Martin Redfern v The Information Commissioner & Anor

The parties were content for there not to be an oral hearing. The panel were satisfied that it could determine the appeal justly and fairly without having to convene an oral hearing.

The appellant is a journalist. His concerns relate to the impact that the large number of students based at the University of Exeter’s campuses - some 38,813 students – has on the city of Exeter. He sought the information requested in order to hold the University of Exeter to account, as the information provided to the local planning authority, Exeter City Council, enabling it to make planning policies related to student accommodation in the city is inadequate. He noted that the Office of National Statistics had concluded their council tax records could not be relied on for the purpose for estimating student populations, and that its research suggests at least twice as many residential buildings have been used as student accommodation, such high levels of student occupancy between Exeter, private residential housing stock, having a wide range of social and economic impacts over the years.

The appellant challenges the decision of the first respondent (the “ICO”) dated 6 February 2023 (Ref: IC-200451-D9M9). This was in respect of a request made to the second respondent, Exter University (“the University”) on 4 August 2022 which was as follows:

The University disclosed information requested in part 1 of the request, provided some information broadly relevant to part 2, but took the position, in respect of part 2, that sections 12 and 21 of Freedom of Information Act 200 (“FOIA”) applied.

The ICO took the view that section 21 did not apply to parts 2(a) and 2(b) of the request, but concluded that although section 21 did not apply, section 12(1) did as it would exceed the cost limit to provide the information requested in parts 2(a) and 2(b). He concluded also that there was no breach of section 16(1) of FOIA and considered that the information sought in parts 2(c) and 2(d) of the request was not information held by the University and that even were that so, providing the specific figures requested would exceed the cost limit under Section 12(1). Accordingly, the ICO concluded that the University had breached Section 10(1) of FOIA as it had not confirmed that it did not hold the information within twenty working days of the request.

The appellant challenged the decision that Exeter was not obliged to comply with parts 2(a) and (b), contending that the provision of the information would not exceed the appropriate cost limit. He also sought to appeal against the conclusion that Exeter did not hold the information requested in parts 2(c) and 2(d).

The core of the challenge is that the ICO was incorrect to accept the University’s claim that in order to provide the information requested, a manual review of student address records would be necessary. He submitted that, given the ICO had concluded [23] in its decision notice that the University potentially holds the building blocks necessary to provide the information requested, but whether they do so rests on whether the University possesses the addresses of purpose built student accommodation in Exeter, provided both by the University and not provided by the University as well, as the addresses of other forms of accommodation that are provided by the University. It is submitted that he had addressed these issues in the internal review request submitted, but this has not been taken into account.

The appellant makes the point that the University confirms that all its student records are kept in a standardised format including an address in the form of a building number, street name and postcode, this being in compliance with the published University regulations which requires students to keep the University informed of up-to-date home and term time addresses, the University’s data protection notice confirming that it holds and processes such addresses.

It is submitted that the University had failed to explain why it would take more than eighteen hours to provide the information requested, failing to provide details as to how this was calculated. He submitted this estimate is not reasonable, as it is neither sensible, realistic nor supported by cogent arguments or evidence.

It is also submitted there is insufficient evidence either to accept the claim that university student records are not kept in a standardised form or in electronic files or to support the conclusion that the University could not provide the requested information without a manual review.

The appellant also challenges the University’s claim that it could only provide the requested information by manual cross-referencing, as in doing so did not consider an obvious and quick means of locating and retrieving or extracting the requested information. It is submitted this is possible because matching student address records with the addresses of purpose built student accommodation as it possesses the addresses of those in Exeter, including that provided by the University and not provided by the University, publishing a map precisely locating these buildings, that map showing university provided student accommodation at 26 addresses in Exeter and accommodation not provided by the University at a further 36 addresses. It is submitted that data spreadsheet and similar queries matching each of the student accommodation addresses possessed by the University and precisely located by map against the addresses of all the student records would yield responses to part 2 of the information requests, that in part (d) being derived in their responses to parts 2(b) and (c), in addition to the information supplied under part 1. The appellant states:

In its response dated 25 May 2023 the ICO set out the request, the University’s initial response and the appellant’s response thereto. It sets out also the grounds of appeal before concluding [12] that it considers that both the appellant and the Tribunal would be assisted by having sight of the University’s specific responses in respect of questions raised and asking for the University to be joined to the appeal under Rule 9 of the Procedure Rules.

There were three points raised:

The ICO also asked the University to respond to the reasons given why it did not hold the requested information in the sense that this would not be a requirement to create information.

On 21 July 2023, the University was joined to the proceedings.

Further case management directions were given on 20 October 2023.

On 27 October 2023, the University responded to the ICO’s response stating as follows:-

It is also stated that the request for data held on students who live in Exeter but not within the University or university owned or managed accommodation would involve over 10,000 additional records to be considered and further cross-referenced as the students may be living at home, in privately owned accommodation, a rented premises or a purpose-built student accommodation arrangement. It is said that they cannot verify the consistency of the data, there being no checks on the accuracy of the information provided, where students are providing their postal address for contact purposes only. Further, the University says it has no business reason to collect from their student system information as to the type of accommodation which they live. That would require a request to do so and, would require there to be a legitimate reason for collecting the data and processing it under the Data Protection Act 2018, which they consider they do not have. Further, it notes that it would have no way to verify the accuracy of the information provided and that there is a fine line between the definition of types of accommodation in which a student would choose to live and they could not confidently verify the information. On that basis it would be necessary to individually cross-reference the data (by postcode), to in part identify the number of students living in University student accommodation, which would not provide accurate figures and some accommodation sites are within the same postcode and would be a mixture of privately owned and University or third party owned accommodation. This would therefore require more than eighteen hours. Further, it is submitted that there is no obligation under FOIA to create information which does not already exist.

Although this notice was served late, time was extended to permit it be relied upon. The appellant was given the opportunity to reply to that no later than 28 November 2023.

In his response to the University’s reply, the appellant sets out that he considers that the University’s decision not to respond to the points summarised at paragraphs 13 to 15 of the ICO’s response means that they are conceding all these points. There is no proper legal basis for such a submission.

The appellant seeks to refute what is set out in paragraph 9 of the response and as the response relates to the academic year 2021 to 2022, whether or not a change of address during the year does not entail that no address was provided at the beginning of the year, guidance being that even if they do not hold the complete set of requested data and still hold information which contains inaccuracies, then that is not relevant, the right under FOIA being to information which is held, not information which is accurate. It is submitted further that he has not suggested creating a data set then sifting it into predetermined categories, but rather using electronic tools to require an existing data set, the student record system, for address matches with a small number of postcodes falling back to street name and number matching where postcodes were not available and no explanation has been given why this could not be done and that the University had failed to consider whether the option exists to assess the quality of a relatively small quantity of data as a represented proxy for the quality of all the data.

The appellant denies suggesting that the University should include a record in its student records information as to the type of accommodation, but rather that it can provide the request information by assembling it from building blocks it possesses using the skills and judgment which it possesses, the information request referring to an unambiguous development and typology that is PBSA. He refutes the suggestion that it would not be possible [15] to identify and use the proper tools, the assertion in the second sentence being one that can only be made on the basis of an analysis of a kind that they said they are unable to perform.

As far as is relevant, FOIA provides:

We have applied sections 50, 57 and 58 of FOIA in considering this appeal.

We have no reason to doubt the University’s statement that it has no business reason to collect data with regard to the type of accommodation a student is living in. As they rightly point out, there would need to be a legitimate reason for collecting that data under the Data Protection Act, which it does not have.

What the appellant contends is that it is possible by cross-referencing information held to set out the number of students who live in various different types of accommodation. We note that at no point does he assert that this information is in fact held at present, and that the basis on which it is said that the University “holds” the information is based on an assertion that the University potentially holds the building blocks necessary to provide the information in respect of parts 2(a) and 2(b), but not in respect of parts 2(c) and 2(d).

The appellant asserts in the grounds of appeal that the University possesses the addresses of PBSA in Exeter, both provided by the University itself and not provided by the University, as well as the addresses of other forms of accommodation that are provided by the University. Whilst it is not in doubt that the University keeps records of student addresses, the submission that they are not kept in a standardised form (and that this is criticised) presupposes that the information that the appellant seeks as to the status of the accommodation they occupy is held on those records. There is a good reason to consider this is not a well-founded criticism given not least the Data Protection Act and the consequences of doing so. Further, it does not follow that because the University has a map of the addresses used that it is possible to break those down by postcode and we consider that the approach indeed that the appellant suggests taking is not a one of normal skills, but indeed falls well without those parameters. What in fact the appellant is seeking is not records held, but for the University to undertake a research project to produce the information sought. This is not an electronic query based approach. The assertions made by the appellant as to how various different databases could be combined and interrogated are not substantiated.

Contrary to what is asserted in the appellant’s responses, we do not consider that the response by the University is inconsistent, nor do we consider that they (or the ICO) have conceded the points raised in the commissioner’s response. The University has said that it does hold addresses, be we accept the reasoning given at [7] why it would not be possible to break down the information as required, and the difficulties that would follow, and we are not satisfied by the appellant’s assertions that this is not so.

Accordingly, we are satisfied that in respect of 2(a) and 2(b), the cost of compiling the data would be well outside the limits permitted, given the complexity of the task in comparing data from different sources and in respect of 2(c) and (d), that the University simply does not hold the data and what the appellant is seeking is for it to create a data set which he can then use.

We do, however, note that the University was in breach of the duty to confirm that it did not hold relevant information within the statutory time limit, but for the reasons set out above, we do not consider that this is a material matter.

Accordingly, for these reasons, we dismiss the appeal,