Christopher McKeon v The Information Commissioner & Anor

This appeal is against the decision of the First Respondent, the Information Commissioner (“the Commissioner”), brought by Christopher McKeon (“the Appellant”), under section 57 of the Freedom of Information Act 2000 (“FOIA). It is against the Commissioner’s Decision Notice of 17 July 2023 - Ref. IC-219998-J5R4- (“the DN”).

On 12th December 2022 the Appellant wrote to the Independent Parliamentary Standards Authority (“IPSA”) and requested information in the following terms:

IPSA responded on 24 January 2023 providing the information requested in an anonymised spreadsheet.

The provision of the information in un-redacted form was refused in reliance on the FOIA exemption contained at Sections 40 (2) and 40 (3A)(a) namely the personal data of third parties.

On 3 March 2023 IPSA affirmed its position after internal review.

On 6 March 2023 the Appellant filed a Section 50 complaint to the Commissioner.

The Commissioner issued the DN on 17 July 2023.

Section 1(1) FOIA affords a general right of access to information from public authorities on request, and a corresponding duty on public authorities to comply with such a request by (a) confirming or denying that it holds the requested information and(b) communicating the information to the requester.

However these rights are subject to certain exemptions, set out in Part II FOIA.

For the purposes of this case, the relevant exemption in Part II is Section 40 of FOIA.

Section 40 FOIA reads insofar as relevant:

By virtue of Section 40 (7) FOIA , “the data protection principles” means the principles set out in the General Data Protection Regulations (“GDPR”), and section 34(1) of the Data Protection Act 2018.

For instant purposes the applicable data protection principle is that disclosure of third-party personal data in response to a FOIA request is only permissible where to do so would be lawful, fair and transparent.

By virtue of Section 2(3) of FOIA, Section 40(2) provides an absolute exemption if disclosure of personal data would contravene any of the data protection principles.

The Commissioner concluded in his DN that the Section 40 (2) exemption was engaged.

The Commissioner is satisfied that the information represents personal data.

The small numbers of staff (on average five) associated with each MP, combined with other information already in the public domain (including that known by the individuals’ colleagues or relatives), suggests that it is reasonably likely that individuals may be identified.

Article 4 GDPR defines personal data thus;

Further amplification of this definition is found in recital 26 GDPR, were, inter alia:

The guiding principle to Recital 26 is “data should be such as not to allow the data subject to be identified via “all” “likely” and “reasonable” means”, and “clearly sets a very high standard”.

Personal data is a relational concept: data in the hands of one individual may not be personal data, where in the hands of another individual holding additional relevant data, it would be personal data: per Cranston J. in Department of Health v Information Commissioner [2011] EWHC 1430 (Admin).

When considering identifiability in the context of FOIA it must be borne in mind that FOIA disclosure is disclosure into the public domain (’the world at large’).

Thus the ‘identifier’ presumed by the GDPR may be any other person in the public domain, not just the requester. This could plainly include complete strangers to the data subject but also friends, family, colleagues, and enemies to the data subject.

In regards this latter category, the Upper Tribunal has previously utilised the concept of the ‘Motivated Intruder’ to assist in consideration of means likely to be used by a third party to seek to identify data subjects, who would have a number of routes and tools to do so (per Information Commissioner v Magherafelt District Council [2012] UKUT 263 and Miller v Information Commissioner [2018] UKUT 229, found here:

The correct question formulated by UT Judge Markus in Miller (adopted and approved in NHS Business Services Authority v. Information Commissioner & Spivack [2021] UKUT 192) was: “Whether a person can be identified taking account of ‘all means reasonably likely to be used’?”.

In Miller the nub issue was whether public authority was permitted to redact ‘small numbers’ data concerning a few individuals from within a larger data set.

The Tribunal is asked to consider paragraph 28 of Miller which affirms the correct threshold for the likelihood of indirect identification was “greater than remote.”

It is apparent from the anonymised spreadsheet that the number of staff for some MPs is greater than five.

It appears the reason behind the Appellant’s request is to explore MPs’ staff turnover, as part of a wider investigation into workplace culture in Westminster.

It is submitted that the motivated intruder would likely leave no journalistic stone un-turned in pursuit of such a story – which is a factor weighing in favour of applying the exemption.

In the present case, having determined that the disclosure of personal information would be prima facie contrary to the data protection principle, the Commissioner went on to ask himself the 3 gateway questions (i) whether there is a legitimate interest in disclosing the information, (ii) whether disclosure of the information is necessary, and (iii) whether these interests override the rights of the individuals whose personal information it is.

The Commissioner determined that there is insufficient legitimate interest to outweigh the fundamental rights and freedoms of the individuals.

The Commissioner considered that there is no legal basis for the IPSA to disclose the requested information, and it would thus be unlawful to do so.

In summary the Commissioner supported IPSA’s entitlement to rely on section 40(2) FOIA to refuse to provide the requested information.

In his grounds of appeal (“GoA”), the Appellant argues the following grounds:

The Commissioner maintains his position as set out in the DN setting out his findings and the reasons for those findings. The Commissioner makes further observations in his Response to the Appellant’s GoA and submits that there is a real (as opposed to hypothetical) risk of re-identification:

The Commissioner argues that immediately it can be seen that the Appellant’s contention that the individual’s name and the name of the MP they work for is already published on the Register is not correct. This is because there are two qualifying requirements before a staff member is required to go on the Register, namely (i) hold a parliamentary pass and (ii) hold outside employment, and/or (iii) receive benefits, gifts and/or hospitality.

The Commissioner argues that the important point to note is that holding a position as an MP’s member of staff does not, in itself, trigger an obligation to go on the Register, or to put it another way any member of staff who does not meet the criteria set out is not required to place their name on the Register. The Register self-evidently is not a comprehensive public record of all staff in the employ of Members of Parliament, and the Appellant is wrong to suggest otherwise.

The Commissioner recognises that many (perhaps the majority) of staff may make such a declaration. But ‘most’ if not ‘all’ , which is the premise upon which the Appellant’s ground is effectively predicated.

The Commissioner submits there must be a likelihood that not all members of all MPs’ staff have posted their work status on Linked-In (if for no other reason than safety concerns, as the Appellant himself has conceded). Thus Linked-In cannot be regarded as a comprehensive public domain record of all staff in the employ of Members of Parliament; the Appellant is wrong to suggest otherwise.

Furthermore he argues, it is far from inconceivable that a motivated intruder could use Linked-In as a tool to discover other members of staff by association (and who themselves do not have a profile), which amounts to a risk of indirect identification (“the jigsaw effect”).

The Commissioner submits that in all the circumstances IPSA was entitled to withhold the information requested by the Appellant and the Commissioner’s DN is correct in law. The Appellant’s GoA do not reveal any error of law in the balancing exercise as alleged and the Commissioner submits that this Appeal should be dismissed.

IPSA submit the withheld information is clearly the personal data of the MPs in question and explain however, IPSA does not rely on the data protection rights of MPs to withhold that personal data: this is because, as regards MPs, IPSA has taken the view that, on balance, disclosure of the withheld information would be lawful, because of the public roles and profiles of MPs. Instead, it relies on the data protection rights of individuals who were members of each MP’s staff over the period covered by Mr McKeon’s request. To disclose the withheld information would be to disclose the personal data of those individuals. “Personal data” is defined in Article 4(1) of the UK GDPR.

IPSA submit that the GoA do not undermine IPSA’s case or the Commissioner’s conclusions on section 40(2) FOIA:

The Commissioner and IPSA argue they were therefore correct to conclude that the withheld information is exempt from disclosure under section 40(2) FOIA.

If the Tribunal agrees with IPSA’s case on section 40(2) FOIA, then it need not consider IPSA’s supplementary case. However, should the Tribunal need to consider the matter further, IPSA also maintains that the withheld information is exempt under section 38(1) FOIA, which provides as follows:

IPSA’s view is that the disclosure of the withheld information would create a significant and weighty risk of some members/former members of MPs’ staff being subjected to the kinds of abusive, harassing and dangerous contact. Even if this were to be only a very small number of such instances, that would suffice for section 38(1) FOIA to be engaged.

Section 38(1) is a qualified exemption, but as the Tribunal recognised in BUAV v IC and Newcastle University (EA/2010/0064): “self-evidently, there would need to be very weighty countervailing considerations to outweigh a risk to health or safety which was of sufficient severity to engage section 38(1)”. There are no such weight countervailing considerations in this case. Therefore, if section 38(1) FOIA is engaged, the public interest balance clearly favours maintaining that exemption rather than disclosing the withheld information.

Accordingly, should the Tribunal need to consider section 38(1) FOIA, it is invited to agree that the withheld information is exempt under that provision also.

For those reasons, together with the reasons given by the IC in his decision notice, Mr McKeon’s appeal should be dismissed.

The Appellant provided submissions in relation to his appeal and response to the Commissioners argument submitting that the Commissioner failed to demonstrate how individual staff members could be identified using the details of staff turnover and further, that there is no clear mechanism involving the date requested that would result in individual members of MPs’ staff being identified without their consent.

The Appellant refutes that the Miller threshold is met.

The Appellant avers that the IPSA’s original position was untenable and therefore the Commissioner’s conclusion is no longer appropriate.

The Appellant contended that the Commissioner misunderstands and mischaracterizes his argument. The Appellant argued that the Commissioner has failed to explain how the requested information could lead to the identification of MPs’ staff without their consent. Therefore, the appeal should be allowed, and the names should be released.

IPSA’s concerns about disclosing that data can be summarised as follows:

That is the summary of IPSA’s case that the Tribunal is invited to uphold. If Mr McKeon’s appeal is to succeed, he needs to make clear which part(s) of the above summary he says are wrong and why. IPSA maintains that its summary above is right, and compelling. The exemptions under sections 40(2) and 38(1) FOIA are engaged, and the appeal should be dismissed. In the remainder of this skeleton argument, IPSA reiterates its case, as put in its Response to the Grounds of Appeal [A18], in more detail.

The Appellant made the following submissions for the Appeal.

That the section 40 (2) exemption was incorrectly applied. Further, that the original argument was flawed. The Appellant stated that disclosure would support the legitimate interests of journalism and transparency.

The Appellant argued that any harm to the interests of others in disclosing the information would be limited. Finally, that disclosure would ensure compliance with the data protections principles.

After discussion on the general submissions the Tribunal questioned the Appellant on specific factual matters that we feel are crucial to the request. We asked the Appellant what he would do with the information and how useful it would be. In answer he described how he had a lot of information already, but this information would, on “a longer term and with a sensitive approach” allow him to identify those who had left their job with certain MPs’, and it would “- confirm his suspicions”. He continued to describe how he could look at adverts for the jobs and add this information to a lot of things in Westminster that are done informally and not advertised etc. This would allow him to piece together information he already has and help focus his inquiries.

When asked if he recognised the risks of speculation, based on the information he seeks leading to inferential conclusions for the use of Personal Data which leads to the identity of the Data Subjects, he answered that the risk of this happening is low, and it would provide a fuller and clearer picture of turnover. The Tribunal explained that like IPSA, the Tribunal accept that the Appellant is a responsible individual but there are many in the world at large that are not so responsible, and disclosure would be to the world at large. The Appellant did not challenge IPSA’s contention that MPs and their staff are vulnerable to abuse, harassing and dangerous contact from members of the public.

The Tribunal accept there is a legitimate interest in addressing any issue of bullying of staff by MPs. We have been provided with evidence of alternative mechanisms of detection of bullying and published outcomes of proper and fair investigations into such unjustified conduct. However, we have serious concerns about disclosure of the withheld information to the world at large. On the Appellants own evidence, it could lead to the identification of the Data Subjects who are employed by MPs at Westminster. Otherwise, the Appellant would not be making the request or appealing the DN. Others could use similar or even alternative methodology as described to us by the Appellant to achieve the same purpose he wishes to use the withheld information for. This, on his own evidence could lead to speculative interpretation that could and in our view would have an unfair, disproportionate, and significant detrimental and harmful effect on the data subjects concerned, as described by IPSA in these proceedings and as we as a Tribunal have judicial notice of in any event. Those data subjects have a strong legitimate expectation that their privacy rights would be protected by law. Even if only one such employee was to be identified those legitimate expectations would be undermined.

The Tribunal recognise there may be a legitimate interest in exposing bullying in the workplace and in circumstances that concern the Appellant however we are of the view that there is not much to be gained from disclosure of the withheld information as we find high turnover rates within an MR’s office may occur for many reasons other than harassment and/or bullying. Accordingly we find the information is not definitive and may well lead to incorrect assumptions. We cannot see benefits to the public interest in disclosure of the withheld information in this case being exposed to the world at large. The Appellant has failed to persuade us otherwise. Such speculative assumptions that might be made, in our view cannot possibly outweigh the data subject protection afforded by the Law to the Data Subjects.

The Tribunal accept that that the withheld information amounts to personal data and s40(2) is engaged as argued by the Respondents. We accept and adopt the Commissioners’ reasoning as set out at paragraph 31 above and similarly address the the 3 gateway questions (i) whether there is a legitimate interest in disclosing the information, (ii) whether disclosure of the information is necessary, and (iii) whether these interests override the rights of the individuals whose personal information it is. We agree there is a legitimate interest in general terms, but as explained above we are not persuaded disclosure is necessary, or in any event that the identified interests in disclosure (transparency and journalism) outweigh the interests or fundamental rights and freedoms of the data subjects which require the protection of personal data and the legitimate interest balancing test weighs in favour of non-disclosure.

We find the arguments presented by Mr. Hopkins in his submissions, and upon the authorities he has cited, compelling and refer also to the helpful ICO guidance at:

For all the above reasons we can find no error of law in the DN nor in the exercise of his discretion by the Commissioner therein and we must dismiss the appeal.

All members of the panel have contributed to the writing of this decision.