James Mooney v The Information Commissioner

Under section 40(2) of FOIA, information is exempt from disclosure if it is the personal data of someone other than the requester and a condition under section 40(3A) is satisfied.

In this case, the relevant condition is contained in section 40(3A) (a). This applies where disclosing the information to any member of the public would contravene any of the principles relating to the processing of personal data (‘the DP principles’), as set out in Article 5 of the UK General Data Protection Regulation (‘UK GDPR’).

First, the Commissioner must determine whether the withheld information can be categorised as ‘personal data’ as defined by the Data Protection Act 2018 (‘the DPA’). If it is not personal information, then section 40(2) of FOIA cannot apply.

Section 3(2) of the DPA defines personal data as: - “any information relating to an identified or identifiable living individual”.

An identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as their name. Information will relate to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus. The Council said that the withheld information was the personal data of the complainants, and of the councillor about whom they complained.

The Commissioner has acknowledged that the councillor is named in the request, and the complaint and hearing were about their alleged conduct. As the withheld information identifies and relates to the councillor, it is clearly their personal data.

However, the Council says that it has recently received the councillor’s consent to disclose their personal data in response to this request. It says it has disclosed as much of their personal data as it is able to, without breaching the privacy rights of the third parties who made the complaint.

The Council says the councillor’s remaining personal data cannot be disclosed because it is inextricably intertwined with the personal data of the third parties who made the complaint against the councillor; it says that the remaining information is therefore exempt from disclosure under section 40(2) of FOIA.

The third parties who made the complaint are not identified in the information the Council has published on its website, but they are repeatedly named in the withheld information, and they are frequently referred to by their position within the Council and their relationship to the councillor. For the same rationale set out in paragraph 35, the Commissioner is satisfied that the withheld information comprises their personal data. However, unlike the councillor, the Council does not have the consent of the third parties to disclose their personal data in response to the request.

Although not raised by the Council, the Commissioner notes that the withheld information also includes the names and contact details of Council staff who administered the Council’s handling of the complaint. Clearly, this is also their personal data.

The second element of the test is to determine whether disclosing the information would breach any of the DP principles. The most relevant principle is that under Article 5(1)(a) of the UK GDPR.

Article 5(1)(a) of the UK GDPR states that: “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

In the case of an FOIA request, personal information is processed when it is disclosed in response to the request. This means that the information can only be disclosed if to do so would be lawful, fair and transparent.

In order to be lawful, one of the lawful bases listed in Article 6(1) of the UK GDPR must apply to the processing. It must also be generally lawful.

Article 6(1) of the UK GDPR sets out the requirements for lawful processing. It says that “processing shall be lawful only if and to the extent that at least one of the” lawful bases for processing listed in the Article applies.

The Commissioner considers that the lawful basis most applicable is basis 6(1)(f), which states: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

When he considers the application of Article 6(1)(f) of the UK GDPR in the context of a request for information under FOIA, the Commissioner has to consider the following three-part test: Legitimate interest test: Whether a legitimate interest is being pursued in the request for information; Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; and Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of those who made complaints against the councillor and the Council staff who administered the complaints and subsequent hearing (‘the data subjects’).

The Commissioner considers that the test of ‘necessity’ must be met before the balancing test can be applied. If it cannot be met, the processing will be unlawful.

In considering any legitimate interest(s) in disclosing the requested information under FOIA, the Commissioner recognises that such interest(s) can include broad general principles of accountability and transparency for their own sakes, as well as case-specific interests.

A wide range of interests may also be legitimate interests. They can be the requester’s own interests, the interests of third parties, commercial interests as well as wider societal benefits. They may be compelling or trivial, but trivial interests may be more easily overridden in the balancing test.

The Appellant has an interest in this information which stems from his belief that the complaint against the councillor may have been maliciously motivated, and that the hearing panel may not have followed proper procedures.

As regards the Council’s position, it told the Commissioner: - “The Council has identified certain legitimate interests in the release of this information. There is a level of transparency required by the Council due to its public facing nature. There is also a legitimate interest in the conduct of its councillors who are elected on behalf of the public and a higher level of transparency and scrutiny is therefore required.”

The Commissioner acknowledges that there is a wider legitimate interest in transparency, regarding the Council’s handling of conduct complaints against elected officers. The Commissioner therefore agrees that disclosure of the information in this case would go some way towards informing the public about the Council’s response to, and handling of, complaints about elected members.

Therefore, the Commissioner recognises there is a legitimate interest in

Necessary’ means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity and involves considering alternative measures which may make disclosure of the requested information unnecessary. Disclosure under FOIA, (which is to the world at large) must therefore be the least intrusive means of achieving the legitimate aim in question.

The Commissioner accepts that disclosing the withheld information about the complaint and the hearing, insofar as it contains the third-party complainants’ personal data, would be necessary to meet the complainant’s legitimate interest and, to a lesser degree, the more general interest of transparency.

However, he can see no equivalent argument that disclosing the names and contact details of non-senior Council staff, whose contact details are not in the public domain in connection with this matter, is necessary to meet the interests of transparency. Their details would add nothing to the public’s understanding of the matter or its handling by the Council, and the information in scope is not diminished by their details being omitted.

The Commissioner is therefore satisfied that disclosure of the names and contact details of Council staff is not necessary to meet the legitimate interests identified above. As the Commissioner has decided that their disclosure is not necessary, he has not gone on to conduct the balancing test. As disclosure is not necessary, there is no lawful basis for this processing, and it is unlawful. It therefore does not meet the requirements of principle (a).

In view of the above decision, the Commissioner need only consider the balancing test in respect of the third-party complainants’ personal data.

In balancing the complainant’s legitimate interests and the data subjects’ rights and freedoms, it is necessary to consider the impact of disclosure. For example, if the data subjects wouldn’t reasonably expect that their personal data would be disclosed to the public under FOIA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override legitimate interests in disclosure.

When conducting the balancing test, in the Commissioner’s view, a key issue is whether the data subjects would have a reasonable expectation that their information will not be disclosed. These expectations can be shaped by factors such as an individual’s general expectation of privacy, whether the information relates to an employee in their professional role or to them as individuals, and the purpose for which they provided their personal data.

It is also important to consider whether disclosure would be likely to result in unwarranted damage or distress to those individuals.

The Commissioner has found in this case that the requested information is the personal data of third parties. Although the information relates to them in their professional capacity, the Commissioner is satisfied that they would reasonably expect that information about them, and the complaints they had submitted (which had been withheld from proactive publication under the LGA), wouldn’t be disclosed to the wider world. As such, disclosing this information under FOIA would be likely to cause them harm or distress. It may also deter them, and others, from making such complaints in future, due to fear of disclosure to the world at large under FOIA.

There is some public interest in how public officials behave and carry out their elected roles, and in how the Council deals with complaints against them, which the requested information may shed a little light on. However, a summary of the issues considered by the hearing, and the outcome, have been placed in the public domain; the Commissioner considers the general interest in transparency to be served by this to a considerable degree. Furthermore, the councillor who was the subject of the complaints is free to pursue appeals mechanisms if they consider they were dealt with unfairly or unreasonably by the Council. To the Commissioner’s knowledge, they have not done so.

The Commissioner is therefore satisfied that the Appellant’s interest and the general interest in transparency, while legitimate, aren’t sufficient to outweigh the data subjects’ fundamental rights and freedoms in this case.

The Commissioner therefore finds that there is no Article 6 basis for processing and so disclosing the third parties’ personal data would not be lawful. Given the above conclusion that disclosure would be unlawful, the Commissioner does not need to go on to consider separately whether disclosure would be fair or transparent.

The Commissioner’s decision is therefore that the Council was entitled to withhold the requested information under section 40(2) of FOIA, by way of section 40(3A) (a).

The Council exceeded the 20-working daytime for compliance when responding to the request. This is a breach of sections 1 (General right of access) and 10 (Time for compliance) of FOIA.

The Commissioner has logged this breach for monitoring purposes.

The Commissioner found: -

In his grounds of appeal signed and dated 31 January 2024, the Appellant stated as follows; “Establish in hierarchy terms if the request for information relating to decisions by public funded bodies including Local Authorities that places the health, safety, wellbeing and quality of life of UK citizens must be declared supreme and overrides any and all exemptions including those in the FOIA”.

The appeal does not provide any arguments as to why s40(2) should not apply to his request, nor argue that the Commissioner's Decision is wrong in law or that discretion should have been exercised differently.

Indeed, the thrust of the appeal appears to be that it doesn't matter whether the requested information is exempt under s40(2) because FOIA should in any case be overridden by Health and Safety Concerns in what he describes as a 'hierarchy of legal obligations' in which Health and Safety legislation should reign supreme; - he says that with no duty of care or statutory obligations to consider the health, safety and wellbeing of UK citizens when undertaking their duties.

The Appellant's desired outcome appears to be for the Tribunal to rule that such a hierarchy of legal obligations does, or should, exist. Such a ruling is not within the Tribunal's jurisdiction, and we cannot consider such matters.

The requested information is unquestionably the personal information of third parties. The Appellant has failed to provide any evidence or arguable grounds to dispute the evidence and rationale on which the DN has been based. We agree, accept and endorse the Commissioner's carefully reasoned DN. 

The only remaining disputed information in scope of this appeal is the personal data of third parties named in the requested documentation. The Tribunal notes that the Council disclosed relevant information from which Councillor Baxter could be identified, following receipt of his consent to do so on 28/7/23 (see email at OB, p.240).

From the Appellant's grounds of appeal and submissions there appears to be no dispute that section 40(2) applies. The tribunal make this ruling, as the remaining disputed information clearly contains the personal data of identifiable individuals.  

The Appellant's identified legitimate interests appear to be that: "... the decisions by SKDC are placing the life and quality of life of UK citizens at risk which is a criminal offence in violation of safety legislation."  

The Council have identified some legitimate interests in disclosure, including: " ..level of transparency required by the Council due to its public facing nature... the conduct of its councillors who are elected on behalf of the public and a higher level of transparency and scrutiny is therefore required." (see OB, p.306).

The Council have identified several legitimate interests in support of withholding the requested information. At OB, para.9, p.306 they say: " There is the possibility that disclosure could lead to damage to the individuals [sic] reputation and would certainly lead to a level of distress as the information a [sic] was provided with a view of it being confidential to the extent that the individuals would not be identified."

They go on to say at para.10 of the same page: "...the release of the information is likely to lead to a level of distress and may deter individuals from making complaints against Councillors in future."

Having considered these factors, we have gone on to consider whether disclosure is necessary for the purposes of the legitimate interests identified. We note in particular that the Council have now disclosed a considerable amount of information regarding the allegations against Councillor Baxter, including the outcome of the investigation. This is described, in part, at OB. P.306, para.5 as follows: 

The Tribunal find that the decision that was published is sufficient for people to understand the nature of the complaint against Cllr. Baxter and the outcome of the investigation.

It is far from clear how the Appellant has established that disclosure of the disputed information would further the legitimate interest identified by him (i.e. that decisions made by the Council are placing "...the life and quality of life of UK citizens at risk which is a criminal offence in violation of safety legislation."  The Tribunal find this does not relate at all to the content of the requested information, which is about a complaint made against a councillor of the Council in relation to his conduct.

In light of this and the fact that the Council have placed information into the public domain about the investigation and outcome of the complaint against Councillor Baxter, we find that disclosure is not necessary for the identified legitimate interests.

Consequently, the First Data Protection Principle, set out in Article 5(a) of the UK General Data Protection Regulations is not satisfied. 

Having decided that disclosure is not necessary, we do not need to go on and consider the balancing exercise. However, it is clear to us, given the legitimate expectations of the data subjects and the confidential nature of the complaints process, that the balance would be clearly in favour of upholding those rights and freedoms.

As the Commissioner correctly observed and argued at §18 of his Response (see OB, p.192): “The Commissioner submits that the Appellant’s concerns regarding health and safety matters are separate to FOIA considerations and are not matters which can be determined by a Tribunal in a section 57 FOIA appeal. The Commissioner cannot look into allegations of misconduct.”

In his Notice of Appeal, the Appellant noted at part 7 (Reasons for your appeal) see §64 above: Such an outcome is beyond the jurisdiction of this Tribunal. Our remit is founded in section 58, FOIA and we cannot go beyond that.

Accordingly, we are not persuaded there is any error of law in the DN nor in the Commissioners exercise of his discretion therein and we in a collegiate and unanimous decision must dismiss this appeal.