Independent Digital News and Media Limited v The Information Commissioner & Anor

This appeal concerns the following request made on behalf of the Independent on 8 June 2022:

HMT initially relied on section 40(2) (personal information) and section 35(1)(d) (ministerial communications). It upheld its position on internal review.

In the course of the Commissioner’s investigation HMT relied in addition on section 27 (international relations) and asserted that some information in relation to which it had originally applied section 40(2) was outside the scope of the request.

In a decision notice dated 7 December 2021 the Commissioner decided that:

The reasons for the Commissioner’s conclusion that most of the information was within the scope of the request is set out in a closed annex.

It is not necessary for the purposes of this appeal to set out the Commissioner’s reasoning in relation to scope or in relation to section 35.

In relation to section 40(2) the Commissioner concluded that the information related to Rishi Sunak and named individuals who were involved in the exchange of correspondence. He was satisfied that this information both related to and identified the individuals concerned. It was therefore personal data withing section 3(2) of the Data Protection Act.

The Commissioner recognises a legitimate and compelling interest in learning more about exchanges with US officials regarding the then Chancellor’s US green card. According to the US Citizenship and Immigration Services website, having a green card allows the holder to live and work permanently in the United States. According to the website of the US Embassy in London, a foreign dignitary such as a senior UK politician would normally travel on an A1 visa which must be arranged in advance.

The Commissioner accepted that reasonable necessity had been met as, in line with that test, disclosure would provide greater transparency about the extent to which what is described by HMT as ostensibly a private matter was considered via a publicly resourced channel of communication.

It is now a matter of public record that Rishi Sunak had a green card and according to news reports, he rescinded this card before his visit to the US as Chancellor in October 2021. There is a legitimate interest in the public knowing more about the details of discussions with US officials given that green card status.

The Commissioner acknowledged that Mr Sunak’s green card is a personal matter. It was obtained in his capacity as a private citizen and not as an elected official and a government minister. The October 2021 trip in question to the US was in his official capacity as the then Chancellor of the Exchequer. In this case, any correspondence with US officials on the matter of his green card would inevitably relate to his impending official trip made in his public capacity.

The Commissioner recognised that a balance must be struck between Mr Sunak’s legitimate interest in keeping private any correspondence which related to his green card and the legitimate interest in transparency about arrangements for his official trip to the US and about the use of publicly resourced channels to discuss these matters. He acknowledged that the legitimate interest in disclosure has been served to a large extent by a report which had been commissioned in early 2022 entitled ‘Advice from the Independent Advisor on Ministers’ Interests about the Chancellor of the Exchequer’s outside interests’ (Lord Geidt’s report).

The Commissioner determined by a narrow margin that there was insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms.

In relation to the names of junior officials he concluded that disclosure would be unfair and wholly outside their reasonable expectations.

In relation to section 27, the Commissioner accepted that disclosure could encroach on the confidential space needed to conduct effective relations with senior representatives of other states, especially those which value the UK’s trust and discretion. The Commissioner accepted that disclosure would be likely to harm the UK’s relations with such states. He concluded that the public interest in disclosure was outweighed by the public interest in ensuring that the UK maintains effective relations with the US.

The two grounds of appeal are:

It is argued:

It is argued:

The Commissioner stated that he does not consider that, in practice, there is any real difference between the concept of a ‘balancing test’ and the question of whether the rights and freedoms of Mr Sunak or other data subjects override the legitimate interests in disclosure. In any case, the Commissioner considered that the result is the same.

In relation to the personal data of junior officials, the Commissioner argued that he was correct to place reliance on the reasonable expectations of those data subjects that the information would not be disclosed.

In relation to the personal data of Mr. Sunak, the Commissioner submitted that the fact that and purposes for which Mr. Sunak originally held a green card, alongside any decisions concerning that card are by their nature personal. That does not prevent correspondence relating to the trip itself being official in nature.

The Commissioner submitted that the alternative ground of public interest relied on in the decision notice is not incompatible with earlier references and only benefits the appellant’s case.

The Commissioner submitted that he did not place excessive weight on the reasonable expectations of the data subjects and primarily relied on this ground in relation to the personal data of junior officials.

In so far as the Commissioner’s conclusion that legitimate interests in disclosure were met by Lord Geidt’s report, the Commissioner invited the Tribunal to consider the withheld information and the contents of that report. The Commissioner agreed with the Treasury’s submissions (summarised at DN [50]) that disclosure would not meaningfully increase public understanding and that (per DN [52-53]) Mr Sunak’s interests in not having the data disclosed, which engage his rights and fundamental freedoms under the UK’s data protection legislation, override the public interest in disclosure.

In relation to section 27, the Commissioner noted that he is constrained in what he can say about the withheld information and invited the tribunal to examine the information and form its own conclusions. The Commissioner noted that the material raises a number of issues that concern the UK’s relationship with US officials, and that disclosure of that information would, in the Commissioner’s view, be likely to prejudice relations with the US, and in particular the smooth functioning of communications when coordinating or arranging ministerial trips to the US. The Commissioner considered that, in the circumstances of this case, he reached the correct conclusion on the balance of public interests.

HMT submitted that the Commissioner was justified in taking the approach set out in the Decision Notice. In particular, he correctly identified the interests in play – namely those in favour of disclosure, the interest in protecting the international relations between the UK and the US, those of Mr Sunak, and of those of other persons whose identity would be exposed by disclosure, and the limited additional value of the information being disclosed for transparency – and carried out a justified balancing act of those interests.

In particular, HMT said that the Decision correctly emphasised:

HMT submitted that no appeal grounds are formulated by reference to the personal data of anyone other than Mr Sunak. As such, the Commissioner is justified in concluding that “personal data rights of those other than Mr Sunak outweigh interests in disclosure for the reasons given in the DN”.

HMT submitted that it is well-established that there is no material difference between the ‘overriding interests’ test and that concerning qualified exemptions.

HMT said that the reasonable expectation of privacy of the individuals concerned was a relevant factor and an appropriate consideration, in the presence of personal data which concerned personal matters (including Mr Sunak’s green card, which was not held in an official capacity). There is no evidence that any particular or undue weight was placed on this factor.

HMT said that the decision was not internally inconstant, by recognising the dual aspects of the discussions in this case (discussion by public officials of a private right to travel/live in the United States).

HMT submitted that the existence and content of Lord Geidt’s report was relevant to (i) the balancing of the interests at play and (ii) the assessment of necessity of disclosure, i.e. whether there were alternative means of obtaining the information requested.

It is noted that the Commissioner expressly referred to “[…] the importance of confidentiality of communications between the UK and the US and of avoiding the harm disclosure could cause to relations between the two countries. It also referred to the potential chilling effect on everyday exchanges of correspondence in similar circumstances”. It is submitted that these are sufficiently particularised and specific interests which are the subject matter of the exemption in s.27(1). It is submitted that the decision reflected consideration of the requested information and carefully sought to balance the interests at play.

The Independent agreed that the information sought would inevitably contain information relating to Rishi Sunak and related individuals involved in the exchange of correspondence, and that this information falls within the definition of ‘personal data’ in section 3(2) of the DPA.

The Independent agreed that the data protection principle most relevant in these circumstances is the principle set out in Article 5(1)(a) of the UK GDPR, i.e., that information can only be disclosed pursuant to a request under FOIA if to do so would be lawful, fair and transparent.

The Independent agreed that the lawful basis most applicable in these circumstances is that set out in Article 6(1)(f) of the UK GDPR, i.e., that processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject which require protection of personal data.

The Independent agreed and endorsed the Commissioner’s finding that there was a legitimate interest in the public knowing more about the discussions taking place between Rishi Sunak, HMT, and US officials, and that disclosure was necessary to provide greater transparency about the extent to which what is described by HMT as ostensibly a private matter was considered via a publicly resourced channel of communication.

It is submitted that the Commissioner did not draw a clear distinction between the interests or fundamental rights and freedoms of Rishi Sunak and those of other data subjects. In any event, the relevance of the distinction is not entirely understood given that section 40(2) is an absolute exemption. The appellant submitted that if personal data of any of those data subjects contained in the information sought was found to satisfy all the stages of the exemption such that their rights and freedoms overrode the legitimate interest and necessity of disclosure, then the public authority would be absolutely exempt from disclosing the information requested.

It is submitted that the fact that Rishi Sunak obtained his green card prior to becoming an MP (and later the Chancellor of the Exchequer, and the Prime Minister), does not render his green card a ‘personal matter’; he held a US green card for over six years while he was an MP (during which time he was Parliamentary Under-Secretary of State for Local Government from 9 January 2018; and Chief Secretary to the Treasury from 24 July 2019), and for at least nineteen months while he was Chancellor of the Exchequer between February 2020 and October 2021. During that period, he had a right of permanent residency in the USA, enjoyed certain statutory rights in the USA, and filed annual tax returns with the US government.

In circumstances where Mr Sunak held high-level ministerial positions in the UK government (and for example, as Chancellor was responsible for domestic tax policy and negotiating international tax treaties), the independent submitted that it cannot be the case that “any decisions concerning that card… [were] clearly by their nature personal” [IC Response/§26]. It was submitted that it follows that Rishi Sunak cannot have had a legitimate interest “in keeping private any correspondence which relates to his green card” [D/§52].

As an elected politician and Chancellor of the Exchequer, working within public authority bodies subject to FOIA and the spirit of transparency, the Independent submitted that Mr Sunak cannot have had a reasonable expectation that his personal data would not be subject to disclosure.

In any event, it was submitted that the legitimate interest in disclosure that the Commissioner had already established could not have “been served to a large extent” by the independent report that had been commissioned in early 2022 (and referred to at paragraphs 40-44 of the DN) (“the Geidt Report”). The Geidt Report was “confined to the question of conflicts of interest and the requirements of the Ministerial Code”; and the role did not “touch on any wider question of the merits of such interests or arrangements (paragraph 27).

The Independent submitted that the Geidt Report relied upon “the material held by the office of Independent Adviser as well as requesting further information from HM Treasury and the Chancellor”. The Independent argued that it is not clear whether the Geidt Report relied upon or had access to correspondence between HM Treasury and US officials, which is the subject of the Request. In any event, it was submitted that legitimate interests identified by the Commissioner in the Decision Notice (namely, the “legitimate interest in the public knowing more about the details of discussions with US officials given that green card status” was and is not served by the Geidt Report.

The Independent is not clear on what individuals constitute the category of data subjects who are ‘individuals other than Mr Sunak’. It was submitted that if the personal data contained in the information sought belongs to either Rishi Sunak or to junior officials that seems potentially incompatible with the Commissioner’s conclusion as to the international relations exemption, that disclosure would encroach on “the confidential space needed to conduct effective relations with senior representatives of other states” (unless the personal data exemption was not relied upon to withhold that information, in which case there is perhaps no such incompatibility).

It was argued that the reasonable expectations of any ‘junior officers’ whose personal data is contained in the information sought needs to be carefully considered in the context of the Request. These ‘junior officers’ are individuals who work for, and with, Rishi Sunak, and whose responsibilities included having input or insight into correspondence with US officials relating to the serious and significant matter of Rishi Sunak’s green card and his upcoming travel to the US on a trip in a public capacity. That information is of a particular nature – and the responsibilities of a particular level – that those junior officers whose personal data is contained in the information sought would inevitably have had a reasonable expectation that their personal data may be disclosable.

To the extent that the legitimate interest of disclosure was overridden, it is submitted that a more proportionate approach would have been to redact identifying details relating to those individuals.

It is submitted that the ‘international relations exemption’ is not engaged on the basis that the three-stage test in Hogan requires the applicable interest(s) within the relevant exemption to be identified; a causal relationship to be shown between the potential disclosure and the prejudice that is ‘real, actual or of substance’ (the evidential burden of which rests with the decision-maker); and a likelihood of prejudice to be shown (a step which also lies with the decision-maker). It is not understood how disclosure of communications in relation to “arranging travel abroad” can give rise to prejudice to international relations that is ‘real, actual or of substance’.

The Independent considered the application of the international relations exemption to be insufficient because it attaches any purported prejudice to a category of ‘communication’ without explaining how that prejudice is likely to be caused by the disclosure of the content of that communication, which it is understood to have related to “arranging travel abroad”.

The Independent argued that the IC wrongly took into account the likelihood of harm to states other than the US in its decision.

Even if the international relations exemption is engaged, it was submitted that any such engagement is weak (for the reasons given above) and overwhelmingly outweighed by the public interest in disclosure of the information requested.

It was argued that the fact that Mr Sunak, a UK MP holding various high-level ministerial positions of public responsibility, held a green card entitling him to certain statutory rights in the US and filed annual tax returns with the US government – and the fact that that green card was only forfeited by Mr Sunak in October 2021 (nineteen months after having been appointed Chancellor of the Exchequer) – render the decision-making around Mr Sunak’s green card to be a significant matter of public interest.

The Independent does not accept that it is in the public interest not to disclose information on the basis that such disclosure would have a chilling effect. On the contrary, the Independent submitted there is a public interest in ministerial and public officials being aware of their obligations under FOIA, and the spirit of transparency, and to conduct their public roles and official correspondence accordingly.

The tribunal sought additional submissions and clarification in relation to a number of issues from HMT as follows:

HMT helpfully clarified that section 27 was relied on in relation to 67.2.

Unhelpfully HMT provided no separate submissions in relation to 67.1 and 67.3. Instead it relied on its previous ‘statement of facts’, its rule 14 Application and Annex A. There were no substantive submissions in the rule 14 application or Annex A which addressed the matters in in 67.1 or 67.3. HMT have not provided a document headed ‘statement of facts’ but the tribunal has taken into account any submissions already provided by HMT in, for example, its response to the appeal and in its letters to the Commissioner.

We read and took account of an open and a closed bundle. The closed bundle consisted of (i) the disputed information (ii) an unredacted version of correspondence between the Commissioner and HMT (iii) a confidential annex to the Decision Notice.

The tribunal considered that it was not necessary for some of the information originally in the closed bundle to remain closed. The tribunal’s deliberations were therefore adjourned and a case management order issued in relation to the closed bundle. A large portion of the previously closed information was provided to the appellant, and the Judge was satisfied that the remainder of the documents had to remain closed, otherwise the purpose of the proceedings would be defeated. The appellant and the Commissioner were given the opportunity to make further submissions on the basis of the newly open information but none were received.

The relevant parts of s 40 of FOIA provide:

Personal data is defined in section 3 of the Data Protection Act 2018 (DPA):

This is in line with the definitions in the General Data Protection Regulation (EU) 2016/679. Recital 26 to the Regulation is relevant, because it refers to identifiability and to the means that should be taken into account:

The definition of "personal data" consists of two limbs:

The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA [2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.

In Durant, Auld LJ, giving the leading judgment said at [28]:

In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:

The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider:

The data protection principles are set out Article 5(1) of the GDPR and s 34(1) DPA. Article 5(1)(a) GDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) GDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.

The only potentially relevant basis here is article 6(1)(f):

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows

Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:

Section 40(3A) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

Section 27(1) provides:

The exemption is prejudice based. ‘Would or would be likely to’ means that the prejudice is more probable than not or that there is a real and significant risk of prejudice. The public authority must show that there is some causative link between the potential disclosure and the prejudice and that the prejudice is real, actual or of substance. The harm must relate to the interests protected by the exemption.

Section 27 is not an absolute exemption and therefore under s 27(1) the Tribunal must consider whether, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The tribunal has to determine the following issues:

The information withheld under section 40(2) is:

We do not accept that there is any legitimate interest in emails addresses or telephone numbers. We conclude that this information is exempt under section 40(2).

We ordered HMT to provide submissions on why section 40(2) applied to the names of individuals, other than Rishi Sunak, with specific reference to the grade and/or level of seniority of each individual. HMT have not provided any substantive additional submissions. In the absence of those submissions we are not persuaded that some of the redacted names belong to ‘junior’ employees or officers. Those individuals are identified in the closed annex.

We do not accept that there is any legitimate interest in the names of ‘junior’ officials or employees and we conclude that this information is exempt under section 40(2). There are no redactions of job titles of individuals that we have accepted are ‘junior’.

We accept that there is a legitimate interest in the identity, i.e. the job titles and the names, of any individuals other than junior employees involved in discussions of this nature.

We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interests. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least restrictive means of achieving the legitimate aim in question, because it would not be necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subjects.

In our view the legitimate interest in the identity and names of any individuals other than junior employees cannot be achieved through other means and therefore it is reasonably necessary to disclose the names of those individuals.

We do not accept that more senior employees in these type of roles have a reasonable expectation of privacy in relation to this this specific information (i.e. their names in a work context).

For those reasons we conclude that the names of more senior employees are not exempt under section 40(2).

We have considered the name and job title of one of those employees or officials under section 27, because it was considered in the decision notice under section 27. HMT have not relied on section 27 in the alternative in relation to the other names and this did not form part of the Decision Notice.

We accept that this is Rishi Sunak’s personal data, in the sense that it relates to him – it is obviously about Rishi Sunak and he is its focus. He is also identifiable from the information.

We find that there is a clear legitimate interest in transparency in relation to the precise circumstances and the detail of the discissions surrounding the following matter:

Further we agree with the Commissioner that there is a legitimate interest in transparency in relation to the extent to which what is described by HMT as ostensibly a private matter was considered via a publicly resourced channel of communications.

We accept that the Geidt Report does contribute to transparency in relation to this issue to some extent, however it does not set out any detail of what the discussions were with the relevant authorities or cast any light on why, as a result of those discussions, Mr. Sunak decided it would be appropriate at that point to relinquish the Card. In our view, it is reasonably necessary for the correspondence to be disclosed for the purpose of the identified legitimate interests.

In relation to one redaction to page A20 and a redaction on page A14 of the bundle, the tribunal accepts that the legitimate interests are overridden by the interests of fundamental rights and freedoms of the data subject. Whilst this takes place in the context of official discussions about a state visit in Mr. Sunak’s official capacity as Chancellor, these particular sections of these emails fall squarely, in our view, into Mr. Sunak’s private life. We find that Mr. Sunak would have had a reasonable expectation of privacy in relation to this particular information.

In relation to the remainder of the information relating to Rishi Sunak withheld under section 40(2) we do not accept that Mr. Sunak would have had a reasonable expectation of privacy. The fact that Mr. Sunak held a Green Card and that he decided to relinquish it as a result of discussions with US officials was in the public domain at the date of the response to the request. These are discussions between state officials organising a visit by Mr. Sunak to the US in his capacity as Chancellor. We accept that the Green Card was held by Mr. Sunak as a private individual, but its relevance to these discussions between officials about a state visit is its impact on his public role and his public duties not on his private life. The discussions do not reveal any aspects of Mr. Sunak’s private life. We do not accept that there would be any harm or distress to Mr. Sunak as a result of disclosure of this information.

In our view there is an important legitimate interest in this information, given Mr. Sunak’s position as Chancellor and the controversy and public debate surrounding the holding and the relinquishing of his Green Card.

For those reasons we conclude that the legitimate interests outweigh the interests and fundamental rights and freedoms of Rishi Sunak in relation to the remainder of his personal data withheld under section 40(2). For the same reasons we conclude that disclosure would be fair and transparent.

We conclude that HMT was not entitled to rely on section 40(2) to withhold that information.

There is additional closed reasoning on section 27 in the closed annex.

The applicable interest under section 27 is the protection of the interests of the UK in its dealings with other states.

HMT’s arguments on this issue appear largely in the closed bundle in the redacted portions of its letter to the Commissioner. Some of that argument is repeated in the Decision Notice and so can be set out in open:

There is another aspect to HMT’s argument which is contained in the closed bundle and considered in the closed annex to this decision.

We are not persuaded that emails that include what we would categorise as banal discussions of administrative arrangements or those that simply reveal that the discussions were between certain individuals engage section 27. We are also not persuaded in relation to one redaction that does not fall within this category.

We have considered the consequences that HMT asserts would flow from the disclosure of this information, but we are not persuaded of any causative link between the disclosure of this particular information and those consequences. We do not accept that release of this information carries a significant and weighty chance of causing any chilling effect on the candour with which Private Offices and Embassy officials communicate.

We are not persuaded that there is a significant any weighty chance of prejudice to relations between the United Kingdom and another state in either way set out by HMT through disclosure of this information.

We have set out the pages in relation to which we find that section 27 is not engaged in the closed annex.

In relation to two pages of the emails we do accept that section 27 is engaged for the reasons set out in the closed annex.

We accept that there is a very strong inbuilt interest in avoiding harm to the interest of the UK in its dealings with other states. In relation to the particular information redacted from the two pages in relation to which section 27 is engaged, we are not persuaded that there is a significant public interest in disclosure. The information does not illuminate the public interest issues highlighted by the appellant. We accept that there is a general public interest in transparency but in our view this is outweighed by the public interest in maintaining the exemption.