Jenna Corderoy v Information Commissioner & Anor

The appeal is brought under s. 57 of the Freedom of Information Act 2000 (FOIA) against the Decision Notice (DN) of the Commissioner dated 22 November 2022 with reference IC-166434-G1H2 which is a matter of public record.

The Tribunal conducted a remote hearing by CVP on 6 October 2023 and adjourned part- heard. The Tribunal conducted a remote hearing by CVP on 8 July 2024 and considered all the evidence comprising an agreed Open Bundle and two Closed Bundles containing the unredacted Withheld Material. The Tribunal heard submissions from Ms Whitelaw KC, on behalf of the Second Respondent, and Ms Corderoy and evidence from Inspector Didham.

Ms Corderoy lodged a Request on 4 October 2021 in the following terms:

The Second Respondent responded to the Request and provided partial disclosure of the number of officers disciplined by year and the sanctions imposed and relied on the exemption in s.40(2)(3A)(a) (personal information) to withhold the more detailed information sought (Requests 1(b)-(c) and 2(b)-(c)) because it would identify police officers and/or victims.

Following a request for an internal review on 20 January 2022 the Second Respondent made a further partial disclosure.

The Second Respondent undertook an internal review on 20 January 2022 and confirmed its position citing the exemptions by virtue of s. 40(2)(3A)(a) (personal information) of FOIA.

On 14 April 2022 Ms Corderoy referred the matter to the Commissioner.

On 27 September 2022 the Commissioner invited the Second Respondent to revisit his decision and address whether brief decriptions of conduct could be provided, whether the messages had been sifted and to provide detailed submissions concerning the FOIA exemptions upon which the Second Respondent sought to rely.

On 11 October 2022 the Second Respondent provided a response via the Commissioner as follows:

The DN dated 22 November 2022 concluded that the Second Respondent was entitled to rely on the exemption in s.40(2)(3A)(a) (personal information) to withhold copies of WhatsApp/other social media posts involved where police officers were disciplined or dismissed for conduct in relation to such messages, as disclosure would contravene Article 5(1)(a) of the UK GDPR.

The Second Respondent relied on the exemption in s.30(1)(a) (investigations and proceedings) but the Commissioner did not find it necessary to consider this exemption as s.40(2) was properly engaged. The Second Respondent contended that s.38 FOIA (health and safety) also applied.

The Commissioner concluded:

S.40(2)(3A)(a) provides as follow:

When the first condition in (3A) is satisfied, s.40 is an absolute exemption in accordance with s.2(3)(fa) FOIA. It is therefore not subject to the public interest test.

Personal data is any information relating to an identified or identifiable living individual (s.3(2) Data Protection Act 2018 (DPA)).

Article 5 UK GDPR (Principles relating to processing of personal data) provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and transparency).

In considering whether disclosure would contravene the above principle the following need to be determined:

Article 9 UK GDPR defines special category data as ‘personal data about an individual’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.’ The most likely special category data to apply to WhatsApp/social medial messages is data concerning race, ethnic origin, politics, sex life or sexual orientation.

In order for disclosure of special category data to be lawful, a lawful basis for processing under Article 6 UK GDPR must be identified and a separate condition under Article 9 UK GDPR. Article 9(2)(e) states: ‘processing relates to personal data which are manifestly made public by the data subject’.

Criminal Offence Data (Article 10 UK GDPR) - Pursuant to s.11(2) DPA criminal offence data is information relating to:

Article 10 UK GDPR provides specific safeguards for processing such data which are relevant in this appeal and must be met:

If one of the above conditions is met, then there must also be a lawful basis for processing the information under Article 6 UK GDPR.

For disclosure to be lawful it must satisfy one of the six lawful bases in Article 6 UK GDPR. The only appropriate basis in this case is contained in Article 6(1)(f) (which can be used by a public authority in these circumstances due to s.40(8) FOIA). This provides:

To determine whether Article 6(1)(f) is satisfied, and therefore whether disclosure would be lawful, the following three-stage test applies:

Article 6(1)(f) states that the disclosure must be “necessary”. The test of whether a disclosure under FOIA is necessary for the purposes of the requestor’s legitimate interests must be satisfied before considering whether the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

The test of necessity requires that disclosure be “more than desirable but less than indispensable or absolute necessity” as set out in Goldsmith International Business School v The Information Commissioner and the Home Office2014 UKUT 0563 (AAC) 2014 at [39] which is summarised as follows:

The High Court in Corporate Officer of the House of Commons v Information Commissioner & Others [2008] EWHC 1084 (Admin) at [43] accepted the common ground in that case that:

Only if the disclosure passes the necessity limb of the test should the balancing test be conducted. The balancing of legitimate interests with the interests, rights and freedoms of the data subject requires an assessment on the facts of the specific case. The effect of the DPA, when it is incorporated through s.40 FOIA, is that the personal data of a third party will be protected unless there are strong reasons to disclose it.

Even if a disclosure is found to be lawful it must also be fair and transparent. There is no presumption that the openness and transparency of public authorities should take priority over personal privacy. Fairness involves consideration of the reasonable expectation of the data subjects, the possible consequences of disclosure for the data subject(s), and the balance between the rights and freedoms of the data subject(s) and any legitimate interests in the public having access to the information.

S.30(1) is a qualified exemption providing circumstances in which information does not have to be disclosed:

Provided that the information is held for this investigative purpose, s.30(1) applies even after investigations have been closed and it covers information gathered prior to, during, and after the investigation/decision to charge. ICO Guidance on Investigations and Proceedings explains the application and implication of the s.30(1) exemption:

S.30 also captures investigations where civil sanctions rather than criminal procedures are used.

Since s.30 is a qualified right, it is subject to the public interest test within the FOIA. Information can be withheld if the public interest in maintaining the exemption outweighs the public interest in disclosure.

In Alan Digby Cameron v the Information Commissioner and Bedfordshire Police and Hertfordshire Police (EA/2008/0023 and 0025) at 14 the Tribunal summarised the relevant factors for a s30(1) public interest assessment:

S.38 FOIA provides:

This is a qualified exemption, subject to the public interest test.

The issue before the Tribunal is whether the Second Respondent is entitled to withhold the Withheld Material under ss.40(2), 30 and 38 FOIA.

Ms Corderoy appealed the DN by Notice of Appeal dated 15 December 2020 and put forward the following points:

The issues between the parties have narrowed as this appeal has developed and disclosures have been made by the Second Respondent.

On 25 October 2021 the Second Respondent disclosed the number of police officers disciplined for their conduct on social media including any sanctions issued for the misuse of social media from 2018 to 2021 (Open Bundle (OB) C73 to C76). The Second Respondent withheld information in relation to the details of the specific cases and refused the Request by virtue of s.40(2)(3A)(a) (personal information) FOIA.

On 11 October 2022 the Second Respondent disclosed parts of a report which included years, sanctions and parts of the allegation summaries (OB C98 to C102). The Second Respondent withheld information relying on s.40(2)(3A)(a) and, in addition, s.30(1)(a)(i) (investigations and proceedings)

The appeal came before this Tribunal on 6 October 2023 when the Second Respondent was directed to lodge and serve within 3 months any general privacy notice together with any particular privacy notice served prior to disciplinary meetings or hearings or a statement explaining any similar documentation that is provided prior to disciplinary meetings or hearings and to lodge and serve in a closed bundle the full unredacted copies of the posts relating to the 24 cases.

On 1 July 2024 the Second Respondent lodged in relation to parts 1(c) and 2(c) of the Request a Proposed further Disclosure document comprising:

Ms Corderoy confirmed she wished to pursue the appeal because the disclosure of 1 July 2024 raised further questions.

Case Management Directions have been issued pursuant to rule 14(6) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 regarding the Closed Hearing Bundle 2 (the Withheld Material).

Ms Corderoy accepted that the information had been disclosed in relation to the Requests relating to the number of police officers that were disciplined or dismissed for their conduct on WhatsApp and/or other social media sites. This is not in issue between the parties.

At the hearing Ms Corderoy submitted that having considered all the disclosed information the only remaining issues she wished to raise related to 6 Cases as follows:

Ms Whitelaw submitted that extensive disclosure had been provided and the small amount of withheld information was on the basis of good reason and the exemptions relied on had been fully explained.

The Commissioner in response to further partial disclosure indicated that he would be content to settle on the basis of the revised disclosure but maintained his position in relation to redacted/withheld material.

Ms Whitelaw submitted that extensive manpower time was involved in providing the disclosed information and the Second Respondent could have sought to rely on the s.12 exemption that the cost of compliance exceeds the appropriate limit. However, the Second Respondent had not sought this due to the time over which and the way in which the disclosures had been made.

Inspector Didham in evidence explained how complex and time consuming the process had been to obtain the information because of the format in which the information was kept and that the information had to be extracted on a case by case basis. He had looked at the Centurion system and read through all the cases. He then produced a spreadsheet with the results and commentary. He explained that the majority of the cases were heard at misconduct meetings which are private and do not result in notices being published under the Police Conduct Regulations.

He explained that it was necessary to examine each folder from the shared folder for misconduct meetings to scrutinise the documents and there were documents embedded within documents. He had to identify the relevant information which had to be redacted. Checks were then required to see if individuals could be identified. This had been a huge task which he had undertaken in addition to his other duties.

In closed session Ms Whitelaw took the Tribunal through the six cases in issue and Case 18 which was not put in issue. The Tribunal considered the redacted and unredacted material for each case and a Gist of the closed session was provided to Ms Corderoy.

On an appeal under section 57 FOIA the task for the Tribunal is to decide whether the DN is in accordance with the law (section 58(1)(a) FOIA). The Tribunal is entitled to review any finding of fact on which the DN was based (section 58(2) FOIA).

In reaching its decision the Tribunal took into account all the evidence before it whether or not specifically referred to in this Decision. The Tribunal applied the legislation and case law.

Ms Corderoy is a journalist who has been investigating police forces over officers’ inappropriate use of social media.

Ms Corderoy submits that s.40(2) does not apply to the messages. She stresses that she has never asked for the officers’ names, ranks and genders and has focussed on obtaining copies of the offensive messages and posts that were written and/or shared.

She asked for each disciplined or dismissed police officer a brief description be given regarding their conduct on WhatsApp and other social media sites. She stated she was not asking for a detailed description and was not asking for any names of other identifiers.

She submits that her Request satisfies the legitimate interest because she wishes to scrutinise whether officers are receiving fitting punishments for their actions and it is difficult to assess this when the public does not have access to copies of the messages and posts. The term “inappropriate” in relation to comments and images does not convey how bad the officers’ actions were.

She submits that the disclosure is necessary to meet the legitimate interest in questions. Disclosure would allow the public to determine whether the punishment is severe enough to reprimand officers and discourage others from posting or sharing offensive messages.

She submits that the above interests override the legitimate interests or fundamental rights and freedoms of the data subjects. There is no reasonable expectation for the privacy of officers if they have published offensive messages in the public domain.

In relation to the Cases in issue the Tribunal found as follows:

In reaching its decision that a person or persons could be identifiable in the Cases in issue the Tribunal has given regard to the ICO guidance: What is identifiability?

The Tribunal found that in Cases 10, 14, 16, 23 and 24 individuals could be distinguished from other individuals and were identifiable. The Tribunal found that either names were given or the face was clearly visible. Where individuals could be directly identifiable this constituted personal data.

In Cases 23 and 24 the Tribunal found that there was the hypothetical possibility that someone might be able to reconstruct the data in order to identify an individual using readily accessible search engines in order to match the dates, the subject matter and the specific and unusual characteristics of the memes. In this context the tribunal considered the searches that could be made by an interested and sufficiently determined person. Taking into account the nature of the memes the Tribunal did not consider that the likelihood of identification had changed over time and that the information would have been available at the time of the Request.

In reaching its decision the Tribunal has attached weight to the ‘mosaic effect’ where requested information can be combined with other information obtained through other means.

The Tribunal considered whether disclosure of the personal data under FOIA would be lawful. The Tribunal found that Ms Corderoy had a legitimate interest in this information for the reasons put forward by her. There is public interest in the statutory provision of Police disciplinary proceedings for misconduct and that there should be scrutiny and transparency.

The Tribunal found that the disclosure of the personal data in the Withheld Material is not reasonably necessary for the purposes of the identified interests. The Tribunal is not satisfied that knowledge of the identity of individuals involved would significantly further openness and transparency.

The Tribunal has balanced these interests against the privacy rights and expectations of the data subjects and finds that the interests in disclosure are overridden by the legitimate interest or fundamental rights and freedoms of the data subject which require protection of personal data.

The Tribunal finds that the disclosure of the redacted personal data under FOIA would contravene the data protection principles and the Second Respondent was entitled to withhold it under s. 40(2)(3A)(a) FOIA.

The appeal is allowed in part in so far as there was an error of law in the Commissioner’s DN in deciding that all the information not disclosed at the date of the DN was correctly withheld and the Second Respondent was entitled to rely on s. 40(2)(3A)(a) FOIA in relation to the information requested under Requests 1(b) and (c) and 2(b) and (c).