Edward Carter v The Information Commissioner & Ors

Section 31 FOIA provides a qualified exemption subject to the public interest test in respect of information relevant to specific areas of law enforcement:

The exemption is prejudice based. ‘Would or would be likely to’ means that the prejudice is more probable than not or that there is a real and significant risk of prejudice. The public authority must show that there is some causative link between the potential disclosure and the prejudice and that the prejudice is real, actual or of substance. The harm must relate to the interests protected by the exemption.

Section 31(a) is a qualified exemptions and therefore if it is engaged, the tribunal must consider whether, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing whether the information.

Section 41 provides, so far as relevant:

The starting point for assessing whether there is an actionable breach of confidence is the three-fold test in Coco v AN Clark (Engineers) Ltd [1969] RPC 41, read in the light of the developing case law on privacy:

The common law of confidence has developed in the light of Articles 8 and 10 of the European Convention on Human Rights to provide, in effect, that the misuse of ‘private’ information can also give rise to an actionable breach of confidence. If an individual objectively has a reasonable expectation of privacy in relation to the information, it may amount to an actionable breach of confidence if the balancing exercise between Article 8 and Article 10 rights comes down in favour of Article 8.

Section 41 is an absolute exemption, but a public interest defence is available to a breach of confidence claim. Accordingly, there is an inbuilt consideration of the public interest in determining whether or not there is an actionable breach of confidence. The burden is on the person seeking disclosure to show that the public interest justifies interference with the right to confidence.

Under section 12(1) a public authority is not obliged to comply with a request for information where:

The relevant appropriate limit, prescribed by the 2004 Regulations is £450.

In making its estimate, a public authority may only take account the costs it reasonably expects to incur in relation to the request in–

The 2004 Regulations specify that where costs are attributable to the time which persons are expected to spend on the above activities the costs are to be estimated at a rate of £25 per person per hour.

The estimate must be sensible, realistic, and supported by cogent evidence ( McInnery v IC and Department for Education [2015] UKUT 0047 (AAT) para 39-41).

A public authority cannot comply with FOIA by providing such information as it can find before exceeding the section 12 limit ( Reuben Kirkham v Information Commissioner [2018] UKUT 126 (AAC)).

Guidance on applying section 14 is given in the decisions of the Upper Tribunal and the Court of Appeal in Dransfield ([2012] UKUT 440 (AAC) and [2015] EWCA Civ 454). The tribunal has adapted the following summary of the principles in Dransfield from the judgment of the Upper Tribunal in CP v Information Commissioner [2016] UKUT 427 (AAC):

The Upper Tribunal held that the purpose of section 14 must be to protect the resources of the public authority from being squandered on disproportionate use of FOIA (para 10). That formulation was approved by the Court of Appeal subject to the qualification that this was an aim which could only be realised if ‘the high standard set by vexatiousness is satisfied’ (para 72 of the CA judgment).

The test under section 14 is whether the request is vexatious not whether the requester is vexatious (para 19). The term ‘vexatious’ in section 14 should carry its ordinary, natural meaning within the particular statutory context of FOIA (para 24). As a starting point, a request which is annoying or irritating to the recipient may be vexatious but that is not a rule. Annoying or irritating requests are not necessarily vexatious given that one of the main purposes of FOIA is to provide citizens with a qualified right of access to official documentation and thereby a means of holding public authorities to account (para 25). The IC’s guidance that the key question is whether the request is likely to cause distress, disruption, or irritation without any proper or justified cause was a useful starting point as long as the emphasis was on the issue of justification (or not). An important part of the balancing exercise may involve consideration of whether or not there is an adequate or proper justification for the request (para 26).

Four broad issues or themes were identified by the Upper Tribunal as of relevance when deciding whether a request is vexatious. These were: (a) the burden (on the public authority and its staff); (b) the motive (of the requester); (c) the value or serious purpose (of the request); and (d) any harassment or distress (of and to staff). These considerations are not exhaustive and are not intended to create a formulaic checklist.

Guidance about the motive of the requester, the value or purpose of the request and harassment of or distress to staff is set out in paragraphs 34-39 of the Upper Tribunal’s decision.

As to burden, the context and history of the particular request, in terms of the previous course of dealings between the individual requester and the public authority in question, must be considered in assessing whether the request is properly to be described as vexatious. In particular, the number, breadth, pattern, and duration of previous requests may be a telling factor [para 29]. Thus, the greater the number of previous FOIA requests that the individual has made to the public authority concerned, the more likely it may be that a further request may properly be found to be vexatious. A requester who consistently submits multiple FOIA requests or associated correspondence within days of each other or who relentlessly bombards the public authority with email traffic is more likely to be found to have made a vexatious request [para 32].

Ultimately the question was whether a request was a manifestly unjustified, inappropriate, or improper use of FOIA. Answering that question required a broad, holistic approach which emphasised the attributes of manifest unreasonableness, irresponsibility and, especially where there was a previous course of dealings, the lack of proportionality that typically characterises vexatious requests [paras 43 and 45].

In the Court of Appeal in Dransfield Arden LJ gave some additional guidance in paragraph 68: ‘In my judgment the Upper Tribunal was right not to attempt to provide any comprehensive or exhaustive definition. It would be better to allow the meaning of the phrase to be winnowed out in cases that arise. However, for my own part, in the context of FOIA, I consider that the emphasis should be on an objective standard and that the starting point is that vexatiousness primarily involves making a request which has no reasonable foundation, that is, no reasonable foundation for thinking that the information sought would be of value to the requester or to the public or any section of the public. Parliament has chosen a strong word which therefore means that the hurdle of satisfying it is a high one, and that is consistent with the constitutional nature of the right. The decision maker should consider all the relevant circumstances in order to reach a balanced conclusion as to whether a request is vexatious. If it happens that a relevant motive can be discerned with a sufficient degree of assurance, it may be evidence from which vexatiousness can be inferred. If a requester pursues his rights against an authority out of vengeance for some other decision of its, it may be said that his actions were improperly motivated but it may also be that his request was without any reasonable foundation. But this could not be said, however vengeful the requester, if the request was aimed at the disclosure of important information which ought to be made publicly available...’

Nothing in the above paragraph is inconsistent with the Upper Tribunal’s decision which similarly emphasised (a) the need to ensure a holistic approach was taken and (b) that the value of the request was an important but not the only factor.

The lack of a reasonable foundation to a request was only the starting point to an analysis which must consider all the relevant circumstances. Public interest cannot act as a ‘trump card’. Rather, the public interest in the subject matter of a request is a consideration that itself needs to be balanced against the resource implications of the request, and any other relevant factors, in a holistic determination of whether a request is vexatious.

In relation to whether or not a request could be vexatious because of the cost of compliance the Court of Appeal stated:

In Home Office v Information Commissioner and Cruelty Free International [2019] UKUT 299 (AAC) the Upper Tribunal stated:

In the same case the Upper Tribunal stated, at para 21, that although there are other provisions, such as section 12, that allow burden to be addressed, those other provisions do not deal with every eventuality.

The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether she should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The issues we have to determine are as follows:

If the disputed information, or any part of it, were released, would it prejudice, or be likely to prejudice, the prevention of crime?

If so, does the public interest in maintaining the exemption outweigh the public interest in disclosing it?

Is any of the disputed information confidential within the meaning of section 41(1) FOIA?

For any information which is confidential, would disclosure be in the public interest such that it would not amount to an actionable breach of confidence?

Do the relevant costs fall within the costs that may be included within an estimate of the cost of responding to the Request, for the purposes of section 12, as defined by the 2004 Regulations?

If so:

Is the request vexatious?

We had before us the following bundles of documents, which we have taken account of where relevant:

We read statements from and heard oral evidence from:

We read witness statements from the following witnesses on behalf of the appellant who did not attend the hearing:

We placed more limited weight on the statements of Mr. Chait and Mr. Talbot Williams because their evidence was not tested by cross-examination.

The appellant and the Councils submitted skeleton arguments and made oral submissions. The tribunal took account of the content of all submissions where relevant.

We held a number of short sessions that were closed to the public but open to the parties, the content of those sessions and any documents or evidence referred to in those sessions are covered by a separate rule 14(1) order and their disclosure or publication to anyone other than the parties is prohibited.

We held a closed session, from which everyone except the second and third respondents was excluded. The following gist of that closed session was provided to Mr. Carter’s representative in the hearing:

Three categories of information are requested:

The only requested information not agreed as being in the public domain is confirmation of what companies are liable for which hereditament (the PRN being related to that hereditament). The objection, essentially, is to ease of triangulation of two pieces of publicly available information.

The relationship between business name and hereditament is obtainable with little effort, including by the Royal Mail’s Postcode Address File (PAF).

Both Councils’ primary process to counter fraud by telephone (set out briefly at Paragraph 11 of CoL’s Response) centre on provision of an Account Reference Number, business name and address. The former is not requested to be disclosed in these proceedings; the latter two are public knowledge.

Failing the provision of an Account Reference Number by a caller, both councils ask a number of questions as a kind of backup process to confirm identity. WCC give as examples “payment method, amount of last payment dates of occupancy and any exemptions or reliefs that have been applied for”. Imitating a ratepayer is made very difficult by the Councils’ processes, as one would expect.

There is no evidence of any fraud caused by disclosure of the requested information by other public authorities. This includes the Royal Borough of Kensington and Chelsea and Hammersmith and Fulham, with whom WCC share fraud prevention services. CoL itself released the information until 2019. Local authorities who do release the requested information have a similar dearth of business rates fraud). 31 out of 33 London boroughs disclose the requested information.

There is also little evidence that business rates fraud is a significant issue, particularly post-Pandemic, and the end of COVID-related grants.

CoL has had no attempted frauds in the last 10 years and WCC have been able to raise one or two incidents of rates fraud since 2015, one where the perpetrator certainly had physical access to the building. Evidence of fraud that has been filed relates to either: physical interception of communications or forms; wholesale forgery of proof of address and/or trading to attempt to either (i) change the bank details on file or (ii) prove occupancy; or something other than business rates.

There are other, complex systems in place to prevent fraudulent transfer of funds both at the stage of accessing the account and at the stage of transferring funds. This includes providing refunds only to the person who made payment.

A list of ratepayers would not help a fraudster with the in-depth research or forgery on a single target that a fraudster would need to perform to even begin an attempt at fraud.

In both councils’ witness evidence, it appears that the name of the ratepayer is only relevant to fraud protection in that it “amounts to” (Footnote: ¹ ) (though presumably not “is”) an answer to one of many questions used in a backup process on a telephone helpline. However, the business name and property address are also asked for on first contacting the telephone helpline.

The information sought is not relied on by local authorities to prevent fraud to any appreciable extent. This is logical: all the information requested is easily triangulable from public sources. It is not clear how such information even relates to the prevention of crime, let alone how it would be likely to prejudice it.

The amount of rates administered is independent of fraud risk.

Even if the tribunal were to find section 31 engaged, the likelihood of prejudice would be merely marginal.

There is substantial public interest in disclosure of information assisting with the transparency and accountability of government, particularly in the field of taxation where the local authority benefits from substantial coercive powers and may retain unclaimed credits.

Disclosure of the information would provide significant assistance to specialist advisors in recovering overpayments for ratepayer and the provision of specialist tax advice. The information sought will also assist in revealing wrongdoing by ratepayers – for example, it will assist journalists and investigators reporting on apparently widespread tax fraud relating to souvenir and sweet shops. Disclosure would reveal compliance with regulations made under the Companies Act 2006 concerning disclosure of legal entities, regulations themselves designed to bring transparency. The information will also assist in economics research relating to each borough. There is a clear public interest in knowing the extent (if not the specifics) of the Councils’ poor data retention practices.

CoL and WCC only rely on section 41 as regards the company names. It cannot be seriously argued that the name and address of a company’s registered office is subject to a duty of confidence, given the information on Companies House.

A company’s postal address does not have the basic attribute of inaccessibility. It is insufficient to simply say ‘CoL would be undermining any decision taken by a business to avoid publishing their office address’ without identifying the particular business.

The ‘Marcel principle’ is not a freestanding situation in which information will be provided in confidence. Rather, it applies only where ‘information of a personal or confidential nature is obtained or received in the exercise of a legal power or in furtherance of a public duty’.

In LGFA (section 63C) there is a carve-out from FOIA for disclosure of “revenue and customs information relating to a person” (Footnote: ² ) received from HMRC. Parliament declined to provide the same immunity to other public authorities.

Information showing what company is responsible for which hereditament cannot be said to be imparted in circumstances conferring an obligation of confidentiality.

In relation to the public interest balance, if a company does have an office it wishes to remain secret the tribunal should be anxious to scrutinise the reasons why, given the significant public interest in exposing the potential for fraud or corruption and the illegality of not publicising the entity that carries on business from the premises. If a company does have a particularly compelling reason for remaining secret, that company’s address can be redacted.

In both Councils’ systems, there is a drop-down menu in the system that can identify limited companies. It is possible also to search for entities whose names include common indicators of a company, such as ‘Limited’, ‘Ltd’ or PLC’. Finding all information held fitting the description “companies paying business rates” should therefore take a matter of seconds, perhaps minutes.

The dispute as to section 12 (and 14) really arises because both Councils think that some of the information may be incorrect. The estimates are only arrived at by including costs not properly attributable to the task.

The tribunal is invited in any event to scrutinise the estimates with case.

The Councils accept that there is an easily searchable centralised database that can be filtered for company type and name. Its case instead is that it would need to check these records for their accuracy, lest it disclose details of ratepayers that in fact are not companies (in particular it raises the spectre of personal data) and the cost of this audit can be counted towards the cost of complying with the request for the purposes of section 12.

This argument is wrong in law. The right to recorded information is indifferent as to whether the information is accurate. The requests are for the information recorded by the public authorities on ratepayers that ( according to the information those authorities had recorded and held at the time of the request) were companies. Regulation 4(3)(d) of the 2004 Regulations concerns only costs in separating out information described by the request from that not described by the request. This cannot extend to verifying the accuracy of that information or altering the information to make it accurate.

Comparing the accuracy of the information against an external source and vetting the database for compliance with legal obligations and/or best recordkeeping practice is not ‘extracting information from a document’.

Any consideration or investigation as to whether information caught within the request is exempt (for example, a consideration of whether it is personal data or not) is not caught by the 2004 Regulations and is not attributable to the costs of compliance for the purposes of section 12.

In this case, the Councils hold information that certain ratepayers are companies. Whether that information may be wrong is irrelevant: that the information held may be incorrect does not mean it is not (i) information, that is (ii) held, which; (iii) is described by the request.

That a public authority wishes to audit its own record-keeping in response to a request is not due to the request for FOIA purposes and cannot make that request vexatious within section 14. The costs of an exercise not required by or under FOIA cannot be counted towards it and so cannot make a request vexatious.

It would also allow public authorities to retrospectively correct wrong information (and there is a public interest in ascertaining a public authority acted based on an error of fact, or holds wrong information, or holds it in breach of legal obligations). It would remove the ability of the public to discover errors.

The Upper Tribunal in Homes for Haringey said (at [88]):

The appellant submits that the request is not vexatious when considered under the headings in Dransfield.

It is submitted that release of the Requested Information would allow a malicious actor more easily to circumvent the security checks that the Councils apply to verify the identity of callers to its NNDR telephone service (and in CoL’s case, would supply one piece of information required to set up an online account). That, in turn, would offer access to other ratepayer information, and so open up additional opportunities for fraud based on impersonation of the ratepayer.

A fraudster would not know directly from the Requested Information which accounts were and were not due a refund, but it is the Appellant’s case that this can often be discerned from the Valuation List published by the VoA. The Requested Information would enable a fraudster systematically to match the VOA entry to a business name, using the PRN.

In addition, disclosure would mean that security could more easily be compromised, allowing a fraudster to find out more information about the account and potentially to divert funds. Moreover, the provision of a ready-made list of information relating to all ratepayers would allow for systematic attempts to match this information with other data available (legitimately or otherwise) to clear security on the Council’s NNDR enquiries service.

Only a partial set of the Requested Information is in the public domain, some of it at cost, and even that information is not necessarily available in the form of a ready-made list. The provision of such a list would therefore be of significant assistance to a potential fraudster.

Attempts to commit a different type of imposter fraud, whereby fraudsters pose as CoL’s commercial suppliers, have increased since local authorities have been required to publish details of transactions over £500. This is evidence that fraudsters are liable to exploit any available data set that can be linked to financial transactions.

The Councils administer a higher volume and value of NNDR, and NNDR refunds, than any other local authority in the country. The Councils maintain that disclosure would present a significant additional risk of fraud against them, regardless of the situation in other local authorities.

The statements of Mr Hinckley and Mr Black provide a fuller explanation of how disclosure would assist a fraudster to bypass telephone security. Moreover, armed with the hereditament and business name (potentially combined with other identifying information, obtained legitimately or otherwise) it would also be possible to write to or e-mail the Councils to request alterations to the business rate account, obtain access to the CoL online portal, divert bills, close accounts, and request refunds.

It is submitted that disclosure would prejudice the prevention of crime, that is that the relevant prejudice would be more likely than not to occur.

The public interest in not facilitating fraud, which if successful enriches a dishonest wrongdoer at the ultimate expense of ratepayers, is very significant indeed, especially given the particularly large sums that are at stake in relation to the two Councils. One or more successful frauds are a real possibility as a result of disclosure, and this possibility should be given very considerable weight in the public interest balancing exercise.

The tribunal must consider secondary effects, such as the measures that are likely to be taken to combat the enhanced risk of fraud. In the present case, these include changes to the telephone security system and time and resources spent by the Councils in combatting attempts at fraud. These are both undesirable outcomes that add additional weight to the public interest in maintaining the exemption.

The Councils acknowledge that there is some public interest in the additional transparency that would be provided by disclosure. However, it is disputed that the Requested Information, which does not include any data on the value of NNDR levied nor on the applicability of any reliefs, could be used to ‘provide research and statistical data and advice on the revaluation of premises since the Covid-19 pandemic’. Nor has the Commissioner or appellant offered any convincing explanation of how it ‘would aid in the economic development (and redevelopment) of an area’ to release only a list of company names, hereditaments, and PRNs. In the absence of such an explanation, the Councils consider that the dataset is simply not rich enough to provide any meaningful boost to economic development.

Gavin Chait states that the Requested Information would reveal changes in economic activity over time – but this envisages repeated release of the equivalent information in future and is only tangentially relevant to the public interest in disclosure of this Requested Information. The second point made by Gavin Chait relates to a legal requirement that has applied since February 2023 and is not relevant to the public interest in disclosure at the relevant time in September 2021.

Local authorities already have processes to alert ratepayers who are entitled to a refund, which limits the extent of the public interest in advisers gaining ‘an opportunity to approach companies when they believe there is an unutilised opportunity to achieve a saving on their behalf.

A significant element of the appellant’s public interest case rests on the argument that disclosure would increase the ability of surveyors and ratings agents to market their services helping businesses to apply for refunds. Ultimately, the appellant is seeking to increase direct marketing of a commercial service. Increased marketing of rating agent services is therefore by no means an unalloyed public good.

The suggestion that disclosure might work to reveal companies with ‘links to money laundering and/or corruption’ remains speculative. Investigations into tax evasion are carried out by authorities who have (or can request) access to much more detailed information that is within the scope of the Request. Corrupt companies are likely to be very few relative to the overall number of ratepayers in the Westminster/City of London, and anyone with an interest in tracking their activities is already able do so, much more efficiently, via (for example) targeted internet searches.

The principle of taxpayer confidentiality is well established and applies to any information for which the elements of a breach of confidence are made out. The obligation of confidentiality also arises expressly through the privacy notice which CoL provides to ratepayers when collecting information.

The ratepayers’ identity, which carries with it the necessary implication that they are liable for NNDR in Westminster/the City of London, is information that the Councils obtain from ratepayers, so that they can fulfil duties under the relevant legislation to levy NNDR. That information is not necessarily freely, or easily available online, and accordingly may properly be regarded as confidential.

By publishing the details requested, the Councils would be undermining any decision taken by a business to avoid publishing their office address (as being linked to that business), which would cause them detriment. For the reasons set out above in relation to section 31 FOIA, disclosure of ratepayer companies’ identities would also increase the risk of fraud being committed against the company.

The Request is for information relating to companies only, and so the Council would need to extract the Requested Information from its NNDR database, which also contains equivalent information relating to partnerships and sole traders. There is no automatic and accurate way to separate company information from non-company information.

Both Councils have made an estimate of the time it would take to respond to the Request. In each case, the only time they have counted is the time it would take to extract the Requested Information from the database containing it. The estimate in each case exceeds the section 12 cost limit. In each case, the estimate is supported by evidence, is based on an actual sample review (not mere guesswork) and is reasonable.

The appellant now argues that the time it would take the Councils to ensure that they supplied only company information, and not sole trader or partnership information, is not time that can be counted towards the section 12 limit. The appellant argues, first, that time spent confirming whether information does or does not relate to a limited company is not time spent ‘extracting the information from a document containing it’ for the purposes of reg. 4(3)(d); and second, that in any case the Request encompasses information wrongly categorised as company information.

The cost of identifying what is and is not part of the Requested Information is obviously a cost ‘incurred in relation to the request’ in extracting the information.

It cannot be the case that ‘information of the description specified in the request’, to which section 1 FOIA applies, includes information wrongly so labelled by a public authority.

In the alternative the Councils rely on cost under section 14. If the tribunal accepts the Councils’ arguments that it will be extremely time-consuming and costly to disaggregate company from non-company information, those costs would impose an undue burden, whether or not they fall within the 2004 Regulations.

Mr Castle submitted that, standing back, this is a list of names and addresses of companies. A company’s name is in the public domain. The list of hereditaments is in the public domain and can be downloaded as a searchable list from the VoA.

The relationship between the two is largely obvious from public sources such as Companies House and the PAF list of addresses. The Companies Act regulations require the person carrying on a business in a property, which will be the occupier, to display the company name in characters that can be read with the naked eye. Mr. Carter’s evidence was that he could find the requested information in relation to an individual business in 20-25 minutes.

Mr. Hinckley’s evidence that many businesses do not display company names should be looked at in the context that he can only comment on ‘problem properties’ and does not visit that many properties personally. The evidence in the bundle shows that the two companies that were asked and objected in fact publish the information.

Mr. Castle submitted as follows:

Without rating agents, it is very difficult for individual ratepayers to claim what they are entitled to. They are a necessary part of the system in relation to rateable value appeals and can assist in claiming reliefs. The information would enable rating agents to do their work. This is important because of the amount of unclaimed reliefs. Although CoL have never had to write down unclaimed reliefs, WCC do this in the amount of about £1 million every year.

The information can be used by economic researchers to plot macro and micro economic changes over time.

The information will assist in reporting and open public debate in relation to fraud such as the ‘sweet shops’ fraud. This may lead to landlords ‘freezing out’ such companies from the market. It is an entry point into opaque corporate structures.

The information can be used to monitor compliance with Companies Act regulations on the publication of company names and assist in transparency for the purpose of enforcing consumer rights or other disputes with companies that do not publish their names.

Rogue agents are a minority. The tribunal should be cautious in concluding that rates avoidance is not in the public interest.

When CoL released the information, the situation was mitigated by a simple instruction to staff, so the phone system would not need to be altered.

The information is not confidential in nature. The two businesses who said that they wanted to keep their address confidential published it on the internet.

The fact that the material is list is not relevant to section 41, because it depends on each individual’s separate action for breach of confidence.

Section 41 cannot be applied in a blanket manner.

The right under FOIA is to be informed if a public authority holds information recorded in any format of the description specified in the request. The request in this case is for information held and recorded about companies that pay business rates. Therefore, if it is recorded for entity A that it is a company, then that it what must be communicated to the requestor.

Checking whether the information really matches the request because the entity is truly a company does not fall within ‘extracting the information’. It is wrong to import concepts of ‘right’ or ‘correct’ information into FOIA.

Given the acknowledged public interest in the release of the information it cannot be said that this request is manifestly unjustified.

Mr. Lockley invites the tribunal to put little or no weight on the evidence of Mr. Chait and Mr. Williams because they have not been put forward for cross-examination.

Mr. Lockley submits that the Councils’ case is very simple. If someone calls the NNDR inquiries line, they are asked first for the account number. If a caller doesn't have that account number, they are asked a series of questions one of which is the name on the account. The Councils have been asked to disclose a ready-made list of the names on the account for every account in those two boroughs.

Mr. Lockley acknowledged that other information would be needed to bypass the security systems, but one those systems have been passed, the Council understands that it is talking to the bona fide ratepayer which could facilitate the commission of fraud in a number of ways.

The evidence was that the requirement to display a company name is observed more in the breach both from Mr. Hinkley and his team. Providing a ready-made list is a highly material addition to the risk to the system. It is a head start for anyone wanting to commit fraud. It provides a bigger list of places to start digging.

The test is whether disclosure would or would be likely to prejudice the prevention of crime, not whether it would or would be likely to lead to an increase in crime. The test is made out to the higher threshold.

Additional security is expensive for Councils and the taxpayer. The public interest in avoiding a less secure system is obvious. Successful fraud and attempted fraud cost the public purse money.

Any evidence of a lack of recorded fraud or attempted fraud is of limited value. The data relates the period prior to the pandemic when there was an increase in fraud and opportunities for fraud. It shows that they had no records of attempted fraud not that there were no attempts. In relation to WCC it relates to a period in which they did not publish the data. CoL only published the information on three occasions when it was at least 6 months old, and it was hidden on the Council website. There was no discernible increase in the activity of ratings agents when the CoL information was published. This suggests it was not that widely accessed.

It would be a mistake to assume that the types of fraud described in evidence are in any way exhaustive of the ways in which people attempt to commit fraud.

In summary the public interest in favour of withholding the information is very weighty because of:

Mr Lockley recognised that it is in the public interest that businesses claim the reliefs to which they are entitled, and that most rating agents play a legitimate role in facilitating that, but that rating agents already do that without the requested information. A ready-made list would not add much to the work of legitimate rating agents above saving some time. A ready-made list would facilitate blanket approaches which are more likely to be taken by less reputable ratings agents whose work is not in the public interest.

Mr. Lockley submitted that the tribunal should place limited weight on Mr. Chait’s evidence. It has not been tested by cross-examination and his research uses different data – vacancy data. It is in any event unclear how it would work without series of data releases to show changes over time. There will be very limited ability to extract trends using the limited data already released by CoL.

Mr. Lockley submits that it is naïve to suggest that publishing the requested information would help with unravelling the problem of candy stores when the people who are supplying the name to be used on the account are, by definition, criminals. The Councils are already working on the issue with full access to the information plus other coercive powers. It is unclear how publication would move that forward. Journalists can write about this without the requested data.

Mr. Lockley suggested that the tribunal disregard or give limited weight to the new point that was made in Mr. Castle’s oral submissions about compliance with Companies Act regulations, in the absence of any evidence that anyone was particularly concerned about this or would seek to use the information in that way.

Mr. Lockley submitted that the interrelation between the name and the hereditament satisfies the three conditions in Coco on a class basis.

It is imparted in circumstances implying confidentiality. That arises out of the relationship between the Council as ratings authority and the occupier who is compelled to provide that information to trade. The notices given by the Councils do not refer expressly to an obligation of confidence but convey a message that disclosure will be for tightly controlled purposes relating to the administration of rates and not to the world at large and not for the purposes of marketing.

The information has the quality of confidence. The name on the account is often not public at all, because it might be a trading name. It is possible to get a general sense of where a business is carried on, but it is often hard to know specifically what a hereditament is. Those are available on the VoA but without the link to the name.

There may be specific detriment to particular companies, but the detriment as a class is the increased risk of fraud.

The public interest in disclosure is modest so there will be no public interest defence available to justify disclosure.

Mr. Lockley submits that the tribunal should accept the evidence about what the witnesses did in making their estimates and find that the estimate was reasonable and supported by cogent evidence.

Mr. Lockley submits that the challenge is primarily on the basis that there is a label in the database saying that an organisation is a company or not and that somehow that label should be definitive for the purpose of the request. FOIA requests are to be construed objectively not according to the public authority’s individual labelling of the information. The request is for a list of companies. The existence, or otherwise, of an indicator does not change the information that falls within the scope of that request.

The definition of information in section 84 excludes unrecorded information and includes information recorded in any form. It does not seek to define information by the formal trappings of how it is recorded unless the request makes clear that is what is wanted. The Councils are not checking that the information is accurate in the sense of checking the correct post code or the spelling of the name or even that the company has used the correct legal name.

Mr. Black explained that the indicator has not been used in a systematic way. It defaults to ‘company’. It would be absurd if simply not checking the box meant that an individual was included within the scope of a request which is for information about companies. If a label was definitive, it would cut down the section 1 right which would be at the whim of labelling errors.

The cost of extracting information covers all costs that would reasonably be expected to occur in extracting that information, which includes working out which information you need to extract.

If the tribunal holds that the extraction process is properly a redaction process, the tribunal can apply section 14. Section 40 is effectively a mandatory exemption. The question remains whether this is a disproportionate or unjustified use of FOIA in the light of the burden on the public authority.

There is an overlap under this exemption between whether the section is engaged and any subsequent application of the public interest test, because the prevention of crime is in the public interest. Some of our reasoning in this section also supports our conclusions on the public interest balance below.

The applicable interest in this case is the prevention of crime. It is important to note that section 31(1)(a) is engaged where there would or would be likely to be prejudice to the prevention of crime. It does not require the respondent to show that disclosure would or would be likely to lead to any increase in crime.

The nature of the prejudice being claimed by the Councils is that the release of the information would reduce the effectiveness of their security checks used to identify the occupier/account holder because, at present, one of the security questions is ‘the name on the bill’ (the liable business party name) and the information includes a list of those names. This is said to be likely to lead to either a need for extra counter fraud security measures or an increase in thwarted attempted fraud and a real possibility of an increase in successful fraud.

When deciding if the section is engaged, we must decide if the Councils have satisfied the evidential burden of showing that some causal relationship exists between the prejudice being claimed and the potential disclosure; if the prejudice is real, actual, or substantial; and whether the chance of prejudice is more than a hypothetical or remote possibility i.e. is there a real and significant risk of prejudice?

We accept that, in many cases, by visiting the building in question and matching with other publicly available information it is possible to find out the name of the occupier of a particular building in around 25 minutes. This should be, and in most cases, will be, the same as the ‘name on the bill’. Sometimes it will not be possible and sometimes the occupier is not the name on the bill.

That is the case for a number of reasons:

Further, whilst it is possible in many cases to find out the name of the ratepayer, we accept that there is an advantage to fraudsters in having a searchable ready-made list of the answers to one of the security questions for every ratepayer, over having to physically visit the premises of each company that you intend to defraud. A list enables access to the information by those who do are not based in the same geographical area and for whom a ‘site visit’ would not be practical.

We accept that this information would not, in itself, allow a fraudster to breach the Councils’ security systems, but it gives one answer to one of the security questions for all ratepayers and therefore weakens the system to some extent. The fraudsters will need a lot more information in relation to an individual company to bypass the security systems, but they will be able to guarantee that they will not get the wrong answer to the question about what name is on the bill, and they will be able to do so without spending 25 minutes per company visiting the premises and matching up other data online. Weakening the security systems in our view inevitably prejudices the prevention of crime.

Based on the above, we accept that there is a causative link between the release of the information and a real and significant risk of prejudice to the prevention of crime, which is real, actual and of substance. We find that disclosure would be likely to lead to prejudice to the prevention of crime and the exemption is engaged.

We have considered above the prejudice of weakening the Council’s current security system. In our view this is an inevitable consequence of releasing the information. We think that there is a strong public interest in not weakening the Council’s security system by releasing a ready-made list to the answer to one of the questions. In effect, the Council would have two options, either live with a less secure system or redesign the security systems entirely which is likely to have significant cost consequences for the public purse. The latter would carry significant weight in the public interest balance.

We note that when the City of London previously released this data into the public domain, they, in effect, chose the former. No steps were taken to change the security questions, albeit that an instruction was issued to staff to make sure that they were aware that the information was in the public domain and that they therefore needed to be careful about the additional questions that were asked in terms of identifying the caller. As far as Mr. Black was aware, there was no increase in fraud or attempted fraud during the 18 months in which this information was online.

The value of this evidence is limited by a number of factors. First, failed attempts to bypass the security systems are not recorded. The Council and Mr. Black would not have been aware of these failed attempts. Second, the information was published 6 months out of date on each occasion. Third the information was relatively ‘hidden’ on the website. Mr. Black was not aware of any increase in the activity of ratings agents during that period. For whatever reason, it appears that the information was not widely known about during that period. In contrast we must consider the effects of disclosure as if it is disclosure to the world.

However, we do think that if there was a high risk of an increase of successful frauds as a result of the release of this information, there would be likely to be some evidence of an increase during the period of 18 months in which it was published by City of London, or that City of London would have taken more extensive steps to deal with the risk. In addition, we note that the examples of fraud provided by the Councils are, in the main, of a different nature.

Further, taking into account that the information only provides a starting point for a fraudster, and that significantly more targeted information would be needed about a particular company to commit a successful fraud, overall we find that the risk of an increase in successful frauds (in the sense of bypassing the security systems and causing financial loss) as a result of the release of this information is very low. Although the risk is very low, the consequences are extremely severe and therefore this factor still carries reasonably significant weight in the public interest balance.

If the system is not re-structured, we think that there is a moderate risk of a small increase in unsuccessful attempts to bypass the security systems, as a result of providing a ready-made list of the answer to one of the security questions. This is particularly so because of the general increased risk of fraud during the pandemic. These attempts may amount in law to fraud, rather than attempted fraud, even if they do not succeed in bypassing the security systems. In some circumstances they might lead to investigations and costs incurred by the public purse. There is a strong public interest in preventing fraud, even at low levels and even if it does not result in financial losses to the Council. This factor carries fairly significant weight in the public interest balance.

Taken overall we think there is a moderate public interest in withholding the information.

Both Councils accept that it is in the public interest for businesses to claim the reliefs to which they are entitled and that rating agents play a legitimate role in facilitating that, in particular in relation to appeals which are complex. We find that there is a public interest in enabling rating agents to do their job.

We accept that there is a large amount of unclaimed credit in both Councils. In general, at the end of the year this is used to reduce a ratepayer’s liability for the next year. However, if, for example, there is no live account, the credit is carried over and written down after 6 years. The City of London write down approximately £1million a year. Whilst rating agents can assist in claiming credits, this is something that companies can easily do themselves. The large amount of unclaimed credits is not something that adds significantly in our view to the public interest in disclosure. We do not accept that the Councils deliberately attempt to create ‘friction’ in the process in an attempt to deprive businesses of the money to which they are entitled.

Rating agents already operate successfully in Westminster and in the City of London without disclosure of the withheld information. The information needed to enable the work of rating agents can already be found, with some effort. Given the targeted approach taken by ratings agents, an extra 25 minutes work per potential client is not, in our view, disproportionate. Having a ready-made list would no doubt make the job of ratings agents somewhat easier, but that carries limited weight in the public interest balance.

Having a ready-made list would facilitate blanket marketing, but in our view that is not in the public interest and not the approach taken by legitimate rating agents like Mr. Carter who take a much more targeted approach. A ready-made list is much more likely to be useful to those who operate at the shadier end of the rating agents’ market, where agents offer a poorer service to clients and, in a minority of cases, engage in illegal evasion. This reduces the public interest in disclosure.

Our decision does not mean that other public authorities should not publish similar data. It does not mean that the City of London or Westminster are entitled to withhold this information in response to similar or even identical requests in the future. That is not how FOIA works. The public interest balance in relation to, for example, historical data, or a series of sets of this data over a period of time where this would facilitate identified and valuable research would involve different considerations and might result in a different outcome.

It is very important that our decision is not used by either these two public authorities or other public authorities as justification for not releasing this type of data. Each request needs to be considered on its merits, considering the particular information requested and in the light of the public interest at that particular time.

Similarly, a decision that this information should be disclosed does not amount to a ruling that similar information must be disclosed in the future, either regularly or at all. That is why we must consider the value of disclosure of this snapshot of data, in the light of any information already in the public domain, rather than the value of regular future publication of this data by these public authorities.

We accept that the withheld information is likely to be useful, to some extent, to researchers. However, we are considering the effect of disclosure of one snapshot list. It could not be used, by itself, to inform research that, for example, observes the rate and volume with which companies open and close business rates accounts over time. This would need number of data points. There is some limited comparative data available from the prior publication of this data by City of London but given the limited number of data points and their age it is unlikely to be of particular assistance in showing trends.

The witness statement of Mr. Chait relates largely to vacancy data, but we do note that he highlights in his statement some specific uses of the data requested in this appeal. Further we note that even one instance of this data could be fed in to Mr. Chait’s database and is therefore likely to plug a small gap and be of at least some value in supporting his work, which we accept adds to the public interest in disclosure.

The media has reported on alleged tax avoidance or evasion by souvenir shops and sweet shops. The Financial Times reported that in August 2022 that Westminster Council had said in June 2022 that they were owed £7.9m in overdue business rates from 30 sweet and souvenir shops in the Oxford Street area.

This issue has been widely reported and investigated. Mr. Hinckley is responsible for this issue at WCC. He already has access to the list of ‘names on the bill’, provided by the persons intent on avoiding paying tax, but the difficulty is in identifying the real occupier of the premises. It is unclear to the tribunal how making the list of names public would add anything meaningful to the likelihood of successfully tackling this problem, when Mr. Hinckley’s team already has access to the list and other coercive powers.

We accept that publication would assist in transparency to some extent, because it would at least identify the name that the company has put forward to the Council as being the occupier. However, having read the detailed reporting on this issue and bearing in mind the information in the public domain on Companies House, with the VoA and displayed at premises, the large amount of public information has already enabled informed and detailed public debate and media reporting. There are likely to be other issues where an opaque corporate structure will be illuminated, to some extent, by knowing the name that the company has put forward to the Council as occupier.

Overall, the increase in transparency in relation to this issue adds a small amount to the public interest in disclosure.

Under regulation 22(2) of the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015/7, a company must display its registered name at any location at which it carries on business. If the location is shared by five or less companies, the name must be positioned that it may be easily seen by any visitor. If the location is shared by six or more companies the names can be available for inspection on a register by a visitor rather than displayed. It is a criminal offence to fail to comply with the requirements of regulation 22.

Mr Hinckley’s evidence was that, in his and his teams’ experience, this was largely observed in the breach. Although Mr Hinckley’s team’s visits will largely be to ‘problem properties’, we accept that this evidence shows that not all companies comply with the Regulations. Given that Parliament has determined that a failure to display the company name is a criminal offence, we accept that there is a public interest in ensuring that companies comply with those regulations. We are not convinced that disclosure of the requested information will, in practice, add materially to informed public debate on this issue or result in any increased compliance, and we find that this does not add significantly to the general interest in transparency in company structures already identified above.

We accept that where a company fails to display a company name, the withheld information might, in some circumstances, assist individuals in identifying the potentially liable legal entity in the case of harm or a consumer dispute. Given the information already publicly available, for example, on Companies House, this is not likely to be of significant impact and in our view adds little to the public interest balance.

Taken overall, although there is some public interest in disclosure, it is reasonably limited for the reasons set out above, and looked at in the round we think that the public interest in disclosure is less than the moderate public interest in withholding the information.

For those reasons the appeal is dismissed and it is not necessary to consider the other exemptions relied on by the Councils, however we have indicated our view and brief reasons below in relation to sections 41 and 12.

If we had had to consider section 41, we would not have been satisfied that the link between the company name and the hereditament had the necessary quality of confidence as a class. In the majority of cases this link is information that has to be made public: the company name (which should be the name of the occupier and therefore the name on the bill) has to be displayed or available for inspection at the place where that company carries on business (which would often be the hereditament) under the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015/7. We accept that in relation to some companies on the list the information may have the quality of confidence, but we are not persuaded that this is the case on a class basis.

If we had been satisfied that the information had the quality of confidence, we would have been satisfied in relation to the other elements of this exemption.

If we had had to consider section 12, we would have accepted that the estimates were reasonable and based on cogent evidence.

We would have rejected Mr. Castle’s argument about the scope of section 12. The question of whether information falls within the scope of a request cannot be conclusively determined by the label that the public authority, however wrongly, happens to ascribe to it in its records. For those reasons we would also have accepted that the information was exempt under section 12.

In the circumstances, we did not go on to consider section 14.

For the above reasons we determine that the Commissioner was right to conclude that the public authority was entitled to withhold the requested information under section 31 and the appeal is dismissed. This decision is not binding on any other public authority, nor does it mean that any request for similar information in the future should be refused by these two authorities. Each request should be assessed based on the public interest in disclosure of the particular information requested at that particular time.