Ganesh Sittampalam v Information Commissioner & Anor

FOIA provides that any person making a request for information to a public authority is entitled to be informed in writing if that information is held (section 1(1) (a)) and if that is the case to be provided with that information (section 1(1) (b)). These entitlements are subject to a number of exemptions which can be absolute or subject to the public interest balance in section 2(2)(b) FOIA namely that in:-

“... all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information”

The exemption in section 31(1)(g) FOIA, which is subject to the public interest balance, provides that:-

Section 31(2)(c) FOIA provides:-

Section 40 FOIA concerns personal information. Subsection 40(2) provides:

“(2)

Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles …

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the UK GDPR (general processing: right to object to processing).

(4A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018 …

Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) DPA), and so includes disclosure under FOIA.

The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation (“UK GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” (Article 6(1)(a)).

It also includes where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The UK GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.

The balancing of interests test under Article 6(1)(f) involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):

The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Section 41 FOIA concerns information provided in confidence. Under subsection (1) information is exempt from disclosure if it was obtained by the public authority from any other person and the disclosure of the information to the public (otherwise than under FOIA) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.

Under section 43(2) FOIA, information is exempt if its disclosure under FOIA would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it).

Section 44(1)(a) provides that information is exempt information if its disclosure is prohibited by or under any enactment. As it is an absolute exemption the public interest balance does not apply. The relevant statute in these appeals is the Utilities Act 2000 (“UA 2000”).

The relevant provisions within the UA 2000 are:

The role of the Tribunal is governed by section 58 FOIA. This requires the Tribunal to consider whether the Commissioner’s Decision Notice is in accordance with the law, or, where the Commissioner’s decision involved an exercise of discretion, whether he should have exercised it differently. The Tribunal may review any finding of fact on which the Decision Notice was based (section 58(2)). This means that we may review all the evidence provided to us (even if that evidence was not before the Commissioner) and make our own decision on the merits.

As set out in NHS England -v- Information Commissioner and Dean [2019] UKUT 145 (ACC) "The First-tier Tribunal ‘exercises a full merits appellate jurisdiction and so stands in the shoes of the IC and decides which (if any) exemptions apply..."

In Peter Wilson -v- The Information Commissioner [2022] UKFTT 0149 it was held that:- “30...the Tribunal’s statutory role is to consider whether there is an error of law or inappropriate exercise of discretion in the Decision Notice. The Tribunal may not allow an appeal simply because it disagrees with the Information Commissioner’s Decision. It is also not the Tribunal’s role to conduct a procedural review of the Information Commissioner’s decision-making process or to correct the drafting of the Decision Notice.”

The main issues for the Tribunal to determine in this appeal are:

Was disclosure of the information prohibited under the Utilities Act 2000 (section 105(1)(a) and (b)) for section 44 FOIA to be engaged?

Is the disputed information confidential within the meaning of section 41(1) FOIA?

For any information which is confidential, would disclosure be in the public interest such that it would not amount to an actionable breach of confidence?

Ofgem has statutory duties under various legislation including the Gas Act 1986 Act, the Electricity Act 1989 and UA 2000.

On 31 January 2023, The Times provided evidence to Ofgem relating to British Gas’ use of pre-payment meters in the homes of its vulnerable customers.

On 1 February 2023, The Times published allegations into British Gas’ conduct of imposing forced prepayment meter installations on vulnerable customers. Ofgem opened an investigation into British Gas on 2 February 2023. It formally published the terms of reference of its investigation into British Gas Trading Ltd’s compliance with its licence conditions on 21 February 2023.

The information derived from The Times was the key piece of information that led Ofgem to make a provisional order on 2 February 2023 against British Gas on the basis that it appeared to Ofgem that British Gas was or was likely to contravene its Standard Licence Conditions. The provisional order was made under powers within the 1986 Act and 1989 Act. It is available on Ofgem’s website.

The first request (the October Request) was made to Ofgem on 8 October 2023. Ofgem responded to the request on 3 November 2023.

The second request (the November Request) was made to Ofgem on 17 November 2023. Ofgem responded to the request on 14 December 2023.

The approach that the Tribunal has taken is to start with the absolute exemptions. If we have found that an absolute exemption applies, we have not gone on to consider other exemptions claimed, it being unnecessary to do so. Of course, where absolute exemptions have been found not to apply, we have proceeded to consider the other exemptions. Where we have identified that an exemption applies to information within an email chain, we have treated all the information as covered by that exemption. We have not attempted to separate out parts of the information as any potentially disclosable information was minimal and would be meaningless without the context of the withheld information.

Section 44(1)(a) FOIA provides that information is exempt information if its disclosure is prohibited by any enactment. In this case, if disclosure of information is not prohibited by section 105(1) UA, then condition (a) above is not satisfied, and the information is not exempt information under section 44(1)(a).

In deciding that Ofgem was entitled to rely upon section 44(1)(a), the Commissioner cited Ofcom v Gerry Morrissey and the Information Commissioner [2011] UKUT 116 AC to the effect that neither the Commissioner nor the Tribunal has jurisdiction to determine whether the public authority acted reasonably.

The Commissioner further quoted its guidance on prohibitions on disclosure under section 44 that:

“Where a public authority has discretion about applying a gateway to disclosure, the Commissioner will not question or examine the reasonableness of the authority’s decision. If the authority has decided that information should not be disclosed under a gateway, the Commissioner will only verify that the authority has made that decision, and not consider whether its decision was reasonable. So, if there is a statutory prohibition on disclosure and the authority has decided that it is not disapplied by a gateway, then the Commissioner will accept that section 44(1)(a) applies.”

As set out in Morrissey:

“54.

The language of s 2(2)(a) confirms that it must be for the public authority initially to determine whether the information requested is exempt “by virtue of” s 44. This in turn means that it is for the public authority to consider whether, in the light of the specific nature of the request made, and of the particular nature of the information sought to be disclosed, the applicability of some other statutory enactment results in the prohibition encapsulated in s 44. It will then be for the Commissioner to verify whether or not the public authority has dealt with the matter in accordance with the requirements of Part I of FOIA.”

“58.

The Commissioner’s statutory remit, in accordance with ss 18 and 50 of FOIA, is to decide whether a public authority has failed to deal with a request in accordance with the requirements of Part I of FOIA. It follows that the Commissioner is then charged with the responsibility of verifying whether the exercise required by FOIA has been correctly conducted by the public authority in question. The exercise which the Commissioner conducted was, insofar as it examined the reasonableness of OFCOM's failure to conclude that disclosure should be made under s 393(2), not in our view an exercise required by FOIA in the circumstances of the present case. As s 44 confers an absolute exemption, the role of the Commissioner, and thereafter that of the tribunal if appropriate, is limited to a verification process.  There is, of course, a question of statutory construction as to what it is that FOIA contemplates will be involved in the verification process. Once that is resolved it is not the role of the Commissioner to stray beyond that remit.”

It was initially for Ofgem to determine whether the information requested is exempt by virtue of section 44. The Tribunal’s powers are restricted by reference to those of the Commissioner, which are limited to a verification exercise. This was summarised at paragraph 63 of Morrissey as:

“In short, the task of the Commissioner is to make a decision whether, in any specified respect, a request for information made by a complainant to a public authority has been dealt with in accordance with the requirements of Part I of FOIA.  That may well require a view to be taken on the construction of a potentially relevant statutory bar on disclosure in other legislation. In the circumstances of the present case it did not extend to asking the questions which might be asked on the subject of reasonableness by a court of supervisory jurisdiction examining a challenge to OFCOM's failure to exercise powers available to it under the 2003 Act.”

Following the above approach and whether Ofgem dealt with the request “in accordance with the Requirements of Part I”, the question for the Commissioner and for the Tribunal is whether disclosure is prohibited under section 105 UA 2000.

Ofgem maintains that the information was obtained either under Schedule 1(11)(1) of the UA 2000 by reference to its enforcement functions under the 1986 Act and the 1989 Act or directly under those Acts by reference to Ofgem’s enforcement functions. It is further maintained that the information relates to the affairs of a particular business, being The Times and British Gas. As such, it is argued that the information is subject to the general restriction on disclosure within section 105 UA 2000.

The Tribunal’s attention is drawn by Ofgem to the Employment Appeal Tribunal decision in Office of Gas and Markets v Pytel [2019] ICR 715. At paragraphs [77-78] section 105(1) is described as creating “a very widely worded prohibition” that provides “a carefully crafted scheme of exceptions from the prohibition”.

Not all information obtained by Ofgem is prohibited from disclosure under the UA 2000. Ofgem states that it considered if any of the disclosure gateways in section 105 apply but concluded that they do not. In any event, Ofgem’s position is that the gateways provide a power to disclose but not a duty. Even so, the Tribunal has started by looking at whether section 105 UA 2000 could apply to the information claimed as exempt. It should not be assumed that section 105 automatically applies to all the communications. Section 105 is framed in terms of information “obtained” with reference to its functions under the named Acts.

The Tribunal is satisfied that newly identified document 17 for the November Request falls within the statutory prohibition of section 105 of UA 2000 for section 44 FOIA to be engaged. In terms of the October Request, section 44 applies to documents 26 to 29 (inclusive), 33, 37 to 41 (inclusive) and 42.8 to 42.11 (inclusive), falling within Ofgem’s enforcement functions that are prohibited from disclosure by UA 2000. Although section 44 was not listed against document 42.8 in the table of withheld documents, this was clearly in error as section 44 was claimed on the document itself.

It strikes the Tribunal that Ofgem has taken a broadbrush approach. It cannot have fully considered whether the information within each of the remaining documents was exempt under section 2(2)(a) FOIA by virtue of section 44(1)(a)). Whilst UA 2000 is drafted widely, it does not encapsulate any/all communications that Ofgem may have. The Tribunal concludes that Ofgem has not dealt with the Requests in respect of the remaining documents in accordance with Part 1 FOIA. Other than those documents listed above, section 44 is not engaged.

The Tribunal had no difficulty in concluding that the first limb of section 41(1)(a) FOIA is satisfied where withheld information was obtained by Ofgem from another person, namely from a journalist at The Times.

However, section 41(1)(a) was not fulfilled in the numerous instances where Ofgem was not receiving information but providing it to The Times.

Where information was received by Ofgem, the Tribunal must decide whether the second limb of section 41(1) is met. The question here is whether there was an actionable breach of confidence at the date of the response to the request. That is the relevant date. In our considerations we are not limited to matters known to Ofgem. It is permissible to have regard to later occurring matters if they cast light on the circumstances at the relevant date.

For section 41(1)(b) to be satisfied:

The disclosure of the information must constitute a breach of confidence; (ii) A legal person must be able to bring an action for the breach of confidence to court; (iii) That court action must be likely to succeed.

In respect of (i) above, the Tribunal has applied the three-fold test in Coco v AN Clark (Engineers) Ltd[1969] RPC 41, read in the light of the developing case law on privacy:

Does the information have the necessary quality of confidence?

Was it imparted in circumstances importing an obligation of confidence?

Is there an unauthorised use to the detriment of the party communicating it?

Information possesses the ‘necessary quality of confidence’ if it is more than trivial, is not otherwise accessible and is worthy of protection in the sense that someone has a genuine interest in the contents remaining confidential. The Tribunal is satisfied that documents 6A, 7, 8, 19 and document 35 meet this threshold. They concern journalistic investigation and information provided in confidence whilst operating under cover.

In considering the second bullet point, the Tribunal notes that where information was provided by journalists to Ofgem, from or with reference to a source, there would have been a clear expectation of confidentiality for this element to be met.

On the third bullet point, it would be detrimental to the interests of The Times if it affected the trust that could be placed in it by third parties or disclosed possible reporting or journalistic investigations. The Times has not consented to the release of any of communications.

The common law of confidence has developed in the light of Articles 8 and 10 of the European Convention on Human Rights to provide, in effect, that the misuse of ‘private’ information can also give rise to an actionable breach of confidence. If an individual objectively has a reasonable expectation of privacy in relation to the information, it may amount to an actionable breach of confidence if the balancing exercise between Article 8 and Article 10 rights comes down in favour of Article 8.

Section 41 is an absolute exemption, but a public interest defence is available to a breach of confidence claim. Accordingly, there is an inbuilt balancing of the public interest in determining whether or not there is an actionable breach.

As for element (ii) set out above, clearly The Times is a legal person entitled to enforce Ofgem’s duty of confidence in relation to information in the withheld documents identified.

The final part of the test for engaging section 41 is whether the action for breach of confidence is likely to succeed. From the information before us, there is no apparent defence or lawful excuse to a breach of confidence. The Times had a reasonable expectation of confidentiality in the information within the documents identified by the Tribunal as within the scope of section 41. On balance, the public interest in disclosure does not outweigh the protection of confidences in this case.

We conclude that documents 6A, 7, 8, 19 and 35 are exempt from disclosure under section 41 FOIA.

We do not consider that there is the necessary quality of confidence with regard to the other documents (not already identified as exempt). It can suffice that the preservation of confidentiality is of substantial concern to the person in question, which is not regarded as a high threshold to satisfy. However, where journalists engage with a public authority that is subject to FOIA, there can be no expectation that such exchanges will automatically be exempt by reason of journalistic activities. There is no cloak of confidentiality that can be universally applied to all such exchanges whatever the content. From the content, we are not satisfied that there would be justified cause for concern in preserving confidentiality for the remaining documents.

We have considered section 31 in relation to the information within the closed bundle not already found to be exempt under either section 44 or section 41.

Ofgem relies on the purpose set out at section 31(2)(c) FOIA, being “(c) the purpose of ascertaining whether circumstances which would justify regulatory action in pursuance of any enactment exist or may arise…”.

Whether circumstances exist to justify regulatory action, derive from provisions of the 1986 and 1989 Acts. Both Acts empower Ofgem in carrying out its functions in relation to licenses and certification. In this instance, there was an ongoing investigation into whether British Gas was complying with its licence obligations.

We are satisfied that 31(2)(c) FOIA is engaged in relation to document 34 when considering the document as a whole.

Section 31 is a qualified exemption, meaning that where it is engaged, we must still determine the public interest in the information being released. There is a distinction to be drawn between matters in which the public may be interested and matters which are properly in the public interest i.e. it is for the public good that particular information be known. Press articles are not, or not exclusively, determinative of that latter question.

There is a public interest in the transparency and accountability of public authorities generally, particularly in the public having confidence that public authorities are discharging their obligations. Nevertheless, given that Ofgem’s investigation was said to be ongoing at the time of its Response to the Requests, we find that the public interest balance lies in withholding the information.

Accordingly, Ofgem was entitled to rely on section 31 in terms of document 34. We find no other information (not already found to be exempt) captured by the criteria of this exemption.

The exemption under section 43(2) of FOIA uses the terms ‘would’ and ‘would be likely to’ prejudice the commercial interests of any person. This means that the prejudice in question is more probable than not or that there is a real and significant risk of it happening.

The following statement from a First-tier Tribunal case was subsequently confirmed by the Court of Appeal in the case of Department for Work and Pensions v Information Commissioner & Frank Zola [2016] EWCA Civ 758, as being the correct approach:

“On the basis of these decisions there are two possible limbs on which a prejudice based exemption might be engaged. Firstly, the occurrence of prejudice to the specified interest is more probable than not, and secondly there is a real and significant risk of prejudice, even if it cannot be said that the occurrence of prejudice is more probable than not.”[27] – see also Carolyne Willow v Information Commissioner and Ministry of Justice [2017] EWCA Civ 1876 at paragraph 27.

Therefore, for such exemption to apply, there must be some causative link between the potential disclosure of the relevant information and the prejudice to the commercial interests of a person. The prejudice must also be real, actual or of substance and it must relate to the interests protected by the exemption.

The commercial interests raised are those of The Times. The information to which section 43(2) could apply has already been identified as exempt for other reasons. The exemption is also argued in relation to most of the other communications. We are simply not satisfied that disclosure of the information within the documents not already found to be exempt would be likely to affect The Times’ commercial interests.

A key point is the time the exemption is to be assessed. There may be sensitivities at the time of exchange that have disappeared by the time of the Response. That is the relevant date. In this instance, there is not a real or significant risk of prejudice where information concerning a journalistic investigation has already been published at the date of Response. The remaining documents cannot be said, for instance, to reveal the newspaper’s approach to potential coverage so as to cause prejudice.

Of the documents within the closed bundle not already found to be exempt, the Tribunal finds no others to be exempt by virtue of section 43(2) FOIA.

The information withheld under section 40(2) comprises names, job titles and contact details (telephone numbers and email addresses). Plainly, the contact details are personal information exempted from disclosure under section 40(2).

Names and job titles are ‘personal data’, but only exempt information if one of the conditions in section 40(3A), (3B) or (4A) is met. Here, the exchanges are between members of the Media Team and a national newspaper. There are legitimate interests in disclosure of the information including the identity of those involved, other than individuals in junior roles. We are not satisfied that some names belong to those holding ‘junior’ positions from their job titles and involvement in the exchanges.

There is general public interest in transparency where a regulator engages with the press. We accept that the processing is reasonably necessary for these interests. There is not an alternative means by which the Appellant can obtain this type of information about the requested matter. We find that such interests are not overridden by the interests and rights of the data subjects. The Times has provided its own reasons for not wishing disclosure of any part of the communications. Where the information concerns material subsequently published under the name of the reporter, that personal data was already placed in the public domain by the time of the Responses.

Moreover, those in senior positions at Ofgem involved in issuing press releases, responding to press enquiries and communicating with journalists more generally in a role within a public authority, cannot expect anonymity.

Those individuals who are not in senior roles are identified in the CLOSED Annex, where there is also additional closed reasoning. Their details are exempt under section 40(2) and should be redacted as should third party details who were merely copied into communications. To this limited extent only Ofgem was entitled to rely upon section 40(2) FOIA. None of the three conditions are otherwise satisfied.

We find that some of the documents within the closed bundle are covered by the claimed exemptions as follows:

section 44 was engaged for documents 17, 26, 27, 28, 29, 33, 37, 38, 39, 40, 41, 42.8, 42.9, 42.10 and 42.11.

section 41 was engaged for documents 6A, 7, 8, 19 and 35.

section 31 was engaged for document 34.

The remaining documents within the closed bundle listed below are exempt only insofar as they include personal information which has been found to engage section 40(2) as identified in the CLOSED Annex. They should be disclosed with appropriate redactions.

In summary, we have found that some of the requested information is not covered by the claimed exemptions and so should be disclosed under FOIA. The appeal is therefore upheld in part, and we issue the Substituted Decision Notices set out at the start of this Decision.