Edward Williams v The Information Commissioner & Anor

This Decision concerns the Appellant’s appeal against the Information Commissioner’s Decision Notice dated 13 March 2023, in which the Information Commissioner found that the public authority (Ministry of Justice) was entitled to rely on s. 40 (5B) (a) (i) of the Freedom of Information Act 2000 (Footnote: ¹)(‘FOIA’) in neither confirming nor denying whether it held the requested information.

The Ministry of Justice was joined to this appeal as the Second Respondent by direction of the Registrar dated 1 June 2023.

The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of this Chamber’s Procedure Rules (Footnote: ²). 

The Tribunal considered an agreed open bundle of evidence comprising pages 1 to 145. The Tribunal also considered a closed bundle, comprising pages 1 to 34.

This is an unusual case in which the Second Respondent originally confirmed that it held the requested information and claimed an exemption from the duty to disclose it, but subsequently revised its response to neither confirm nor deny whether it held any information within the scope of the request.

The explanation for this change of stance is that the request was objectively ambiguous so that the Second Respondent had initially understood it to mean one thing, then realised it meant another and changed its stance.

It issued a letter to the Appellant during the course of the First Respondent’s investigation, explaining its changed understanding of the scope of the request and its changed response thereto.

We have seen the public authority’s letter to the First Respondent, explaining its revised position, but we have not seen the letter it sent to the Appellant. We understand it to have constituted an amended or revised response to the request under s. 17 FOIA, as it was the response considered in the Decision Notice and is consequently the response which is the subject of this appeal.

The information request, made on 23 August 2022, was in the following terms:

“Provide a schedule, in date order, of money damages and legal

costs paid by you to females held in women's prison who were

victims of assault (including all types of sexual assault) by male

prisoners (including trans-women) for the period 2018 to date.”

The Second Respondent’s response, on 12 September 2022, was to confirm that it held the requested information, but to claim that it was exempt from disclosure under s. 40 (2) FOIA. This stance was upheld on internal review, communicated to the Appellant on 10 October 2022.

The Appellant complained to the First Respondent on 10 October 2022, who opened an investigation on 19 October 2022.

However, on 16 November 2022, the Second Respondent informed the First Respondent and the Appellant that:

“…as the result of further review during the ICO investigation, we

can confirm that this was incorrect because the information we

were basing this on is not in scope. We are therefore amending

our FOI response to your original request [MOJ reference number

redacted] as set out below. Please accept our apologies for this.

…

I can neither confirm nor deny if the MOJ holds the information

that you have requested. Under section 40(5B)(a)(i) of the FOIA

we are not obliged to confirm or deny whether we hold

information, if to do so would contravene any of the data

protection principles set out in Article 5(1) of the General Data

Protection Regulation and section 34(1) of the Data Protection

Act 2018”.

The Decision Notice dated 13 March 2023 (Footnote: ³) found that, in responding to the revised interpretation of the information request, the Second Respondent had been entitled neither to confirm nor deny whether information was held and required no steps to be taken.

The Decision Notice found that, in originally claiming a different exemption, the public authority had been considering information outside the true scope of the request.

The Decision Notice concluded that the information requested constituted personal data in that it would allow the identification of those concerned. This was because the number instances of assault involved were fewer than five, and also, as some information was in the public domain following a criminal conviction, disclosure would permit a ‘jigsaw’ identification of those who might have received, or not received, compensation.

Nevertheless, the Decision Notice acknowledged that the public authority could disclose this personal data if to do so would be in accordance with the provisions of UK GDPR.

In applying Article 6 (1) (f) UK GDPR, the Decision Notice proceeds to apply a three-part test by asking:

The Decision Notice concludes that there is a legitimate interest being pursued in the request for the information, because it serves the principle of transparency, especially in relation to the public purse. However, it went on to find that this legitimate interest was insufficient to override the personal data rights of those concerned, because they would have no expectation that they would be so identified, and their identification could cause them distress and harm. In the circumstances, it was not necessary to undertake the balancing exercise at part (iii) of the test and the Decision Notice concluded that the Second Respondent was entitled to rely on s. 40 (5B) (a) (i) FOIA in neither confirming nor denying whether it held the requested information.

The Decision Notice did not require any steps to be taken. It also did not make any finding in respect of s. 16 FOIA, concerning the Second Respondent’s failure to clarify the Appellant’s ambiguous information request.

The Appellant’s Notice of Appeal, dated 13 March 2023, was succinct:

“I appeal under s. 57 FOIA….

On 10 October 2022 the PA on IR confirmed its response….

Any further responses by the PA were of no legal relevance.

The First Respondent’s Response dated 7 June 2023 opposed the appeal and relied on the correctness of the Decision Notice.

The Second Respondent’s Response dated 5 July 2023 also opposed the appeal and relied on the correctness of the Decision Notice’s outcome, if not its reasoning. It was submitted that the Decision Notice had erred in concluding that there was a legitimate interest in the information requested, because such a generalised interest in transparency was insufficient and the question should have been applied to the specific information sought. Its submission was as follows:

“37.The Appellant has not identified what legitimate interest he says is in play in these circumstances. The MoJ accepts (and accepted before the Commissioner) that there is a general public interest in accountability and transparency in relation to legal payments made by the MoJ in cases of assaults by prisoners on other prisoners held in the prison estate. But it submits that, for the purposes of the DPA/GDPR framework, there is no legitimate interest in publication of details relating to individual cases. The MoJ submits that the Commissioner erred insofar as he concluded otherwise. In particular, he erred insofar as he concluded (DN §26-27) that a general interest in transparency and accountability was sufficient to establish a legitimate interest for the purpose of Article 6(1)(f): see Cox v Information Commissioner [2018] UKUT 119

§42 (“There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”)

38.

The relevant question is whether there is a legitimate interest in disclosure of the specific information requested: see Kol v Information Commissioner [2022] UKUT 74 §18 (“[Article 6(1)(f)] refers to processing, which can only mean the processing of the data. In this case, that means disclosing the information requested. The issue is whether it is necessary to disclose that

information for the purposes of [the requester’s] legitimate interests. It is the information that is the focus of the enquiry”). In this case the Appellant has an interest as a journalist in finding out whether legal claims have been made in the very small number of individual assault cases falling within scope of his Request. The information would undoubtedly be of interest to the public, but that is not sufficient to establish a legitimate interest – either on the part of the

Appellant, or more generally – in the publication of the individual assault victims’ personal data”.

The Second Respondent helpfully explained its initial error in this case as follows:

“[15] As explained above, in its initial response in September 2022 and at the internal review stage, the MoJ stated that it held information in scope of the request but refused the request under s. 40 (2) FOIA (disclosure would reveal personal data of third parties and would contravene data protection principles. On further consideration of the request, prompted by the Commissioner’s investigation, officials within MoJ realised that they had misinterpreted the scope of the request. On its proper interpretation, the MoJ decided that it could neither confirm nor deny holding information in scope. The MoJ informed the Commissioner and the Appellant of this change to its response on 16 November 2022.”

The Appellant did not file a Reply.

The law relevant to this appeal is as follows.

S. 1 FOIA provides that:

“General right of access to information held by public authorities.

Any person making a request for information to a public authority is entitled—

S. 16 FOIA provides that:

“Duty to provide advice and assistance.

(1)I t shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to it.

(2)

Any public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice under section 45 is to be taken to comply with the duty imposed by subsection (1) in relation to that case.”

The Information Commissioner’s Office has published Guidance on s. 16 FOIA is as follows: (Footnote: ⁴)

“In what circumstances should we provide advice and assistance?

Section 16 aims to ensure that you communicate with an applicant or prospective applicant to find out what information they want and how they can obtain it.

Generally, there are three main circumstances in which this duty arises.

The first is that you have reason to believe that the applicant has not given their real name. In this case, you should ask the applicant for it.

The second circumstance is when the request, read objectively, is ambiguous and requires clarification as to the information sought. In this case, you should contact the applicant to ask for more details to help you identify and locate the information they want.

The third circumstance is when the request would exceed the appropriate limit beyond which you would not be required to provide the information. In this instance, you should provide the applicant or prospective applicant with advice and assistance to

help them reframe the request in a way that would bring it within the appropriate limit”.

Any information to which a request for information relates is also exempt information if—

The first, second or third condition below is satisfied.

would contravene any of the data protection principles, or

would (apart from this Act) contravene any of the data protection principles, or

Articles 5 and 6 of UK GDPR provide (where relevant) as follows:

“Article 5Principles relating to processing of personal data:

1.Personal data shall be:

(a)processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

Article 6Lawfulness of processing:

1.Processing shall be lawful only if and to the extent that at least one of the following applies:

(f)

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:

“If on an appeal under section 57 the Tribunal considers -

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.

On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.”

The burden of proof in satisfying the Tribunal that the Commissioner’s Decision Notice was wrong in law or involved an inappropriate exercise of discretion rests with the Appellant. Where there is a dispute of fact, the relevant standard of proof is the balance of probabilities.

None of the parties filed skeleton arguments in this appeal.

None of the parties filed open evidence in this appeal.

We have considered, in our open bundle, the evidence provided by the MoJ to the Information Commissioner during his investigation of the complaint. The Appellant has of course seen this.

We considered a closed bundle in this appeal, consisting of unredacted versions of the evidence contained in the open bundle. The Appellant has not seen this, because it is subject to a direction under rule 14 of the Tribunal’s Rules. It has not been necessary for us to refer to the closed bundle in making this Decision, so there is no closed annexe.

We ‘gist’ the closed material for the benefit of the Appellant as follows: it consists of correspondence with the Information Commissioner’s Office during the investigation, which explains the change of stance by MOJ.

We find that the Appellant’s information request was objectively ambiguous and required clarification. As the Second Respondent has submitted, the terms in which the information was requested made it difficult to distinguish between a request for a schedule of money damages paidduring the period 2018 to date, and a schedule of money damages paid to those who were victims of assault during the period 2018 to date.

We conclude that the Second Respondent failed to comply with s. 16 FOIA, theInformation Commissioner’s Guidance and the Code of Practice in responding to the request based on an initial, and flawed, understanding of the information requested, without clarifying it.

We conclude that the Second Respondent was entitled to revise its response after it had realised its mistake. Following the Upper Tribunal’s reasoning in FCDO v Information Commissioner, Williams and Other (see paragraph 33 above), we find that the s. 17 FOIA response is an administrative step and not a substantive one, so a public authority changing its stance after it has complied with the administrative step is not a breach of FOIA. We would have expected the Appellant to be aware of this, having been a party to the Upper Tribunal appeal which most recently established the relevant legal principle. He has not, in any event, sought to distinguish the authority.

Although it seems counter-intuitive, the Second Respondent’s change of stance is explained by its initial misunderstanding of the request. We are satisfied by the evidence in both the open and closed bundles before us that, properly understood, the request has within its scope different information from that within scope of the first erroneous interpretation. It could be argued that the 16 November 2022 response is in fact the first response to the request once it was properly understood, but the First Respondent treated it as a revised response to the same request and we do not think this is objectionable. We find it regrettable that the Second Respondent found itself in this position, which is attributable to its own failure to clarify an ambiguous request and thus its breach of s. 16 FOIA.

The Decision Notice treated the public authority’s revised response as the operative response for the purposes of the Appellant’s s. 50 FOIA complaint. The Appellant appears to have agreed to this. This appeal is therefore an appeal against the Decision Notice which was issued on 13 March 2023 and not an appeal against the Second Respondent’s change of stance. We discern no error of law in the First Respondent’s Decision Notice in this regard and conclude that the Appellant’s first ground of appeal is misconceived.

Turning to the application of s. 40 (5B) (a)(i) FOIA, we conclude that the information requested does constitute personal data, and so we reject the Appellant’s second ground of appeal. We agree that the information requested is not criminal offence data.

We also conclude that the Second Respondent is correct to submit that the legitimate interest identified in the Decision Notice was an erroneous conclusion, and that the interest apparently claimed by the Appellant is insufficient to override the victims’ personal data rights.

We conclude that there is an error of law in the Decision Notice for this reason. We agree with both Respondents’ submissions that the publication of the data is not necessary and that it is unnecessary to proceed to part (iii) of the three-part test. Despite our finding that the Decision Notice contains an error in relation to part (i) of the three-part test, the substantive outcome thus remains the same.

We further conclude that the Decision Notice erred in failing to find that the Second Respondent had breached s. 16 FOIA in failing to clarify an objectively ambiguous request. To this extent, the appeal succeeds in part (although not in relation to grounds advanced by the Appellant).

As our conclusions do not alter the substantive outcome, we make no substituted Decision Notice, and we require no steps to be taken.