Ronald Warren Foster v The Information Commissioner & Anor

The appeal is dismissed.

The appellant claims that he was the victim of financial fraud following the theft of his mobile phone. Essentially, he asserts that the person(s) who stole his mobile phone were able, by using information stored on the phone and mobile banking Apps for accounts with HSBC and Revolut, to apply for and obtain a £10,000 loan from the lender Lendable, and to purchase goods online from retailer Argos. We note that Argos is owned by Sainsbury’s and references to Sainsbury’s in this decision should be read as also referring to Argos.

The request for information arises as a result of this alleged fraud. The appellant engaged with both banks and the lender involved and claimed that all the activity was fraudulent. Neither bank accepted that they were liable to reimburse the appellant. Chargeback on items purchased from Argos was refused. He lodged a complaint to the second respondent (the FOS) in July 2022.

On 21 October 2022 the FOS did not uphold the appellant’s complaint against Revolut on the basis that it was considered unlikely that a third party could have accessed his mobile phone and banking Apps. The appellant disagreed with the outcome and asked for a review of the decision by the Ombudsman. In addition, the appellant asked the FOS to provide a copy of the Argos collections report pursuant to the Freedom of Information Act 2000 (FOIA). The terms of the request were as follows:

The appellant had a verbal discussion about the matter on 26 October 2022 during which an FOS investigator made the appellant aware of the nature of the goods that had been purchased at Argos. They included high value Apple computers and baby equipment, which were collected from Argos in Hulme, Manchester. The appellant states that during the telephone call he requested information detailing the ‘collection of goods from Argos Manchester Hulme, time of collection and goods collected’.

The FOS investigator stated that they did not have information about the time of collection of orders and in any event, did not consider that the information was relevant to whether a third party had been able to access the appellant’s phone or banking Apps. The appellant stated that he would nevertheless like a copy for his records.

On 31 October 2022 the FOS investigator advised the appellant that Argos had declined to allow the FOS to provide him with the collection report. The appellant responded, asserting that he had the right to be provided with the information pursuant to the Data Protection Act 2018 (the DPA).

The FOS provided its final decision on the appellant’s complaint against Revolut on 20 December 2022. The Ombudsman concluded that the transactions were authorised, and that the appellant was therefore liable for them. Around the same time, the appellant also received the outcome of his complaint to the lender who concluded that there was insufficient evidence that the appellant had been a victim of fraud and that he remained liable for the £10,000 loan.

The appellant’s complaints against HSBC and Lendable were assigned to a different investigator at the FOS. The appellant states that the investigator indicated that they believed there had been a failing on the part of Argos in respect of the requirement to see proof of identity when the goods were collected, but that as his complaints did not relate to Argos, the FOS could do nothing about that. The appellant states that he requested to see the collection report from Argos but was again advised that it could not be released to him.

The FOS’s decisions on the appellant’s complaints against Lendable and HSBC were given on 30 June 2023. It was concluded that it was more likely than not that the appellant had consented to the loan. The appellant disagreed and asked for the decisions to be reconsidered. The request for reconsideration remained outstanding at the time the appellant lodged this appeal.

On 18 August 2023 the appellant made a direct request to Argos for information relating to the collection of the disputed items on 5 June 2022. There was further correspondence which resulted in Argos treating his request as a subject access request and he was advised that he could expect a response within 30 days.

On 22 August 2023 the appellant wrote to the FOS and made the following request:

The FOS responded the same day and advised that the information requested could not be released under FOIA, but that it would share information to which the appellant was entitled under a subject access request. The appellant made a subject access request seeking disclosure of the Argos collections report and requested an internal review of the FOIA response.

Also on 22 August 2023 the appellant contacted the Information Commissioner (the Commissioner) to complain about how his request for information had been handled. At that stage no internal review had been carried out.

On 12 September 2023 the FOS reviewed its decision maintaining that the requested information was the appellant’s own personal data and therefore could not be released under FOIA.

In an email dated 18 September 2023 a subject access request advisor within the FOS advised the appellant that it could not share information it had obtained from Revolut which had in turn been supplied with the information by Argos on the basis that it was commercially sensitive information shared by the business in confidence. The response further stated:

Having received that response, the appellant contacted the Commissioner for advice on 2 November 2023. The appellant advised the FOS that the Commissioner stated that the fact that information was commercially sensitive shared in confidence was not an exemption under either FOIA or the DPA and asked the appellant for further information. The appellant duly requested clarification from the FOS as to the exact basis on which it was continuing to withhold the requested information. The FOS relied on the passage set out above and stated that it applies to all subject access requests.

Having been made aware of the appellant’s appeal, the FOS contacted Sainsbury’s on 21 December 2023. The FOS advised Sainsbury’s that although it had applied exemptions under FOIA and the DPA, it considered that the requested information was correctly withheld under FOIA, but that as it was personal data relating to the appellant, disclosure should be made under the DPA. The FOS reassured Sainsbury’s that if concerns about releasing the information related to the fact that it contained the personal data of Sainsbury’s employees, that data would be redacted.

On 22 December 2023 Sainsbury’s responded to the FOS and confirmed that the requested information could be shared with the appellant on the basis that it is his own personal data. It apologised for its unclear advice given previously.

As a result, the requested information was provided to the appellant on 14 January 2024.

The Commissioner gave his decision on 16 October 2023 and gave the following reasons:

The appellant lodged an appeal against the Commissioner’s decision on 8 November 2023. In his grounds of appeal, he argues:

The Commissioner contends that no part of the appellant’s case has any reasonable prospect of success and submits that it should be struck out pursuant to rule 8(3)(c) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (the Procedure Rules).

We note that the tribunal refused the Commissioner’s request to strike the appeal out on 16 January 2024 on the basis that it was not possible to conclude that the appeal had no realistic prosect of success without having seen the withheld information.

In respect of the withheld information, the Commissioner maintains that it is clearly information from which the appellant could be identified and is therefore his personal data within section 3(2) of the DPA. The absolute exemption in section 40(1) of FOIA was therefore correctly applied.

In its response, the FOS states that it attempted to resolve this appeal informally by providing the appellant with the withheld information. The appellant was invited to withdraw his appeal but refused to do so. The FOS submits that the appeal has become academic and that it should therefore be dismissed.

In respect of the submission that the appeal ought to be dismissed because it has become academic, the FOS cites the test in R (Salem) v SSHD [1999] UKHL 8; [1999] 1AC 450; [1999] 2 All ER 42; [1999] 2 WLR 483 (HL):

The FOS submits that the test set out in Salem is not met because there is no public interest in determining the appeal and because the case does not give rise to a discrete point of statutory construction which does not involve a detailed consideration of facts. The FOS submits that the issue in the appeal would involve the tribunal making findings of fact as to whether the requested information is personal data relating solely to the appellant or whether it includes personal data relating to another data subject. The FOS further submits that this is not a case where a large number of similar cases exist or are anticipated such that the issue will need to be resolved in the future.

In relation to the substance of the appeal, the FOS relies on the Commissioner’s reasons given in the decision notice. The FOS submits that the information was correctly withheld pursuant to section 40(1) of FOIA.

The FOS notes the appellant’s contention that the personal data in the withheld information includes an email address and a telephone number which he contends are not his, but relies on the final decision of the Ombudsman in which it was found that it was unlikely that an unknown third party was involved without the appellant’s consent.

The FOS submits that regardless of the email address and telephone number, the withheld information contains the appellant’s name and address which are his own personal data pursuant to section 3(2) of the DPA, and on that basis the absolute exemption in section 40(1) of the DPA was applied.

Section 1(1) of FOIA provides that a person who makes a request for information to a public authority is entitled to be informed in writing about whether the requested information is held and, if so, to have that information communicated to them.

The duty to provide requested information does not arise where the information is exempted under Part II of FOIA. Exemptions are either absolute or qualified. Where a qualified exemption applies, the information will only be exempt from disclosure if the public interest in maintaining the exemption outweighs the public interest in disclosing the information. Absolute exemptions are not subject to this public interest test. Section 40 of FOIA is relied on in this case. Section 40(1) contains an absolute exemption and section 40(2) contains a qualified exemption.

Section 3(2) of the DPA defines personal data as ‘any information relating to an identified or identifiable living individual’.

The appellant requested that his appeal be determined on the papers without a hearing. The respondents agreed that a hearing was not necessary. We considered that it was possible for us to properly determine the issues without a hearing having regard to rule 21 of the Procedure Rules.

There are two issues in this appeal:

The starting point for our consideration is that the appellant has now been provided with the withheld information. There is no longer a dispute between the parties and the appellant’s argument about the applicability of section 40(2) is academic.

While we accept that the matter is of personal interest to him, the appellant has provided no evidence of any wider public interest and we find that there is none.

The appeal turns on its facts and does not raise a discrete point of statutory construction. The appellant’s argument turns solely on the factual matter of whether the withheld information contains solely his own personal data or whether it also contains the personal data of another individual. The answer to the factual question will resolve the issue of which exemption applies.

Given that the appeal turns on its own facts, this is not a situation where there is already a large number of similar cases or where a large number of similar cases is anticipated such that the issue is likely to need resolving in the future.

We find that appeal is academic and that the test in Salem is not satisfied. Accordingly, the appeal is dismissed.

Although we have dismissed the appeal, we consider that it is in the interests of justice to note that the requested information has not been provided in an easily legible format. It is in the interests of justice that the second respondent make best efforts to obtain a legible copy of the requested information and provide it to the appellant. The appellant should note that as the appeal has been determined, it is at an end and the tribunal will take no further action in relation to this.