we should mention that Judge Wikeley also referred to an eighth Proposition in the Goldsmith case, but this related to tests which were applied in relevant case law and which does not alter the other seven propositions we refer to.

Applying the propositions is not a sequential process, in that some later numbered propositions need to be considered and determined before returning to earlier numbered propositions. Moreover, some earlier numbered propositions may be superfluous after applying later numbered propositions.

Proposition 1: The three questions set out in the South Lanarkshire case (as we have addressed above – namely, the Legitimate Interests Test) must be applied. Consequently:

Proposition 2: The test of “necessity” under the second of those questions must be met before the third question can be considered. Again, this requires us to turn to Propositions 3 to 5 (inclusive).

Propositions 3 to 5 (inclusive) all relate to the concept of ‘necessity’ and so we group them together before commenting on them:

With regard to those three propositions, we note that Lady Hale, in the South Lanarkshire case, stated that the word “necessary” must be considered in relation to the processing to which it relates.

We also note that, in the Halpin case, Upper Tribunal Judge Kate Markus QC (now KC) stated that: (Footnote: ¹³) “the Goldsmith guidance…makes it clear that the question whether there are alternative measures (proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it…”. In the more recent case of Kol v Information Commissioner and Reigate and Banstead BoroughCouncil (Footnote: ¹⁴), Upper Tribunal Judge Edward Jacobs stated: “If there is another way of satisfying [the requestor’s] legitimate interests without disclosing the information, then disclosure is not necessary”. This principle would apply to confirming whether or not the information is held, as well as the disclosure of the information.

It is helpful to remind ourselves of the relevant wording from Lady Hale’s judgment in the South Lanarkshire (Footnote: ¹⁵) case, in respect of which Upper Tribunal Judge Edward Jacobs was commenting and which is the authoritative decision on the meaning of ‘necessary’ for current purposes:

We consider that these principles (together with others from additional cases cited in the Goldsmith case) are encapsulated in the three propositions (namely, Propositions 3, 4 and 5). In our view, therefore (and taking into account the above comments of Upper Tribunal Judge Kate Markus QC in the Halpin case), we need to consider all three of those propositions in assessing whether or not the potential processing of the third-party personal data (namely, disclosure by way of confirming or denying if the Requested Information is held) was necessary for the purposes of the legitimate interest being pursued by the Appellant by way of the Request.

As noted, the legitimate interest being pursued by the Appellant was identifying whether the Council was complying with its statutory obligations. On the facts of this case, we find that it is not necessary (within the meaning outlined in all three of those propositions) for there to be confirmation or denial as to whether the Requested Information is held in order to achieve that legitimate interest. This is because, in our view, that legitimate interest is fulfilled by the existence of other means for identifying and pursuing whether the Council has complied with its relevant statutory obligations (such as judicial review proceedings, the Local Government & Social Care Ombudsman scheme and even the Council’s own complaints procedures). During the hearing, we asked the Appellant about potential recourse to the Local Government & Social Care Ombudsman and the Appellant commented that he had not pursued that but just used FOIA instead. It is outside of the powers of the Tribunal to ascertain or opine on whether or not those alternatives are sufficient or flawed in any way, but the existence of these alternatives is germane to our assessment of ‘necessity’, having regard to the relevant legal principles and tests we have outlined.

As we have explained, the remit of the Tribunal is to determine whether or not the Decision Notice was in accordance with the law (and not to assess or determine whether there was any wrongdoing by the Council or the merits of any means by which any alleged wrongdoing could be identified or pursued). In this regard, we remind ourselves that when a third party’s personal data is potentially involved in respect of any request for information under FOIA:

In addition, as set out in Proposition 5 (and taken from the judgment of Lady Hale in the South Lanarkshire case): “a measure would not be necessary if the legitimate aim could be achieved by something less”. The fact that there is something less which can achieve the Appellant’s legitimate aim is a relevant point in this appeal. Again, it is not for the Tribunal to determine the merits of, or other matters pertaining to, the ‘lesser means’ by which the Appellant’s legitimate interest may be met, but rather for us to take into account in our decision making (as part of our assessment of ‘necessity’, as we have outlined) whether or not there are other means by which that legitimate interest could be achieved.

Consequently, we find that the Commissioner was wrong to conclude (in paragraph 24 of the Decision Notice) that it would be necessary to confirm or deny whether the Requested Information is held to meet the Appellant’s legitimate interest.

At this juncture, we should return to Proposition 2. As we have noted, this requires the test of “necessity” under the second of the questions in Proposition 1 to be met before the third of those questions can be considered. Given our finding that the processing involved is not necessary for purposes of the legitimate interest being pursued by the Appellant (that is, our answer to the second question is negative) then, in accordance with Proposition 2, we do not need to consider the third of the questions in Proposition 1 (the Balancing Test). In other words, as we have reached the conclusion that, for the purposes of section 40(5B)(a)(i) of FOIA, the disclosure of personal data (by way of ‘confirmation or denial’) is not necessary and therefore the Legitimate Interests Basis is not satisfied, we do not need to go on to consider the Balancing Test between the legitimate interest of the Appellant and the rights and freedoms of third party data subjects.

Proposition 6: Where there are no issues regarding an individual’s privacy rights, the question posed under Proposition 1 can be resolved at stage (ii) of the three-part test referred to (that is, the question can be resolved at the ‘necessity’ stage of the Legitimate Interests Test). Clearly, the appeal involves issues regarding the privacy rights of individuals (namely, potential third-party data subjects) and therefore Proposition 6 is not applicable.

Proposition 7: Where there are issues regarding an individual’s privacy rights, the question posed under Proposition 1 can only be resolved after considering stage (iii) of the three-part test referred to - namely, the Balancing Test. For the reasons given, this appeal involves issues regarding the privacy rights of individuals (potential third-party data subjects). However, as we have stated, given the application of Proposition 2 and our findings on ‘necessity’, we do not need to consider the third of the questions in Proposition 1 (the Balancing Test). Accordingly, Proposition 7 becomes redundant in the context of this appeal.

Various arguments have been put forward by the parties in respect of the application of certain provisions of the LGA which pertain to the Council’s duty to publish certain information. As we have noted, the Appellant argued that the Requested Information should have been disclosed pursuant to the LGA. We do not think that it is necessary to undertake a detailed analysis of the relevant provisions of the LGA. We do note, however, that whilst the LGA requires certain information to be published (Footnote: ¹⁶), it also makes provision for certain exemptions to those requirements (a point which was common ground between the parties), which include where the relevant information relates to an individual or is likely to reveal the identity of an individual. (Footnote: ¹⁷) Those exemptions are also subject to some qualifications, including a ‘public interest’ test, (Footnote: ¹⁸) but for current purposes the relevant point is that there are some exemptions to the publication requirements under the LGA where personal data is involved. We therefore find that the relevant data subjects would not necessarily expect that there would be disclosure of their personal data merely because they are officers of the Council or the subject of applicable meetings. Put another way, we find that the data subjects would have an expectation of privacy in certain circumstances, notwithstanding their role or status within the Council.

Whether or not the Requested Information is held by the Council, we find that the Council has not published any Requested Information pursuant to the LGA. Even if (hypothetically) the Council holds the Requested Information, whether or not it was right not to publish it (or, in other words, whether or not the LGA was complied with by the Council) is not an issue which we could determine, having regard to our powers as set out in paragraph 34 (and summarised in paragraph 35). The fact is that there has been no such publication, which is an additional factor supporting our view that there is a certain expectation of privacy on the part of the relevant data subjects.

As we have noted, section 40(5B) of FOIA is not an absolute exclusion and accordingly the Public Interest Test must be applied. For completeness, we would note that the Council, in its initial response to the Request dated 19 October 2022, erroneously stated that section 40(5B) of FOIA was an absolute exclusion. Following its internal review, the Council’s further response dated 7 December 2022 did not expressly correct that position but it did briefly refer to a public interest test (albeit in the context of disclosure of information, rather than the Duty to Inform). Clearly some errors were therefore made by the Council in that regard, but it is the Decision Notice which is of relevance for the purposes of this appeal.

The Decision Notice, having concluded that section 40(5B)(a)(i) of FOIA was engaged, (Footnote: ¹⁹) did not go on to identify the need for the application of the Public Interest Test. Consequently, the Commissioner did not then apply the Public Interest Test in order to validly determine that the Council could rely on section 40(5B)(a)(i) FOIA to neither confirm nor deny that it holds the Requested Information.

We recognise that the Commissioner did consider public interest aspects in his assessment of the Legitimate Interests Test and the Balancing Test (although we have found that the Balancing Test was not necessary, for the reasons set out in paragraph 91, linked to our finding in paragraph 87). However, that is not the same as applying the Public Interest Test.

Mr Lewin referred us to the Commissioner’s guidance entitled “Neither confirm nor deny in relation to personal data” (v 2.1, 24 November 2020). (Footnote: ²⁰) Relevant parts of that guidance provide as follows: (Footnote: ²¹)

We see no legal basis for that view. We cannot reconcile the Commissioner’s position in that guidance with the provisions of section 2(3) of FOIA, which explicitly states “the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption” (emphasis added). In our view, section 40(5B)(a)(i) of FOIA is subject to the Public Interest Test, as noted in paragraphs 42 and 43.

During the hearing, we asked the Appellant and Mr Lewin for their submissions on the Public Interest Test. The Appellant’s view was that the public interest in disclosing whether the Council holds the Requested Information outweighed the public interest in maintaining the exclusion of the Duty to Inform. The Appellant stated that the Council was a public body and there was a public interest in there being scrutiny of its performance, including with regard to its statutory disclosure obligations, as well as scrutiny of its councillors. The Appellant further submitted that the LGA emphasises the public interest in assessing documents held by the Council. In essence, the Appellant considered that there was an overwhelming public interest in transparency.

The Council’s position was that the public interest favoured maintaining the exclusion of the Duty to Inform. Mr Lewin submitted that the factors relied on by the Council regarding the Public Interest Test were the same as those argued in respect of the Legitimate Interests Test and that the outcome would be no different; ultimately, the privacy rights of the data subjects prevailed in either test.

We recognise and accept that there is a public interest in transparency regarding the relevant activities of the Council and in there being scrutiny of the councillors and the Council’s compliance with applicable laws. However, we find (considering all of the circumstances) that the public interest in maintaining an individual’s rights to privacy, based on the legal principles we have referred to, outweighs those public interests. We view the principle of the protection of privacy with respect to the processing of personal data to be paramount.

Linked to the preceding point, disclosure of information under FOIA is, effectively, disclosure to the public (in other words, to the ‘world at large’). It cannot be restricted to the Appellant as the person making the Request. It is for this reason that appropriate consideration and weight had to be afforded, in the application of the Public Interest Test, to the protection of individual’s privacy rights – namely, because disclosure of information under FOIA is disclosure to the general public.

For the above reasons, we therefore find that the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the Council holds the Requested Information.

For completeness, we now briefly address relevant remaining issues raised by the Appellant.

In his grounds of appeal, the Appellant expressed surprise that the Commissioner had considered that the Legitimate Interests Basis was the most likely lawful basis for processing of personal data. The Appellant asserted that the Legitimate Interests Basis “is specifically not available to public authorities in the performance of their public task”. However, we have noted in paragraph 47, whilst Article 6(1) of the UK GDPR does include an exception to the Legitimate Interests Basis (stating that it does not apply to processing carried out by public authorities in the performance of their tasks), section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA.

The Appellant also stated in his grounds of appeal that the Commissioner had not considered Article 6(1)(c) (Footnote: ²²) of the UK GDPR (processing is necessary for compliance with a legal obligation to which the controller is subject) or Article 6(1)(e) (Footnote: ²³) of the UK GDPR (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).

Taking each of those in turn:

As noted in paragraph 16, the Appellant contended in his grounds of appeal that the other decision notices cited by the Commissioner (Footnote: ²⁴) did not provide support for his conclusion in the Decision Notice.

As referred to in paragraph 34 (and summarised in paragraph 35), our remit is to consider the Decision Notice. Whilst the Decision Notice did refer to other decision notices previously issued by the Commissioner, those other decision notices are not relevant for the purposes of the appeal. Whether or not the other decision notices supported the Commissioner’s decision in the Decision Notice is not an issue we needed to decide. We have considered the Decision Notice without reference to other decision notices but only with regard to the matters relevant to the Decision Notice itself and to the issues raised in the appeal.

For all of the above reasons, we conclude that section 40(5B)(a)(i) of FOIA is engaged and that the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the Council holds the Requested Information. Accordingly, we find that the Decision Notice was correct in determining that the Council could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information. It follows that we agree with the findings of the Commissioner in the Decision Notice in that regard.

However, we find that the Commissioner was wrong to conclude (in paragraph 24 of the Decision Notice) that it would be necessary to confirm or deny whether the Requested Information is held to meet the Appellant’s legitimate interest. This relates to our finding (as noted in paragraph 80.a) that the Commissioner wrongly considered that the legitimate interest being pursued by the Appellant was in respect of understanding whether disciplinary action had been taken in relation to Council staff. We also find that the Decision Notice was flawed in not applying the Public Interest Test, having concluded that section 40(5B)(a)(i) of FOIA was engaged.

Our findings in the preceding paragraph do not, however, affect our decision regarding the ultimate conclusion reached in the Decision Notice, given that our decision results in the same outcome – namely, that that the Council can rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it holds the Requested Information. As we are therefore dismissing the appeal, we conclude (having regard to the provisions of section 58 of FOIA) that there is no basis for us to substitute the Decision Notice notwithstanding those findings.

We therefore dismiss the appeal.