Dimitri Shvorob v The Information Commissioner

This appeal concerns a request made to the Council on 22 March 2023:

The Council responded on 27 April 2023. The Council confirmed that it held the information requested in part 1 but withheld it under section 40(2) FOIA. In relation to part 2 of the request the Council said that it did not hold the information because no section 32 applications were rejected in 2022.

In the appellant’s request for an internal review dated 30 April 2023, he noted, inter alia, that the request was for anonymised information. The Council upheld its position on internal review.

During the course of the Commissioner’s investigation the Council:

This change in position was confirmed to the appellant in writing.

In a decision notice dated 30 October 2023 the Commissioner concluded that the Council was entitled to rely on section 40(2) FOIA.

The Commissioner concluded that the withheld information contained details of the perceived threat and of the individuals involved and also contained some information that the Commissioner considered would be special category data about identifiable individuals. He concluded that the information was personal data.

In relation to the special category data, the Commissioner concluded that there was no legal basis for disclosure because there was no explicit consent and the data had not been made manifestly public by the data subject/s. This information was therefore exempt under section 40(2).

In relation to the information that was not special category data, the Commissioner accepted that the appellant had a legitimate interest in the information because disclosure would shed light on any ‘rubber stamping’ or abuse of section 32 of the Localism Act.

The Commissioner was not satisfied that disclosure was reasonably necessary because he concluded that there were less intrusive means of achieving the legitimate aims, namely filing a complaint and asking for the matter to be investigated and, if appropriate, referring to the Ombudsman.

The Commissioner held that the majority of the information was special category data and once such data had been removed the remaining information would only provide a partial picture of how the process operated.

Further, the Commissioner noted that all councillors, whether they have applied for an exemption or not, are subject to section 31. They are prevented from discussing or voting on matters in which they have a financial interest irrespective of whether the interest is or is not published. The Monitoring Officer is responsible for ensuring that interests are properly declared and that councillors recuse themselves where appropriate. Further each councillor’s entry shows where the exemption has been applied, which for most councillors relates to land they own or lease in the borough.

If a person suspected that a particular councillor had taken advantage of an interest not being published and taken part in a decision in which they had a financial interest, that person would be able to raise the matter with the Monitoring Officer and, if necessary, with the Ombudsman. This still allows councillors to be held to account without revealing their personal data to the world at large.

Having concluded that disclosure was not reasonably necessary, the Commissioner did not go on to consider whether disclosure would be fair or transparent.

As the Commissioner was satisfied that the information was exempt under section 40(2) FOIA, he did not need to consider section 44.

The Grounds of Appeal are, in essence, that the Commissioner was wrong to conclude that the information was exempt under section 40(2). The appellant highlights that the request is for anonymised data and questions the “’sensitive information’ defence”.

In essence the Commissioner relied on and repeated the reasoning in his decision notice.

In addition the Commissioner submitted that anonymisation was not capable of rendering the individuals non-identifiable.

The appellant submitted, in summary, that it was possible to render the data subjects non-identifiable. He also reiterated the public interest in disclosure.

The appellant was provided with further information on the contents of the closed bundle in an order dated 9 May 2024. In response to that information the appellant provided further submissions in which he repeated his submission that it would be possible to share the withheld information if it was suitably redacted. He stated that his interest was in whether any ‘case-specific’ reasoning was provided by the councillors.

The relevant parts of section 40 of FOIA provide:

Personal data is defined in section 3 of the Data Protection Act 2018 (DPA):

The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA [2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.

In Durant, Auld LJ, giving the leading judgment said at [28]:

In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:

The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider:

‘Identifiable’ means a living individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data (NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192 (AAC)).

The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.

The only potentially relevant basis here is article 6(1)(f):

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:

Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner[2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:

Article 9 UKGDPR provides, relevantly, as follows:

Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The issues for the tribunal to determine are:

The tribunal read an open and a closed bundle.

The appellant’s request, in effect, is for any recorded information held by the Council, ‘suitably anonymised’, which contains the justifications put forward by ten councillors, who are named in the request, for the publication exemption provided under section 32 of the Localism Act.

There is no recorded information containing the justifications put forward by four of the councillors, because they were put forward orally and no written record was made of the discussions. The Council should have given a ‘not held’ response to the request in so far as it related to these councillors. The Council confirmed to the appellant in writing in the course of the Commissioner’s investigation that this information was not held and the appellant raises no issue about this in his grounds of appeal.

In relation to one of the remaining councillors the justification is not withheld because it is in the public domain.

There remain five councillors by whom justification for the section 32 exemption was put forward in writing. That is the information that has been withheld and is in issue in this appeal.

We consider first whether the information, in unredacted form, is personal data in the sense that it relates to an identifiable individual. We then consider if it is possible to anonymise that data so that it no longer relates to an identifiable individual.

Each justification consists of an individual set of circumstances that are specific to each councillor. The information, in relation to each councillor, is clearly about that individual. In each case it relates to that individual’s personal life and has biographical significance and has impact on that individual in a personal capacity. In some cases it refers to the characteristics, identity or behaviour of that individual. On that basis we find that the information relates to each individual.

It goes without saying that if the information were released without any redactions, each councillor would be identifiable, because the information is contained in an email from that individual councillor containing the councillor’s name.

However, the request is for ‘suitably anonymised data’ and therefore we must consider if it is possible to provide the justifications in anonymised form, i.e. so that a councillor cannot be identified.

We consider first whether the councillors would be identifiable if just their names and email addresses were redacted. ‘Identifiable’ means an individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data.

The individuals that have relied on section 32 are named in the request, and also identified in the Council’s public register of interests. However, it is not sufficient to say that this is a small pool of individuals and that the public might be able to bridge the gap between the information and the data subject by means of speculation.

Accordingly the tribunal has considered whether, in relation to each individual councillor, it is possible to identify that particular individual using the information contained in the justification, any information in the public domain and any information that could be obtained by a ‘motivated intruder’. It is also legitimate to take account of information that is likely to be known to particular groups of people, including, for example, those in the councillor’s ward and/or the friends, colleagues and family of the individual councillors.

Having considered each specific justification put forward we find that the particular personal nature of each of those justifications, combined with other information that is likely to be known to particular groups of people, would allow some groups of people to identify which one of the five named councillors had put forward that particular justification.

We have considered whether it is possible to further redact the justifications to remove any facts which would enable identification. However, the justification put forward,in each case, is the personal facts relating to that individual. Without those very personal facts, there is no justification to disclose.

For those reasons we conclude that it is not possible to ‘anonymise’ the data, in the sense that we find that any information within the scope of the request renders the individual identifiable.

On that basis we agree with the Commissioner that the requested information is personal data.

We do not agree with the Commissioner that the ‘majority’ of the withheld information is special category data.

In relation to one of the councillors the justification provided is special category data. The tribunal considers that one of the other justifications may be special category data but it is not possible to determine that from the information provided and we have therefore not considered it under this heading.

There is no evidence of consent or that the special category data has been manifestly made public by the councillor in question, and this information is therefore exempt under section 40(2).

In relation to the remaining councillors, we accept that there is a legitimate interest in disclosure. There is a legitimate interest in shedding light on whether the legislation was being complied with, specifically whether or not the Monitoring Officer has been ‘rubber-stamping’ the reasons put forward by councillors in their justification and whether generic or ‘case-specific’ reasoning had been put forward/accepted.

We take a different view from the Commissioner in relation to necessity. In our view, disclosure is reasonably necessary for the above legitimate interest because without sight of the justifications, it is not possible to ascertain whether generic reasons or case-specific reasons had been put forward.

Although we have taken the view that disclosure is reasonably necessary for the purposes of the particular legitimate interests put forward by the appellant, in considering whether these interests are overridden we note that there is already a level of transparency in relation to the application of section 32 of the Localism Act.

The fact that section 32 has been applied in relation to a particular councillor is public. The statutory test that has been applied is also public. The exemption from disclosure in section 32 is expressly limited to circumstances where a councillor and the Monitoring Officer consider that the interests in question are sensitive, i.e. that its publication could lead to persons being subject to violence or intimidation. The Monitoring Officer and councillors are not unaccountable when applying that test. A complaint can be made in relation to a councillor’s conduct. If there are concerns about whether a Monitoring Officer is performing their role properly, a complaint can be made to the Council and it may be within the remit of the Local Government and Social Care Ombudsman.

Taking into account the personal nature of the justification put forward, and the inherent link between those facts and a risk of violence or intimidation, we find that the data subjects would have had a reasonable expectation that the facts put forward to justify the application of section 32 would not be made public by the Council. Further, in the context of the sensitive nature of the information and asserted risks of violence and intimidation, we find that disclosure would be likely to cause upset and could potentially lead to a risk of harm. In those circumstances we take the view, in relation to each of the five councillors in question, that the legitimate interests in disclosure are overridden by the fundamental rights and freedoms of each data subject.

For those reasons we conclude that the information is exempt under section 40(2) FOIA and the appeal is dismissed.