Adnan Ali v The Information Commissioner

Section 1(1) FOIA gives individuals a right to information from a public authority unless it is “exempt information”.

Section 2(2) FOIA provides that:

“In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

(a)

the information is exempt information by virtue of a provision conferring absolute exemption, or

(b)

in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”

Section 36(2) provides:

“Information to which this section applies is exempt information, if in the reasonable opinion of a qualified person, disclosure of the information under this Act –

…

(b)

would or would be likely to, inhibit –

…

(ii)

the free and frank exchange of views for the purposes of deliberation...”.

The opinion of the “qualified person” must be “both reasonable in substance and reasonably arrived at” Guardian Newspapers Ltd and Brooke v IC, IT, 8 January 2007 (EA/2006/0011; 0013), at [64]. The Upper Tribunal noted in Information Commissioner v Malnick and another [2018] UKUT 72 (AAC), that qualified persons:

“…are all people who hold senior roles in their public authorities and so are well placed to make that judgment, which requires knowledge of the workings of the authority, the possible consequences of disclosure and the ways in which prejudice may occur. It follows that, although the opinion of the QP is not conclusive as to prejudice (save, by virtue of section 36(7), in relation to the Houses of Parliament), it is to be afforded a measure of respect” [29].

The exemption in section 36(2) FOIA is not absolute and is therefore subject to the public interest test in section 2(2)(b).

The public interest in maintaining the exemption must be assessed in all the circumstances of the case and weighed against the public interest in disclosure. It must relate specifically to the relevant exemption. The starting point is to assume a public interest in disclosure. The Tribunal must identify the actual harm or prejudice caused by disclosure and weigh that against the benefits of disclosure.

The public interest must be assessed at the time when the public authority makes its initial decision on a request for information in accordance with the statutory time for compliance (Montague v Information Commissioner and the Department of International Trade [2022] UKUT 104 (AAC)).

Section 40 FOIA provides:

The first data protection principle under Article 5(1)(a) of the UK’s retained version of the General Data Protection Regulation (“UK GDPR”) is that personal data shall be:

“processed lawfully, fairly and in a transparent manner in relation to the data subject”.

Article 6(1) UK GDPR provides that processing shall be lawful only if and to the extent that one of the lawful bases for processing applies. Article 6(1)(f) provides the following lawful basis for processing:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”.

Section 40(2) FOIA is an absolute exemption in relation to the first condition under section 40(3A) FOIA: the public interest balancing test under section 2(2)(b) FOIA therefore does not apply.

Section 40(7) FOIA provides that “personal data” has the same meaning in FOIA as in section 3 of the Data Protection Act 2018 (“DPA”), namely:

“(2)

“Personal data” means any information relating to an identified or identifiable living individual…

(3)

“Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a)

an identifier such as a name, an identification number, location data or an online identifier, or

(b)

one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

In NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192, Upper Tribunal Judge Jacobs considered whether a patient could be identified from a list of dispensaries which had dispensed a particular medication. Judge Jacob described the issue before him as:

“whether any person was identifiable from the [withheld data] when taken together with other information by someone who was motivated to identify one or more of the persons within the data using all the means reasonably likely to be used.” [paragraph 3]

Judge Jacobs observed in paragraph 21 of NHS Business Services Authority that this was not a test of “remoteness or significance or likelihood” but “whether it is possible to identify a specific individual solely by relying on the data available”.

The powers of the Tribunal in determining this appeal are set out in section 58 FOIA, as follows:

“(1)

If on an appeal under section 57 the Tribunal considers -

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.

(2)

On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.”

The Tribunal stands in the shoes of the Commissioner and takes a fresh decision on the evidence before us. The Tribunal does not undertake a review of the way in which the Commissioner’s decision was made.

The reasons for the Tribunal’s decision are set out in full below.

The Tribunal decided that a redacted version of the first 12 pages of the Report should be disclosed to the Appellant. We have set out in a Closed Annex the redactions to be made. The Closed Annex is to be made available only to the Commissioner and the University because it contains information which is to be redacted and not disclosed to the Appellant.

In reaching its decision, the Tribunal took into account all the evidence before it, the written submissions of both parties and the University, and the oral submissions of the Appellant. The Tribunal had before it an open bundle of 124 pages, a closed bundle consisting of the withheld Report, and the parties’ additional submissions in relation to sections 40 and 41 FOIA (see paragraph 22 above).

The Tribunal applied the law as set out in paragraphs 23 to 38 above.

The Tribunal found that the opinion of the qualified person, that section 36(2)(b)(ii) was engaged, was reasonable, noting the guidance of the Upper Tribunal in Malnick. It was reasonable for Dr Spence to conclude that disclosure of the full Report would be likely to inhibit the willingness of staff to participate in the investigation and the ability of University members to discuss freely and fully its conclusions and the serious concerns raised by the Appellant. We noted that Dr Spence was not the Provost of the University at the time of the first two appointments which were the subject of the investigation.

The Tribunal went on to consider whether the public interest in maintaining the exemption in section 36(2)(b)(ii) FOIA outweighed the public interest in disclosing the Report.

The Tribunal accepted that the balance of public interest was in favour of maintaining the exemption in section 36(2)(b)(ii) in relation to the appendices to the Report. The appendices contain detailed interview transcripts and evidence from the University staff who participated in the investigation. The interviews were conducted on the basis that the interviewees’ evidence would be kept confidential. The public interest in respecting those assurances of confidentiality, and in University staff participating in the investigation and future investigations with openness and candour, outweighed the public interest in disclosure of their detailed evidence. The Tribunal accepted that if the individuals had not received assurances of confidentiality, they would not have participated so freely, and that this would have hampered the investigation. The Appellant confirmed at the hearing that he was appealing only in relation to the main body of the Report and not the appendices.

The main body of the Report - the first 12 pages – contained 6 sections:

In relation to the main body of the Report, the Tribunal again decided that the public interest in maintaining the confidentiality of the individuals who had participated in the investigation outweighed the public interest in disclosing their names and evidence. The names of individuals who had been interviewed (or not interviewed) and the dates of interviews should therefore be redacted from Section 4 on Methodology. Section 5 should also not be disclosed – other than the first sentence and column headings - because it contained a summary of the evidence provided by participants and the findings reached by the investigator based on that evidence. The Tribunal concluded that the individuals would be identifiable from Section 5 even if their names and specific references to their evidence were redacted, and on balance, the public interest in maintaining their confidentiality outweighed the public interest in disclosure of specific findings.

However, none of the participants nor their evidence could be identified from Sections 1, 2, 3 or 6 of the first 12 pages of the Report, other than the Appellant and the individual whose appointments were the subject of the investigation. We have addressed the redaction of personal data of the Appellant and that individual in the context of section 40 FOIA in paragraphs 58 to 63 below.

The public interest in disclosure of redacted versions of Sections 1, 2, 3 and 6 which set out the context, scope, methodology, conclusions and recommendations of the investigation, is substantial, in particular because the investigator concluded that the University’s procedures or due process had not been followed in respect of the first and second appointment.

All parties acknowledged the general public interest in transparency and accountability of public bodies. The University and the Commissioner highlighted the public interest in understanding how the University dealt with sensitive issues and allegations of inappropriate behaviour, including under its PIDA policy. The University acknowledged that the allegations made by the Appellant were “serious”.

In addition, the Tribunal found that there is a strong public interest in the use of public funds. The Appellant submitted, and the University accepted, that funding for the first appointment would have been a significant sum.

In relation to the public interest in maintaining the exemption, the Tribunal took into account the University’s submissions that the issue was still “live” at the time of the Request and under consideration by the University’s Audit Committee, and that disclosure at that time would have prejudiced the ability of the Audit Committee to deliberate the outcome of the Report. These submissions go to the heart of the section 36(2)(b)(ii) exemption, which is to enable deliberation and exchange of views. As noted in paragraph 29 above, the public interest must be assessed at the time when the University made its initial decision about responding to the Request, and timing was a determining factor for the Commissioner.

However, the Tribunal did not accept that the issue was still “live” when the University responded to the Request. The email sent by the University’s Vice President (Operations) to the Appellant reported that the matter had “now been fully investigated” and informed him of “what action is to be taken as a result”. The Vice President did not indicate that any further action was planned and no reference was made to referral to, or further deliberation by, the Audit Committee. The Appellant was thanked for his co-operation and patience. The impression given was that the matter was closed. In this context, the Tribunal found little prejudice to the deliberations of the Audit Committee would arise from disclosure of the first 12 pages of the Report.

The University further submitted that the public interest in transparency and accountability had been adequately satisfied by the summary provided to the Appellant. However, the Tribunal concluded that the findings of the Report had been reported to the Appellant in a selective manner. Findings which were favourable to the University were presented in full, while unfavourable findings were omitted or re-phrased. We noted in particular that:

As a result, the Tribunal did not find, as submitted by the University and accepted by the Commissioner, that the summary supplied to the Appellant was sufficient to satisfy the general public interest in transparency and accountability. Indeed, the Tribunal found that the summary raised further concerns about a lack of transparency and accountability at the University and a resistance to what the University termed “external interference” in its submissions. This added weight to the public interest in disclosing the conclusions of the Report.

The Tribunal also did not accept as submitted by the University that disclosure would undermine the University’s ability to “effectively mitigate and manage the outcomes and recommendations” of the Report. We found that, as submitted by the Appellant, disclosure was more likely to build trust and confidence in the University and enable it to be held to account in the way in which it adopted and implemented the recommendations of the Report.

Taking all this together, the Tribunal found that the public interest in transparency about appointments made by the University, compliance with its own recruitment and selection procedures, its process for responding to and investigating allegations of inappropriate behaviour under its PIDA policy, use of public funds, and in holding the University to account in accepting and acting upon the conclusions of the investigation, outweighed the public interest in withholding the Report in order to protect a free and frank exchange of views. This was on the basis that only the first 12 pages were disclosed with redactions to Sections 4 and 5 as set out in paragraph 47 above (and pursuant to section 40 FOIA as set out below).

The Tribunal decided, after considering the further submissions of the parties in this regard (see paragraph 22 above), that further redactions should be made to the first 12 pages of the Report before disclosure in light of section 40 FOIA (personal data). Those redactions are set out in full in the Closed Annex to this Decision. The Tribunal took into account the redactions proposed by the University in a Closed Annex to its further submissions.

References to the Appellant must be redacted pursuant to section 40(1) because they constitute personal data of which the Appellant is the data subject and are therefore exempt. Section 40(1) is an absolute exemption; the public interest balancing test does not apply.

In relation to section 40(2), the Tribunal decided that personal data of the individual whose appointments were the focus of the investigation must be redacted. In addition to their name, other personal data from which they could be identified must be redacted, such as the specific dates and details of their appointments and the reasons for those appointments.

Disclosure of this personal data would contravene the Article 5(1)(a) principle that personal data must be processed fairly and lawfully. The Tribunal concluded that disclosure would not be lawful because the individual’s interests and fundamental rights and freedoms overrode the legitimate interest in disclosure – and therefore the first condition in section 40(3A). While the appointments were likely to be in the public domain, the specific circumstances of and reasons for them, which include personal circumstances sensitive to the Appellant, were not. There are legitimate interests in transparency and accountability in relation to the University’s appointment and PIDA processes and the use of public funds, as noted at paragraphs 49 to 51 and 57 above. However, disclosure of the individual’s personal data was not necessary for the purposes of those legitimate interests. The legitimate interests rest in the findings of the investigator about the University’s failure to follow due process and is satisfied by the disclosure of those sections of the Report without the identification of the individual concerned.

Section 40(2) FOIA is an absolute exemption in relation to the first condition under section 40(3A): the public interest balancing test does not apply.

The Tribunal decided that it was not necessary to redact the number of appointments, the general nature of the appointments nor the broad timeframe. The University did not make any specific submissions in this regard nor draw our attention to other available information which might facilitate identification by a “motivated intruder”. The University did not approach the individual concerned about redactions. The Tribunal concluded, applying the guidance of Upper Tribunal Judge Jacobs in NHS Business Services Authority (see paragraphs 35 and 36 above) and considering in particular the large number of appointments made by the University each year, that it would not be possible for the individual concerned to be identified from the remaining unredacted information.

The University did not submit that the name of the Vice President (Operations) who commissioned the Report should be redacted, which the Tribunal found appropriate, given the seniority of her role. The Tribunal accepted that the names of junior employees should be redacted.

For the reasons set out above, the Tribunal concluded that the first 12 pages of the Report should be disclosed to the Appellant in response to the Request pursuant to section 1(1) FOIA, subject to the redactions set out in the Closed Annex to this Decision. The Rule 14 Orders which apply to the Report are lifted in respect of the unredacted information only.

The appeal is allowed.