Case Reference: EA/2023/0519
Information Rights
Decided without a hearing
Determined, by consent, on written evidence and submissions.
Considered on the papers on 30 May 2024
Before
JUDGE RECORDER CRAGG KC (sitting as judge of the FTT)
MEMBER ROSALIND TATAM
MEMBER DR PHEBE MANN
Between
EDWARD WILLIAMS
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision: The appeal is Dismissed
Substituted Decision Notice: No substituted decision notice.
REASONS
MODE OF HEARING AND PRELIMINARY MATTERS
The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.
The Tribunal considered an open bundle of 52 pages. We note that there is no CLOSED bundle in this case.
BACKGROUND
The Appellant requested information about damages and costs paid as a result of assaults on biologically female prisoners by biologically male prisoners in UK prisons. The Ministry of Justice (MOJ) refused to confirm or deny whether it held the requested information, citing the ‘neither confirm nor deny’ provision within section 40(5) of the Freedom of Information Act 2000 (FOIA) (the exemption for personal information).
On 20 July 2023, the Appellant wrote to the MOJ and requested information in the following terms:-
please disclose, in date order, a list all compensation/damages payments and legal costs made between 1 January 2017 and today, by you, to biologically female prisoners as a result of them being assaulted/sexually assaulted by a biologically male prisoner in a UK prison.
Disclose the TOTAL amount paid as compensation/damages payments made between 1 January 2017 and today, by you, to biologically female prisoners as a result of them being assaulted/sexually assaulted by a biologically male prisoner in a UK prison.
Later that same day, he clarified that the request ‘only refers to assault which took place in a woman's prison’. The MOJ responded on 17 August 2023. It refused to confirm or deny whether the requested information was held, citing the ‘neither confirm nor deny’ (NCND) provision under section 40(5B)(a)(i) of FOIA. The Appellant requested an internal review on 21 August 2023 , asking the MOJ to explain why confirming or denying whether it held the requested information would breach the UK General Data Protection Regulation (UK GDPR).
Following its internal review, the MOJ wrote to the complainant on 14 September 2023. It maintained that section 40(5B)(a)(i) FOIA applied, and stated that:
You have asked for an explanation why confirming or denying would breach the GDPR. This explanation has already been provided. It was explained that FOI is a public disclosure regime, not a private regime. This means that any information disclosed under the FOIA by definition becomes available to the wider public. If any information were held, or not held, confirming this would be to the world at large. If any information were held, (or not held), such information would constitute the personal data of that individual. To disclose this fact would breach the General Data Protection Regulation and/or the Data Protection Act 2018 principles.
You are aware that the First Tier Tribunal has this question under consideration (reference: EA/2023/0148), as you raised it in the context of an earlier Freedom of Information request [reference redacted]. We await the Tribunal’s decision.
The Appellant contacted the Commissioner on 15 September 2023 to complain about the way his request for information had been handled.
THE LAW
The law relevant to this appeal is as follows.
Section 1 FOIA provides that:-
General right of access to information held by public authorities.
Any person making a request for information to a public authority is entitled—
to be informed in writing by the public authority whether it holds information of the description specified in the request, and
if that is the case, to have that information communicated to him.
In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.
Section 40 FOIA provides as follows:
Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
Any information to which a request for information relates is also exempt information if—
it constitutes personal data which does not fall within subsection (1), and
The first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
would contravene any of the data protection principles, or
would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).
(4A) The third condition is that—
on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.]
(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—
giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—
would (apart from this Act) contravene any of the data protection principles, or
would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;
(b)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);
(c)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);
(d)on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.]
(6). . .
In this section—
• “the data protection principles” means the principles set out in—
(a)Article 5(1) of the GDPR, and
(b)section 34(1) of the Data Protection Act 2018;
• “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
• “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).
In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Articles 5 and 6 of UK GDPR provide (where relevant) as follows:-
Article 5 Principles relating to processing of personal data:
1.Personal data shall be:
processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
Article 6 Lawfulness of processing:
1.Processing shall be lawful only if and to the extent that at least one of the following applies:
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal
data, in particular where the data subject is a child.”
The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:-
If on an appeal under section 57 the Tribunal considers -
that the notice against which the appeal is brought is not in accordance with the law,
or
to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.
On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.
The burden of proof in satisfying the Tribunal that the Commissioner’s Decision Notice was wrong in law or involved an inappropriate exercise of discretion rests with the Appellant. Where there is a dispute of fact, the relevant standard of proof is the balance of probabilities.
THE DECISION NOTICE
The decision notice (IC-258600-Z7W1) is dated 27 November 2023. The Commissioner notes that the Appellant made a similar request to the MOJ, where section 40(5B)(a)(i) of FOIA was relied upon, albeit that the period for that request was from 2018 and not 2017, and the second part of the request (for the total figure) was not included in the first request.
This resulted in decision notice IC-196538-F9B5 being issued on 13 March 2023 where the Commissioner upheld the MOJ’s reliance on section 40(5B(a)(i) FOIA. At the time of the decision notice an appeal to the FTT was pending. We note that a decision in case EA/2023/0148 was issued on 3 January 2024, and we will refer this later in this decision.
The Commissioner states that:-
14…for the MOJ to be entitled to rely on section 40(5B) of FOIA to refuse to confirm or deny whether it holds information falling within the scope of the request, the following two criteria must be met:
• Confirming or denying whether the requested information is held would constitute the disclosure of a third party’s personal data;
and
• Providing this confirmation or denial would contravene one of the data protection principles.
On the first issue the Commissioner said as follows:-
16.The two main elements of personal data are that the information must relate to a living person and that the person must be identifiable.
Information will relate to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
It is initially noted that the request does not actually seek to know the number of victims, only any associated money damages and legal costs in respect of any claims they may have made. However, given the Commissioner’s knowledge from his involvement in the earlier decision notice, he is aware that the numbers of assaults are low. The Commissioner considers that those within the prison community will be aware of the victims thereby making them identifiable.
The Commissioner is therefore satisfied that these low numbers mean that any cost or damage-related information that may be held, would be their personal data and its disclosure (by confirmation or denial in this case) would make information about them available to the prison community.
Given the low numbers, the Commissioner considers that reidentification is likely and revealing something about the assault victim(s) would be possible through a confirmation or denial as to whether any costs or damages have been paid. As the Commissioner has already determined that the small numbers mean that those concerned are identifiable, even if it is only within the prison community, a confirmation or denial would reveal something about them.
For the reasons set out above the Commissioner is satisfied that if the MOJ confirmed whether or not it held the requested monetary information this would result in the disclosure of a third party’s personal data. The first criterion set out above is therefore met.
In relation to the second issue and the application of the relevant parts of Articles 5 and 6 UK GDPR (as set out above), the Commissioner said as follows:-
25…When considering whether confirmation or denial of the requested information would be lawful, the Commissioner must consider whether there is a legitimate interest in disclosing the information, whether disclosure is necessary, and whether these interests override the rights and freedoms of the individual that the personal information relates to.
The Commissioner accepts that there may be some legitimate interest in the MOJ being open and transparent about information it holds regarding the subject matter; this is particularly so as it may involve a cost to the public purse.
The Commissioner must next consider whether it is necessary to issue a confirmation or denial under FOIA. He is not aware that the necessity test could be met by any means other than under FOIA.
However, it is necessary to balance the legitimate interests in confirming whether or not the requested information is held against the relevant individuals’ interests, fundamental rights, and freedoms. In doing so, the Commissioner must consider the impact of the confirmation or denial.
A request that is being considered under FOIA concerns a disclosure to the public at large, and therefore to any person. The Commissioner must therefore consider the wider public interest issues and fairness to the relevant individuals to whom the request relates when deciding whether or not to confirm or deny if the information is held.
It is the Commissioner’s view that the individuals who can be identified from the request would not have any reasonable expectation that information about whether or not they had made any claims or been awarded any damages would be placed into the public domain.
In addition, in the Commissioner’s opinion, to confirm or deny whether information is held may cause such individuals damage and distress.
The Commissioner concludes that there is insufficient legitimate interest in this case to outweigh the relevant individuals’ fundamental rights and freedoms. He therefore considers that disclosure of personal information which confirms whether or not the requested information is held would not be lawful in this instance.
THE APPEAL AND RESPONSES
The Appellant’s appeal is dated 27 November 2023. He states:-
The following were errors of law –
The Commissioner’s decision is that the MOJ has properly relied on section 40(5B)(a)(i) of FOIA to refuse to confirm or deny whether any information associated with the specified assaults is held.
The Commissioner concludes that there is insufficient legitimate interest in this case to outweigh the relevant individuals’ fundamental rights andfreedoms. He therefore considers that disclosure of personal information which confirms whether or not the requested information is held would not be lawful in this instance.
A confirmation or denial would not constitute personal data.
The Appellant also asked the Commissioner to clarify ‘what he means by the term 'prison community' [see for example paragraph 20 of the decision notice] in his Response. Without this, it will be impossible to decide whether or not to proceed with the appeal’.
The Commissioner responded to the appeal:-
The Commissioner considers that the wording “prison community” is self- explanatory i.e. it refers to any individual living in, working in and/or in some way connected with the prisons caught by the request.
Furthermore, the Commissioner notes that in the Appellant’s request for an internal review, his section 50 complaint and now before the Tribunal, he only seeks to challenge the engagement of the exemption by way of a bare assertion that confirmation or denial would not reveal any personal data.
…As such, the Commissioner has nothing further to add at this stage albeit he may make further submissions in the event the Appellant provides any substantive submissions in future.
Although the MoJ is not a party to this appeal, the MoJ has submitted written submissions to the Tribunal. The MoJ has also drawn attention to the previous request made by the Appellant, the decision notice and subsequent Tribunal decision:-
The Appellant first submitted a Freedom of Information Act (“FOIA’) request to MOJ on 23 August 2022, in the following terms:
“Provide a schedule, in date order, of money damages and legal costs paid by you to females held in women's prison who were victims of assault (including all types of sexual assault) by male prisoners (including trans-women) for the period 2018 to date.”
The Appellant then appealed to the First Tier Tribunal, who dismissed his appeal in a decision dated 17 January 2024 (EA2023.0148).
…
MOJ submits that in essence, the two requests and appeals brought by the Appellant are the same….
This matter was comprehensively dealt with by the Tribunal in its decision of 17 January 2024 (EA2023.0148). In that decision at [48], the Tribunal concluded that the information requested by the Appellant did constitute personal data, and consequently rejected the Appellant’s ground of appeal on that matter. The Tribunal further held at [49] that the interest apparently claimed by the Appellant was insufficient to override the personal data rights of the victims which would be breached, were the information to be disclosed.
The appeal should be dismissed, on same basis as it was for the first appeal (that is, that the information constituted personal data of the victims, whose rights would be breached if disclosure were to occur), but also on the grounds that this is essentially a duplicated appeal. The Appellant brought the same request and appeal in early 2023, and the matter has already been dealt with by the Tribunal. If the Appellant wished to challenge the Tribunal’s decision, he ought to have appealed that decision, rather than submitting an appeal against the ICO’s decision in this case, on what is in essence the same request.
The Appellant’s response to the MoJ submissions was to query again what was meant by the ‘prison community’.
DISCUSSION
The Tribunal is not bound by the previous Tribunal decision but has considered the conclusions it has reached for the purposes of this appeal.
The main point in this case is whether, in the particular circumstances, revealing that the information is held or not would in itself be a disclosure of personal data of a particular person or persons.
In this case, the Appellant wants (a) a list of all payments to a particular group of prisoners arising from assaults made by another particular group and (b) a total figure for such payments.
In general, if information is held and if the numbers (if any) involved are small, it can be see that confirming or denying that the information is held has the potential to disclose personal data about one or more people to whom that information may relate. For example (not linked to this case) if a request is made for information about persons from a particular postcode treated for a particular disease, confirming that the information is held would confirm that at least one person in that postcode had that disease. In particular circumstances and with the possibility of further information available from other sources, that confirmation could lead to the identification of the person or persons with that disease, and so confirming or denying that the information itself would amount to the disclosure of personal information of that person or persons.
Likewise, confirming or denying that the information sought by the Appellant is held, where the potential numbers of individuals involved are small (as we are told), would confirm or deny whether payments have been made or not to that small group of potential recipients such that the confirmation or denial itself would be the disclosure of personal data.
Thus as recorded in the previous FTT decision:-
...number instances of assault involved were fewer than five, and also, as some information was in the public domain following a criminal conviction, disclosure would permit a ‘jigsaw’ identification of those who might have received, or not received, compensation.
In this case, the Commissioner expressed the position as follows:-
Given the low numbers, the Commissioner considers that reidentification is likely and revealing something about the assault victim(s) would be possible through a confirmation or denial as to whether any costs or damages have been paid. As the Commissioner has already determined that the small numbers mean that those concerned are identifiable, even if it is only within the prison community, a confirmation or denial would reveal something about them.
In our view that analysis correctly applies to both parts of the request, and so includes the request for the total amount paid, as well as the request for a breakdown of individual payments.
Thus, on the facts of this case, we agree with this analysis and the analysis of the Tribunal in the previous case.
For completeness we should engage with the Appellant’s query as to what is meant by the ‘prison community’ in this case. In our view the Commissioner has clarified the phrase in his response by saying that ‘it refers to any individual living in, working in and/or in some way connected with the prisons caught by the request’. That seems a straightforward and sensible way to explain that the phrase includes, for example, prisoners and staff at the prisons and those with an awareness of the workings of those prisons.
Having concluded that the confirmation or denial that the information is held would amount to a disclosure of personal data, it is necessary to consider whether Art 6(1)(f) UK GDPR means that confirmation or denial that the information is held would nevertheless be lawful.
There is a three-part test which enables all the factors in Art 6(1)(f) to be considered:- this:-
Whether a legitimate interest is being pursued in the request for information;
Whether disclosure of the information is necessary to meet the legitimate interest in question;
Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.
First, the Tribunal must consider whether there is a legitimate interest in disclosing the information. As did the Commissioner, we accept that there may be some legitimate interest in the MOJ being open and transparent about information it holds regarding the subject matter and that this is particularly so as it may have involved a cost to the public purse.
Second, the Tribunal must consider whether it is necessary to issue a confirmation or denial under FOIA to meet that legitimate interest. We agree with the Commissioner that the legitimate interest could not be met in any way to disclosure as to whether the information is held or not and therefore the necessity test is met.
Third, and having reached that conclusion, the Tribunal must balance the legitimate interests in confirming whether or not the requested information is held against the relevant individuals’ fundamental rights, and freedoms. (We note that in the previous Tribunal case, the Tribunal appears to have decided at [49] –[50] that the second part of the test is not met and therefore it did not need to progress to the third part. This Tribunal does not take that approach and will consider the third part of the test).
Although transparency is important, in our view we agree with the Commissioner that the individuals who can be identified from the request would not have any reasonable expectation that information about whether or not they had made any claims or been awarded any damages would be placed into the public domain.
We also agree that to confirm or deny whether information is held may cause such individuals damage and distress.
On that basis we agree with the Commissioner and conclude that there is insufficient legitimate interest in disclosure in this case to outweigh the relevant individuals’ fundamental rights and freedoms for the protection of their personal data.
Disclosure of the personal information which confirms whether or not the requested information is held would not be lawful in this instance, and therefore the appeal is dismissed.
Signed Date:
Recorder Cragg KC sitting as a Judge of the FTT 21 June 2024
Promulgated on 21 June 2024