Moade Shubita v The Information Commissioner

This appeal concerns a request made to the University on 22 March 2023. The only part of the request that remains in issue is part 1 of the request:

In its response on 21 April 2023 the University provided some information in relation to parts 2 and 3 of the request. In relation to part 1 it refused to provide the race and gender of the applicants under section 40(2) FOIA. The University upheld its position on internal review in relation to parts 1 and 2 of the request. It upheld the internal review in relation to part 3 and provided further information on 19 June 2023.

In the course of the Commissioner’s subsequent investigation the University confirmed that:

In a decision notice dated 13 February 2023 the Commissioner decided that the scope of his investigation was:

The Commissioner concluded that the University had not recorded the race or gender of the applicants for the post. He concluded, on the balance of probabilities that this information was not held. Because the University did not confirm this to the appellant until four months after the request was made, the Commissioner recorded a breach of section 1(1)(a) FOIA.

The Commissioner was satisfied that the CVs and covering letters related to and identified the individuals involved. His view as that, even with the names redacted, the information as likely to contain information that could be used to identify the individuals involved. He concluded that the information was personal data within section 3(2) DPA.

The Commissioner accepted that the appellant had a legitimate interest in understanding application processes in general and a legitimate interest in the requested information.

The Commissioner does not set out his conclusion as to whether or not disclosure was necessary for the purpose of the legitimate interests, but notes the University’s argument that disclosure was not necessary given the other information available to the appellant.

The Commissioner concluded that individuals applying for a job would not reasonably expect their applications to be disclosed and that, however necessary the requested information is considered to be by the appellant, the fundamental rights and freedoms of the applicants override the appellant’s desire to scrutinise the application process.

For those reasons the Commissioner concluded that the University was entitled to rely on section 40(2) to withhold the information.

The Grounds of Appeal are, in essence, that the Commissioner was wrong to conclude that the University did not hold race and gender information about the other applicants.

The appellant also raises concerns about:

The main points of the Commissioner’s response are as follows.

The Commissioner submitted that the University has clearly explained that the information held is the CV and covering letter of applicants and this does not contain information on race or gender.

Even if the University’s position that it does not hold this information could appear to contradict the ‘job opening’, this does not establish that race or gender information is held.

The Commissioner reiterated his findings at paragraph 24 of the DN:

For the reasons provided in the DN, the Commissioner submitted that there is insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. In particular, the Commissioner remained of the view that there are more appropriate routes to resolve the Appellant’s concerns, as opposed to disclosure of CVs and covering letters submitted by other applicants into the public domain:

The appellant submitted that the core issue is the fact that the University had confirmed that they held the information but refused to disclose it. Further the appellant noted that the opening for the job advert invites ethnic minorities to apply. In the light of this it is argued that the University must hold information about race and gender.

Section 1(1) FOIA provides:

The scope of a request is determined objectively, in the light of all the surrounding circumstances.

The question of whether information was held at the time of the request is determined on the balance of probabilities.

The relevant parts of section 40 of FOIA provide:

Personal data is defined in section 3 of the Data Protection Act 2018 (DPA):

The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.

The only potentially relevant basis here is article 6(1)(f):

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:

Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:

Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The issues for the tribunal to determine are:

The tribunal read an open bundle. We also read and took account of:

We took into account oral submissions made by the appellant.

In his submissions the appellant confirmed that he challenged the Commissioner’s conclusions both in relation to whether information was held and in relation to the application of section 40(2).

The appellant confirmed that although in his notice appeal he had stated that ‘it came to [his] attention that the other two candidates who applied for the same post were white females’, this was only informally mentioned ‘in passing’ and he wanted a formal record of the other candidate’s race and gender.

The appellant drew the tribunal’s attention to a letter from the University dated 10 April 2024 which confirmed that the University held the appellant’s special category personal data namely his gender, ethnicity, religion and sexual orientation and that this data had been provided to an external assessor at Warwick University as part of the job application process. The appellant submitted that in this letter the University admit that they hold the information for one of the applicants and he questions why that is not held for the other applicants.

The appellant was asked by the Judge about how University had come to hold his special category data, and whether he had been asked for that data as part of the application process. The appellant confirmed that he had chosen to include that information in his application because in the advert for the post the University had said that they welcomed applications particularly from black and minority ethnic candidates. On this basis he said that he expected that anyone who applied should or would share such information by default. He said that there was no specific applicant form to complete, instead applicants were required to upload their own documents (a cover letter and a CV).

The appellant also raised his concerns about the University’s failure to disclose an email/the deletion of an email containing a scoring sheet in relation to the appellant himself that he had requested in a subject access request.

First, it is important to note that we are unable to consider the handling by the University of the appellant’s data subject access request. We cannot therefore make any findings in relation to the concerns that the appellant raises about the deletion or non-disclosure of an email containing a scoring sheet relating to him.

Second, the appellant raises concerns about the fact that the Commissioner has, on the one hand, found a breach of section 1 FOIA and on the other hand, has accepted that the University did not hold the requested information and has ordered no steps. Whilst we understand that the University’s change of position is frustrating for the appellant, there is no inconsistency in the Commissioner’s decision.

The Commissioner has recorded that there is a breach of section 1, because the University’s initial response wrongly stated that the information was held and that it was subject to an exemption. By the time of the decision notice, this had been corrected, so it was appropriate not to order any steps to be taken. In our view there is no error in this approach.

FOIA gives a right to recorded information. Information that is simply held in the mind of an employee is not recorded information. If a public authority holds the ‘building blocks’ of raw data from which the requested information can be easily derived, then it does not matter that it is not held in the particular form requested.

In this case, we do not accept that the gender or ethnicity of the other candidates can be derived from the CVs or application forms or indeed any record of the online discussion with the other candidates unless they have explicitly stated their gender or ethnicity in their application, like the appellant did, or in the online discussion.

We do not accept that ethnicity or gender can be derived from, for example, someone’s name, title or appearance. Whilst a title or a name or someone’s appearance can be indicative of a particular gender or ethnicity, it is not necessarily so, and therefore we do not accept that these would amount to a record of that person’s gender or ethnicity.

Although the job advert stated that it welcomed applications particularly from black or ethnic minority candidates, individual applicants were not asked or required to specify their gender or ethnicity. There was no form to fill in with boxes for gender or ethnicity. The fact that the appellant chose to provide this information does not mean that other applicants did so. The fact that the University holds this data in relation to the appellant, because he chose to include it in his application, does not indicate that they hold it in relation to the other applicants.

The University has stated, belatedly, that it does not hold recorded information on the other applicants’ gender or race. It states in a letter to the Commissioner dated 22 August 2023 that:

It is extremely unfortunate that the University did not check whether or not it held the requested information when the request was made. It should not have confirmed that it held the information without knowing whether or not that was the case. It should not have relied on an exemption to withhold information before checking it if held that information. It is unacceptable to inform a requestor 5 months later that the information is not held after all.

However, we are not prepared to infer from this inconsistency that the information set out in the letter of 22 August 2023 is untrue. It is more likely, in our view, to be a case of incompetence than a case of the University deliberately trying to mislead the tribunal.

We accept, on the balance of probabilities, that the other applicants did not reveal their race or ethnicity in the cover letters, CVs or in the online discussion. On that basis we find, on the balance of probabilities, that the University does not hold recorded information on the race or ethnicity of the other applicants.

We accept that the CVs and cover letters of the other applicants are personal data. Even if the applicants’ names were redacted, a CV and a cover letter are likely to contain personal information that would allow at least some members of the public to identify the individual concerned. The information in a CV and cover letter clearly relates to that individual. For those reasons we conclude that the requested information is personal data.

We accept that the appellant is pursuing legitimate interests. First, he wishes to know the gender and ethnicity of the other candidates. Second, he is concerned that the application process was not conducted fairly.

We do not accept that it is reasonably necessary to disclose the CVs and cover letters of the other applicants to the world for the purposes of those interests. First, they do not contain a record of the gender and ethnicity of the candidates and therefore they do not serve the first legitimate interest. Second, there are ways of challenging the conduct of the application process by the University that do not need the disclosure of the CVs and cover letters.

For example, the appellant does not need the CVs and cover letters in order to pursue a claim in the employment tribunal. Employment tribunals have their own powers to order disclosure of relevant documents, and the respondent in those proceedings will have to disclose any documents which support or adversely affect the appellant’s case in the employment tribunal.

In addition, the appellant can challenge the University’s approach to his application without seeing the CVs and cover letters of the other applicants. We note that in the notice of appeal the appellant states ‘Upon following up the matter and via internal processes, the outcome found a breach of applying the policy’. The appellant does not need to see the cover letters and CVs to make a complaint to the University or raise a grievance about the processes followed.

For those reasons we conclude that disclosure under FOIA is not necessary for the purposes of the legitimate interests and we do not need to go on to consider if those interests are overridden by the interests or fundamental rights and freedoms of the data subjects. We agree with the Commissioner that the University was entitled to withhold this information under section 40(2) FOIA.

For all those reasons the appeal is dismissed.