Anna Harrison v The Information Commissioner

On 11 August 2023, the Appellant contacted the College via email and requested information in the following terms:

“This is an FOI request about the Lau China Institute.

It has been reported that the Lau China Institute was set up following a donation from Dr Lau Ming-wai, who is based in Hong Kong. Please provide

a)

emails sent in 2011 and 2012 between KCL staff responsible for administering this donation and Dr Lau,

b)

any due diligence conducted by KCL on Dr Lau,

c)

a list of Dr Lau's visits to the Institute,

d)

any agreement or MoU signed in relation to this gift,

e)

details of any requests Dr Lau made in respect of his gift or has made since,

f)

details of any further donations by Dr Lau, or any other 'ongoing support' as mentioned here (https://www.kcl.ac.uk/lci/assets/ming-wai-lau-summary-report-final-2020.pdf)

g)

information as to how Dr Lau's donation is held by KCL. Is it invested? Is it in an endowment?”.

The College responded on 23 November 2023 (after some correspondence regarding clarification of aspects of the Request). It disclosed the amounts pledged by Dr Lau Ming-wai, including the date of the donations and a brief description of the funds, which we address in more detail in paragraph 48.

The Appellant requested an internal review in respect of the College’s handling of the Request.

The College provided the outcome of its internal review on 28 December 2023. In addition to the previously disclosed information, it disclosed its standard terms and conditions for donations, its donations acceptance policy and details relating to how the donations were held. The College withheld the remaining information which it held within the scope of the Request, citing section 40(2) (personal information), section 41(1) (information provided in confidence) and section 43(2) (commercial interests).

The Appellant (via UK-China Transparency) contacted the Commissioner on 25 January 2024 to complain about the College’s response to the Request. The Commissioner subsequently issued the Decision Notice.

The Commissioner recorded that the Appellant’s complaint was concerned with the College’s response to items (a), (c), (d) and (e) of the Request, but that there was some acceptance from the Appellant that data privacy might “rule out” a response regarding item (c). The Commissioner considered that the scope of his investigation was to focus on the College’s reliance on section 41(1), section 43(2) and section 40(2) in respect of the Request.

In the Decision Notice, the Commissioner decided that (in essence):

The Decision Notice recorded that, as the Commissioner had concluded that the relevant Requested Information had been correctly withheld by the College under section 41 and section 43, he had not gone on to consider the application of section 40(2) to the Requested Information.

The Decision Notice also recorded the Commissioner’s findings that:

The Decision Notice did not require the College to take any further steps.

In summary, the material aspects of the Appellant’s grounds of appeal were as follows:

The powers of the Tribunal in determining the appeal are set out in section 58, as follows:

“(1)

If on an appeal under section 57 the Tribunal considers—

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2)

On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.

In summary, therefore, the Tribunal’s remit for the purposes of the appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).

The proceedings were held by the cloud video platform. The Tribunal panel and the Appellant’s representative joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

At one point during the hearing, the Judge temporarily lost his connection to the video link. The hearing continued from the point when the connection had been lost and the Tribunal was satisfied that nothing had been missed. There were no other interruptions of note during the hearing.

The Appellant was represented by Sam Dunning, a director of UK-China Transparency (the Appellant herself did not appear). The Commissioner did not appear and was not represented.

The Tribunal read and took account of an open bundle of evidence and pleadings, as well as a closed bundle. The closed bundle contained information within the scope of items (a), (c), (d) and (e) of the Request which had been withheld by the College.

All of the contents of the bundles were taken into account, as well as the oral submissions provided by Mr Denning during the hearing, even if not directly referred to in this decision.

Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides:

“Any person making a request for information to a public authority is entitled—

(a)

to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b)

if that is the case, to have that information communicated to him.”.

In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides:

“Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.

Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.

Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides:

“In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

(a)

the information is exempt information by virtue of a provision conferring absolute exemption, or

(b)

in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.

The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). So far as is relevant for current purposes, section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied, and section 41 is included in that list. Section 43(2) is not included in that list.

Accordingly, in summary:

So far as is relevant for current purposes, section 10 provides:

“(1)… a public authority must comply with section 1(1) promptly and in any event not later than the twentieth working day following the date of receipt.”.

So far as is relevant for current purposes, section 17 provides:

“(1)

A public authority which, in relation to any request for information, is to any extent relying on a claim… that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which—

(a)

states that fact,

(b)

specifies the exemption in question, and

(c)

states (if that would not otherwise be apparent) why the exemption applies.”.

So far as is relevant, section 40 provides:

“…(2) Any information to which a request for information relates is also exempt information if—

(a)

it constitutes personal data which does not fall within subsection (1), and

(b)

the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)

would contravene any of the data protection principles…”.

Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:

To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1). One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f)).

Article 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.

The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner (Footnote: ²):

“(i)

Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii)

Is the processing involved necessary for the purposes of those interests?

(iii)

Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.

The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be: ‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.

It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.

The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb (the Balancing Test) can be considered.

For the purposes of the second limb of the Legitimate Interests Test, case law has established that the term “necessary” means something which is more than desirable but less than indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive” means of achieving the legitimate interest in question).

Section 41(1) provides:

“Information is exempt information if—

(a)

it was obtained by the public authority from any other person (including another public authority), and

(b)

the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.”.

Section 43(2) provides:

“Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it).”.

At the start of the hearing, Mr Dunning confirmed his view as to the scope of the appeal, with regard to which aspects of the Requested Information were outstanding. He explained that the appeal was only concerned with item (d) of the Request – namely, any agreement (or MOU/memorandum of understanding) entered into by Dr Lau Ming-wai regarding donations to the College. As we explain below, the relevant aspects of the Withheld Information, to which the appeal relates, are therefore the Agreements.

Accordingly, the focus of the Appellant’s appeal – and Mr Denning’s submissions during the hearing - related to the findings of the Decision Notice in respect of the ability of the College to withhold the Agreements.

As we noted in paragraph 12, the Decision Notice concluded that section 43(2) was engaged in respect of the Agreements and that the public interest favoured maintaining that exemption. The Decision Notice did not conclude that section 41(1) was engaged in respect of the Agreements.

Therefore the relevant issue which we needed to determine in the appeal was whether the Decision Notice was correct to conclude that the College could rely on section 43(2) to withhold the Agreements.

We start by recording our finding that it was public knowledge, prior to the date of the Request, that Dr Lau Ming-wai was a donor to the College and that his donation had established the Lau China Institute. The Request referred to it being reported that the Lau China Institute was set up following a donation from Dr Lau and it included a link to a report which had been published online by the College which referred to that. It appears that the report is no longer available via that link, but a copy of it was included in the open bundle.

Also, in its response to the Request, the College confirmed that Dr Lau was a donor, as well as disclosing details of the amounts he had donated and when. The College disclosed that Dr Lau had donated £6,000,000 on 1st September 2011 and two donations of £1,000,000 and £4,000,000 on 24th August 2020. It stated that the ‘fund description’ was “Lau China Institute Discretionary Fund” in respect of the £1,000,000 donation and was “The Lau China Institute” in respect of the other two donations.

We now turn briefly to the nature of the relevant aspects of the Withheld Information to which the appeal relates (namely, the Agreements). In correspondence with the Commissioner in respect of his investigation, the College described the relevant Withheld Information as “granular information regarding the details of individual gift agreement as contained in the contract, gift agreement…” (i.e. referring to two separate ‘gift agreements’).

In his response to the appeal, the Commissioner explained that the relevant Withheld Information comprised a Gift Agreement relating to the disclosed donation of £6,000,000 in 2011 and a Donation Agreement relating to the disclosed donations of £1,000,000 and £4,000,000 in 2020. The Commissioner stated that the Donation Agreement attached the standard terms and conditions which had already been disclosed to the Appellant and contained the schedule referred to by the Appellant in his grounds of appeal.

The Commissioner also stated in his response to the appeal that the Donation Agreement referred to an additional document as part of the agreement, which was not obtained by him during his investigation. He stated that the additional document had, however, been obtained by him following receipt of the appeal (which was included in the closed bundle) and that, having reviewed it, his position was “the same” in respect of that additional document.

We find that such additional document (referred to in the Donation Agreement as a ‘Confirmation Paper’) is an integral part of the Donation Agreement. This is because it was referred to as part of the section of the Donation Agreement which specified the conditions on the use and purpose of the relevant donations, and it was appended to the Donation Agreement.

Turning to the exemption in question, section 43(2) uses the terms ‘would’ and ‘would be likely to’ prejudice the commercial interests of a person. This means that the prejudice in question is more probable than not, or that there is a real and significant risk of it happening.

For such exemption to apply, there must be some causative link between the potential disclosure of the relevant information and the prejudice to the commercial interests of a person (which may include the public authority in question - in this case, the College). The prejudice must also be real, actual or of substance and it must relate to the interests protected by the exemption.

As recorded in paragraph 38 of the Decision Notice, the College’s position (also set out in correspondence with the Commissioner in respect of his investigation) was that disclosure of the Agreements (and other relevant Requested Information) “could harm [the College’s] commercial interests” (emphasis added). Later in the same correspondence, however, the College stated that disclosure of the Agreements “would be likely to prejudice [the College’s] commercial interests” (emphasis added).

As we have noted, information is exempt under section 43(2) if its disclosure would, or would be likely to, prejudice the commercial interests of a person. The test, therefore, is not whether disclosure of information could prejudice a person’s commercial interests, as initially cited by the College in respect of the Commissioner’s investigation.

Despite the College’s initial characterisation in its correspondence with the Commissioner that disclosure of the Agreements could harm its commercial interests, we find that the College’s position was that such disclosure would be likely to harm its commercial interests. Indeed, that was the position stated by the College in the outcome of its internal review on 28 December 2023 regarding the Request. Likewise, the Commissioner’s view in the Decision Notice was that disclosure of the Agreements would be likely to prejudice the College’s commercial interests.

The Decision Notice recorded the College’s view that, if it became known that the College, as a result of any FOIA request, was required to reveal granular information regarding a donor and agreements with that donor then “it would send a message to all existing or prospective donors that the University was not able to protect their privacy”. Consequently the College argued that potential donors would be likely to conclude that any dealings that they may have with it would not be on a confidential basis, which would in turn be likely to deter them from making donations and encourage them instead to support other causes or institutions. Likewise, the College also argued that existing donors would be less likely to donate again, “contrary to the normal pattern of giving”.

The reasons referred to in the preceding paragraph formed the basis of the College’s view that disclosure of the Agreements would be likely to prejudice its commercial interests. The Commissioner concluded, in the Decision Notice, that such disclosure would be likely to prejudice the College’s commercial interests for the same reasons.

The Commissioner stated, in paragraph 48 of the Decision Notice, that the College had provided a clear link between disclosure of the Agreements and a real and significant prejudice to its commercial interests. However, the Decision Notice did not elaborate on why the Commissioner considered that to be the case, other than stating that “it is an established fact that donations are a significant part of a university’s revenue”.

We accept that the receipt of donations is a commercial activity for universities and that there is competition amongst higher education institutions in seeking to secure donations (as well as regarding attracting students). We also recognise the importance of higher education institutions needing to secure donations, to support their research, teaching and other activities (and which in turn may assist in attracting students).

However, we disagree with the Commissioner that there is a clear link between disclosure of the Agreements and a real and significant prejudice to the College’s commercial interests, for the following reasons.

The College has publicly disclosed not only that Dr Lau is a donor but also how much he donated, both in September 2011 and in August 2020. We cannot reconcile that with the College’s stated concerns that disclosure of the Agreements would suggest to donors that the College was unable to protect their privacy. Likewise, we also do not agree with the College’s arguments regarding existing or potential donors being deterred from making donations to the College in the future. This is because those arguments are also based on the College’s concerns that disclosure of the Agreements would suggest that the College is unable to protect donor’s privacy, when the College has already disclosed details of the donor and the amounts of his donations.

We accept that there may be a need to protect the privacy of donors, but we consider that those concerns are relevant only where there has been an anonymous donation and/or the identity of a donor is not public knowledge. In this case, we are required to consider the Request, which relates only to Dr Lau and in circumstances where not only is his identity as a donor publicly known but also the specific amounts of his donations.

The Commissioner submitted that a distinction should be drawn between the standard terms and conditions which had been disclosed and the contents of the Agreements. The Commissioner contended that “more granular information” is contained within the Agreements than the standard terms and conditions and that disclosure of Agreements would not be within donors’ expectations, with the resulting prejudice to the College’s commercial interests being likely.

We do not agree with those submissions, for the following reasons. First, the Commissioner did not address what he considered was the ‘more granular information’ within the Agreements which would be likely to cause the prejudice to the College’s commercial interests. Having assessed the contents of the Agreements, we do not see what parts of those would be likely to cause such prejudice. As we have noted, the details of the donor and the amounts of the donations are already known. Whilst the specific terms of the Agreements (including the ‘Confirmation Paper’ forming part of the Donation Agreement) regarding the use and purpose of the relevant donations have not been disclosed, it is already public knowledge that the donations were to be used for the establishment of the Institute and the furtherance of its aims and activities.

Secondly, as we have noted, the standard terms and conditions to the Donation Agreement were disclosed to the Appellant in response to the Request. Consequently we consider that most of the ‘granular information’ of the Donation Agreement was disclosed in any event.

Thirdly, the Agreements both contain clauses to the effect that the College could disclose the name of the donor and the amount of the donation. The Gift Agreement provided: “The Donor agrees to allow the College to publish his name and the value of their Gift, in various publications and press releases.”. The standard terms and conditions for the Donation Agreement also included a clause which stated that the College could publicise the donation. That clause stated that this was “unless specified otherwise” and was subject to the other terms and conditions. There was no express specified term to the contrary and the only other potentially relevant clause in the terms and conditions was the clause regarding confidentiality.

That clause regarding confidentiality in the Donation Agreement used the defined term of ‘confidential information’, which (as the Appellant pointed out in his grounds of appeal) meant information “belonging to a party relating to its business, academic, scientific or other activities”. In our view, there was nothing in the confidentiality clause which would negate the right of the College to publicise details of the donation. Accordingly, we consider that the College’s right to publicise details of the donation could extend to the terms and conditions upon which the donation was made (therefore the Donation Agreement).

In any event, however, it was clear from both Agreements that there may be publicity regarding the donations. In contrast, there was no evidence to support the Commissioner’s view that disclosure of the Agreements would not be within donors’ expectations. That view appears to us to have been based on conjecture and without due consideration of the provisions of the Agreements.

Fourthly, the standard terms and conditions for the Donation Agreement also contain a clause which expressly states: “The Donor acknowledges that the College is subject to the requirements of the Freedom of Information Act 2000…”. Accordingly, Dr Lau was put on notice of the potential disclosure of information pursuant to FOIA. Therefore, linked to the third point, we do not accept the Commissioner’s view that disclosure of the Agreements would not be within donors’ expectations, in the absence of any evidence to the contrary.

Consequently, we do not accept the Commissioner’s arguments that disclosure of the Agreements would, or would be likely to, prejudice the College’s commercial interests. We consider that the Commissioner has not demonstrated that such prejudice would occur, nor that there is a real and significant risk of it occurring.

We therefore find that disclosure of the Agreements would not, and would not be likely to, prejudice the commercial interests of the College - and accordingly that section 43(2) is not engaged in respect of the Agreements.

As we have found that section 43(2) is not engaged in respect of the Agreements, it is not necessary for us to go on to consider the associated Public Interest Test.

Whilst the College did not cite section 41(1) in respect of the Agreements and the Decision Notice did not find that section 41(1) was engaged in respect of the Agreements, we nevertheless considered this for completeness.

It is only necessary for us to comment briefly on this point. We find that section 41(1) is not engaged in respect of the Agreements. This is because the Agreements are not information which was obtained by the College from any other person, but had evidently been prepared by the College itself.

We only briefly address the question of section 40(2), as it was not a material issue in the appeal, for the reasons we have given. However, it is relevant to disclosure of the Agreements following our findings that neither section 41(1) nor section 43(2) is engaged in respect of them.

As we have noted, the College has already disclosed the name of the donor and the amount of the donations. Given that, and for the other reasons we have referred to, we consider that Dr Lau can have no reasonable expectation of privacy in respect of that information. However, we consider that any other personal data of Dr Lau (including his address and signature) can be withheld under section 40(2) and accordingly can be redacted by the College in making disclosure of the Agreements.

The Agreements also contain personal data of third parties. We had limited evidence and submissions before us from the Commissioner and the College in this regard, although the Appellant did not dispute the application of section 40(2) to the relevant Requested Information. We consider that the relevant third parties would have a reasonable expectation of privacy with regard to their personal data contained within the Agreements and we find that section 40(2) is engaged in respect of such personal data.

Our findings above regarding section 40(2) are on the basis that disclosure of the relevant personal data would contravene the first data protection principle, such that the first condition referred to in that section is satisfied. Accordingly, it is an absolute exemption and there is no applicable Public Interest Test.

As we have noted, the Decision Notice recorded the Commissioner’s findings that:

We agree with the Commissioner’s finding that the College had breached section 1(1)(b) and section 10(1), given its delay in providing the Disclosed Information to the Appellant.

However, we do not agree with the Commissioner’s finding that the College had breached section 17(1) by later relying on new exemptions which it had not mentioned earlier. Case law has established that section 17(1) does not prevent late reliance on exemptions by a public authority. It follows that a public authority cannot have breached section 17(1) where its response pursuant to that section sets out the exemptions which it is relying on at the time of that response. This is different to the position where a public authority does not issue a refusal notice within the timeframes required by section 17(1), as happened in the current instance.

Consequently, we find that the Commissioner erred in stating in the Decision Notice that the College had breached section 17(1) by later relying on exemptions it had not included in its refusal notice. Rather, we find that the College breached section 17(1) by failing to issue a refusal notice within 20 working days following the date of receipt of the Request. This finding is immaterial, however, given the scope of the appeal which we outlined.

For all of the reasons we have given, we find that the Decision Notice involved an error of law in concluding that the College is entitled to rely on section 43(2) to refuse to disclose the Agreements.

We also find that the Decision Notice involved an error of law in concluding that the College had breached section 17(1) by later relying on exemptions it had not included in its refusal notice.

We thereforeallow the appeal in part and we make the Substituted Decision Notice as set out above.