Peter Cleasby v The Information Commissioner

This appeal concerns the following request made on 31 October 2022 by Mr Cleasby:

“I would be grateful for the following information about (a) the Community Panel, chaired by the Registrar, and highlighted in the latest “Community” newsletter, and (b) the Resident Liaison Group also referred to in the newsletter.

For each body:

1 Its terms of reference

2 The names of its members, and which organisation/interest each member represents

3 How its members were selected

4 The duration of members’ appointments

5 The agenda and minutes of all meetings held to date

6 How the effectiveness of the body is assessed

7 The annual running costs of the body.”

In this decision the tribunal refers to the numbered parts of the request as ‘part 1’, ‘part 2’ etc. This appeal relates only to part 2 of the request.

On 23 November 2022 the University responded to the request. It provided the information requested in parts 1, 3, 4, 5 6 and 7. It withheld the information requested in part 2, relying on section 40(2) (personal data) and section 41 (confidential information). The University upheld its position on internal review.

Mr. Cleasby referred the matter to the Information Commissioner on 13 March 2023.

The Commissioner noted that the Community Panel is made up of members of University staff and local residents. The Resident Liaison Group is made up of members of University Staff, representatives from Exeter City Council (ECC) and Devon and Cornwall Police and local residents. The University also confirmed that local residents attend the meetings simply because they are local residents; they don’t represent any organisation or interest (other than their own interest as a local resident).

The Commissioner was satisfied that the requested information was the data subjects’ personal data.

The Commissioner considered that the complainant had a legitimate interest and that there was a degree of wider public interest in this information that would be met through disclosure. Disclosure would provide transparency about precisely whose views and interests the University takes into account when it makes decisions.

The Commissioner accepted that the local residents who were members of the two groups and who were simply members of the public might reasonably expect that their personal data wouldn’t be disclosed to the wider world under FOIA and that disclosing it would therefore cause them distress. This was particularly the case given that their names and contributions might be discussed, perhaps critically, on a website with which the complainant was associated.

The Commissioner considered that the legitimate interest in transparency had been sufficiently met through the information that the University had released and considered it was sufficient to know that the two groups in question comprise local residents, members of University staff, the ECC and the police and that it is those organisations and interests that are represented. Knowing the names of the specific individuals doesn’t add any further insight.

The Commissioner considered that there was insufficient legitimate interest to outweigh the fundamental rights and freedoms of the members of Community Panel and Resident Liaison Group who were local residents and the majority of the members who were representatives of the University, and the representatives of the ECC and police.

The Commissioner considered that the Community Panel Chair might reasonably expect that their name would be disclosed in response to a FOIA request. Disclosing their name would therefore be fair and lawful and transparent.

The Commissioner did not consider section 41.

In summary, the grounds of appeal are (numbering inserted by the tribunal):

Although there is no public interest balance under section 40(2), the tribunal understands ground 1 to be, in essence, that the Commissioner was wrong to conclude that the legitimate interests in disclosure were overridden by the interests or fundamental rights and freedoms of the data subjects.

As this is a full merits appeal, ground two will be subsumed in our consideration of the appeal in any event. We are not bound to take account of matters taken into account by the Commissioner.

The Commissioner points out that he found in Mr. Cleasby’s favour in relation to whether disclosure was necessary for the purposes of a legitimate interest.

The Commissioner submits that:

To the extent that any level and function of the representative members of the RLG has been redacted from the minutes and agendas disclosed in response to part 5 of the request, this did not form part of the Commissioner’s conclusions in his DN.

The Commissioner notes that the University has been slightly inconsistent with regards to whether all members of both groups consented to the disclosure of their personal data in response to the Appellant’s request. The University’s internal review outcome stated that “consent was not provided by the members for their personal data to be processed.” Whereas in its further submissions to the Commissioner dated 19 May 2023, the University stated, “not all [members] have given permission for their names and comments to be made public.”

The Commissioner considers that the University is best placed to comment on the Appellant’s reference in paragraph 5(a) of the Grounds of Appeal to representatives as opposed to individual members of the public in the RLG in respect of their expectations of privacy.

The Commissioner submits that he was entirely correct to rely upon the University’s representations to him during the course of his investigation.

Mr. Cleasby submits that the members of the groups volunteered for what is a form of public service with a public body on behalf of their community. In doing so, they would, or should, have realised that public service, particularly where this involves the influencing of decisions by public bodies, is accompanied by a degree of public accountability. The proposition that these are “simply members of the public” cannot be sustained since they have volunteered for the work, undergone a selection procedure and been appointed to a body that the University publicises as an example of its commitment to community engagement. The Commissioner comments that “disclosure would therefore cause them distress” but does not clearly explain his reasoning.

Mr. Cleasby submits that the Commissioner was not entitled to take what the University said about the website at face value.

Mr Cleasby submits that the requested information will add materially to what has already been disclosed:

We read an open and a closed bundle.

The closed bundle contained the withheld information, and unredacted versions of open documents where the withheld information had originally been redacted.

It is necessary to withhold the above closed information from Mr. Cleasby because it consists of the withheld information and to do otherwise would defeat the purpose of the proceedings.

The relevant parts of section 40 of FOIA provide:

Personal data is defined in section 3 of the Data Protection Act 2018 (DPA):

The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.

The only potentially relevant basis here is article 6(1)(f):

“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”

The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:

Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor:

“27.

... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “

Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

Section 41 provides, so far as relevant:

“S 41 – Information provided in confidence

(1)

Information is exempt information if –

(a)

it was obtained by the public authority from any other person (including another public authority), and

(b)

the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.”

The starting point for assessing whether there is an actionable breach of confidence is the three-fold test in Coco v AN Clark (Engineers) Ltd [1969] RPC 41, read in the light of the developing case law on privacy:

The common law of confidence has developed in the light of Articles 8 and 10 of the European Convention on Human Rights to provide, in effect, that the misuse of ‘private’ information can also give rise to an actionable breach of confidence. If an individual objectively has a reasonable expectation of privacy in relation to the information, it may amount to an actionable breach of confidence if the balancing exercise between article 8 and article 10 rights comes down in favour of article 8.

Section 41 is an absolute exemption, but a public interest defence is available to a breach of confidence claim. Accordingly there is an inbuilt balancing of the public interest in determining whether or not there is an actionable breach of confidence. The burden is on the person seeking disclosure to show that the public interest justifies interference with the right to confidence.

The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The issues for the tribunal to determine are:

Is the data controller or a third party pursuing a legitimate interest or interests?

Is the processing involved necessary for the purposes of those interests?

Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

It is not in dispute that the information is personal data.

We accept that there is a legitimate interest in transparency about precisely whose views and interests the University takes into account when it makes decisions. We accept that there is a legitimate interest in knowing how broad a spectrum of locations and community characteristics are represented. It is not possible to determine which locations and community characteristics are represented simply from the list of names, but it may be possible to ascertain that from publicly available information if, for example, those individuals already have a public profile. We accept that there is a legitimate interest in the seniority, access and influence of the public sector members of the groups.

We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interests. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least intrusive means of achieving the legitimate aim in question, because it would not be reasonably necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subjects.

It is not possible to achieve transparency in relation to precisely whose views and interests the university takes into account, the level of seniority, access and influence of the public sector members and the locations and community characteristics without knowing the membership of those groups. We do not accept that this can be met by knowing simply that the two groups in question comprise local residents, members of University staff, the ECC and the police and that it is those organisations and interests that are represented. For that reason we accept that disclosure is reasonably necessary for the purposes of the above legitimate interests.

The Community Panel is an outward facing group enabling the University to listen to and engage with the local community. The Resident Liaison Group is also an outward facing group enabling the University to liaise with community representatives and other partners to ‘take stock of concerns and queries relating to University/Community relations.’ These are not internal University meetings for the purpose of, for example, discussing staffing issues or taking substantive decisions. They are groups intended to facilitate community participation in a public body.

The membership of the Resident Liaison Group is made up of University staff, lead representatives of resident associations, Exeter City Councillors and County Councillors, Devon and Cornwall Constabulary Officers, Exeter City Council Staff and relevant community organisations. The Community Panel consists of local residents who expressed interest after the University advertised the opportunity and who have been through a selection process which chose 9 members who represented 6 wards across the city. The members are appointed for 3 years.

There is no suggestion that potential members of either group were ever told that their membership would be kept private. We would not expect anyone applying for membership of community groups such as these to be surprised if a list of the members of the group appeared on the community pages of the University website. We would not expect anyone applying or agreeing to be a member of the community group or attending the resident liaison group to be surprised if minutes of the meetings were regularly published on the University website with the names of attendees at the start.

We conclude that disclosure would have been within the reasonable expectations of both the staff members, and the resident members of both groups, in the absence of any evidence that they were given any assurance or even indication that their membership would be confidential.

The website with which Mr. Cleasby is associated is the website of the Exeter Observer, an online newspaper, adhering to the NUJ code of conduct and a member of the BBC local news partnerships. We do not accept that there is any evidence on which we could base a finding that there is any potential for harm and distress as a result of the publication of the names of the members of the groups.

We accept that there is a reasonable likelihood of occasional scrutiny of the meetings of the groups and that this might lead to some reporting in local newspapers, such as the Exeter Observer, which might in some circumstances identify individuals and might on occasion be robust or critical. In our view that is not outside the reasonable expectations of anybody applying or agreeing to join groups such as these and is unlikely to cause harm or distress.

Taking all the above into account, we conclude that the legitimate interests are not overridden by the interests or fundamental rights and freedoms of the members of the groups. In those circumstances we find that the university was not entitled to rely on section 40(2) to withhold the information requested in part two of the request. It also follows from our decision that the university was not entitled to rely on section 40(2) to redact the names or job titles/roles of any of the members of the groups from the minutes released in response to part five of the request.

We have not considered any redactions other than the names/job titles/roles of the members of the groups as they were not raised in the grounds of appeal.

The Commissioner did not go on to consider section 41. In the light of our findings above we conclude that the information was not imparted in circumstances importing an obligation of confidence and there was no reasonable expectation of privacy. Accordingly we find the Council was not entitled to rely on section 41.

For the above reasons we conclude that the Council was not entitled to withhold the requested information under section 40(2) or section 41 FOIA.