Phil Flanagan v The Information Commissioner & Anor

This is an appeal against Decision Notice Reference: IC-295265-W9C5 dated 4 September 2024, in which the First Respondent (“the Commissioner”) decided that the Second Respondent (“the Council”) was entitled to rely on s40(2) of the Freedom of Information Act 2000 (“FOIA”) to withhold information requested by the Appellant (“the disputed information”).

The parties were agreeable to the determination of the appeal on the papers, that is to say, without an oral hearing. We are satisfied, pursuant to Rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) rules 2009, that we can properly determine the issues without a hearing.

We had before us an OPEN bundle, and a CLOSED bundle containing the disputed information.

The Tribunal Administration brought to our attention that on 3 March 2025, the Council had applied to the Tribunal for a direction pursuant to Rule 14 of the Tribunal Rules that the material in the CLOSED bundle be held on a CLOSED basis, and not be made available to any party or person other than the Commissioner, because its disclosure would defeat the purpose of the appeal. Having reviewed the material, we agree. By a separate direction, the Tribunal has directed accordingly.

On 28 November 2023 the Appellant made a request by multiple questions of the Council for information relating to the Council’s operation of its Strategic Capital Grants programme from July 2022 to October 2023.

The programme was intended to provide financial assistance to the delivery of projects supporting the regeneration and development of communities within the purview of the Council’s Community Plan. Applications were invited by 8 July 2022, and scored against published criteria in a structured process, resulting in recommendations being made to the Council’s Grant Aid Panel, and then the Council’s Regeneration and Community Committee. On 30 March 2023, the Council informed five community organisations that they had been successful in securing funding. We understand that the total funding available was £1.2 million.

The Council offered detailed feedback to unsuccessful applicants or the opportunity to appeal the outcome of their grant applications on specified grounds through a structured appeals process. On 31 July 2023, the Council’s Grant Aid Appeals Panel considered seven appeals, refused them all and upheld the original grant decisions.

The Council disclosed some of the information requested by the Appellant but withheld other parts. For the purposes of this appeal, we are only concerned with one aspect of the Appellant’s request, namely: “A list of all council officers involved at any stage in the assessment process, details of their involvement, and any information held by them in relation to the assessment process.”

The Council's position, shared by the Commissioner, is that that the disputed information is exempt from disclosure under s40(2) FOIA: it is the personal data of the relevant Council employees, and publication of their personal data would contravene Article 5(1)(a) of the UK GDPR because it would be unfair and because no lawful processing condition from Article 6(1) of the UK GDPR would be satisfied.

On 4 January 2024, the Council responded to the request, supplying this information:

“Officer Assessment Panel: Funded Programmes Manager, Funded Programmes Co-ordinators x 2 and Rural Regeneration Officer.

Officer Moderation: Head of Service Economic Development and Investment, Economic & Regeneration Manager, Funded Programmes Manager and Rural Regeneration Officer.

All officers involved in this grants process are experienced in the assessment of grant applications.

The staged assessment process contained in the attached Guidance Notes was adhered to by the assessing panel. Two conflicts of interest were declared during the assessment with the relevant officers removing themselves from the room during the relevant assessments.”

On 22 November 2024, the Appellant sought an internal review. He said: “No names of Council Officers have been provided. No details of those who declared Conflicts of Interests have been provided or where this information was recorded. A record of the meeting or notes held by attendees of the Officer Assessment Panel and the Officer Moderation would also fall under the original FOI request and has not been mentioned or provided.”

On 15 March 2024, the Council responded. It explained that it had a duty to protect personal data; it had weighed the legitimate interest of disclosure against the rights of affected employees, and concluded that there was no legitimate interest in releasing the names of the people on the panels “as knowing their names will not add anything to the requests, and staff would feel uncomfortable sitting on Panels in the future if they were aware that there name could be released.” The Council confirmed that it was withholding the name of any relevant person below a Head of Service level pursuant to s40(2) FOIA, and it provided the name of one person who, we assume, was of Head of Service level grade or above.

On 16 March 2024, the Appellant complained to the Commissioner. The Appellant identified that four people had been involved in the assessment process, two of whom had declared conflicts of interest, and that the Council was refusing to release details of that information to him. Specifically, he wanted to know the identities of the two persons who declared conflicts of interest and from which decisions they had removed themselves.

The Commissioner investigated.

During that investigation, the Appellant submitted to the Commissioner that knowing the identities of the relevant individuals and the nature of their conflicts was a legitimate request, and none of them would have a reasonable expectation that their identities would not be disclosed.

In response, the Council explained to the Commissioner that conflicts of interest were declared at the start of the meeting, in line with normal Council process: “Two Officers declared an interest and removed themselves from decision making and award of funding; the two declarations were documented and are held on Council record.”.

The Council went on to explain: “Written declarations were recorded and retained. Officers considered the reasonable expectations of individuals, taking into account: their expectations both at the time the information was collected and at the time of the request; the nature of the information itself; and the Data Protection principle of lawfulness, fairness, and transparency. Officers did consider the weight of legitimate public interest in disclosure against the rights of employees and, in this case, feel there is no overwhelming legitimate interest in releasing the details of the declarations and who made them. Officers are withholding all the details under Section 40(2) of the Freedom of Information Act, and in particular Section 40(3A), where disclosure of the information would breach one or more of the Data Protection principles.”

In response to the Appellant’s submission to the Commissioner that his request was a legitimate request, the Council said this: Please note in the response above, which was communicated to the Complainant, Officers did consider the weight of legitimate public interest in disclosure against the rights of employees and, in this case, feel there is no overwhelming legitimate interest in releasing the details of the declarations and who made them. Officers below Head of Service level were asked if they wished to waive their anonymity for their names and conflicts of interest to be released through an FOIA; all Officers raised concerns and indicated they would not be comfortable with their names and conflicts of interest being released.”

By the Decision Notice, the Commissioner decided that:

By Notice of Appeal dated 1 October 2024, the Appellant submits, in summary, that:

By his Response, dated 4 December 2024, the Commissioner submitted, in summary, that:

By its Response, dated 17 December 2024, the Council submitted, in summary, that:

The relevant provisions of FOIA are as follows:

The general right of access, is, however, subject to certain exemptions set out in Part 2 of FOIA. Relevant to this appeal is s40 FOIA which provides:

S3(2) DPA defines personal data as “any information relating to an identified or identifiable living individual.” The “processing” of personal data includes disclosure by “transmission, dissemination or otherwise making available” (s3(4)(d) DPA).

The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”. “Lawful” entails disclosure meeting one of the conditions of lawful processing listed in Article 6(1) UK GDPR.

The applicable condition in this case is Article 6(1)(f) UK GDPR, namely that the disclosure “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

Section 40(2) FOIA, so far as relating to the first condition under s40(3A) FOIA, is an absolute exemption, and not therefore subject to a public interest test.

S58 FOIA provides that:

The import of s58 FOIA is that the right of appeal to the First-tier Tribunal involves a full merits consideration of whether, on the facts and the law, the public authority’s response to the Request is in accordance with Part 1 of FOIA (Information Commissioner v Malnick and ACOBA [2018] UKUT 72 (AAC); the Tribunal has jurisdiction to decide, de novo on the merits, whether the Commissioner’s decision is in accordance with the law.

It is no part of the Tribunal’s jurisdiction to determine any procedural or substantive unfairness in, or, ultimately, the lawfulness of the Council’s grant assessment process or funding decisions. Nor is it any part of the Tribunal’s role to determine whether any relevant individual had a conflict of interest, or whether such conflict was operative, or potentially operative, in any part of the process or decision-making. To that end, we do not address any of those facts or matters which the Commissioner or the Council contends justify the process adopted by the Council or the decisions reached.

The Tribunal’s role is to oversee the correct application of FOIA, and to determine the lawfulness of the Council’s responses to the request, specifically, in this case, whether the Council was entitled to withhold the disputed information pursuant to s40(2) FOIA.

We are satisfied that the withheld information is personal data within the meaning of s3(2) DPA, and that its disclosure under FOIA would constitute processing within the meaning of s3(4)(d) DPA.

The focus of our consideration, therefore, is whether disclosure of the disputed information under FOIA would contravene Article 6(1)(f) UK GDPR: specifically, would disclosure be lawful, fair and transparent?

Dealing with the first requirement of lawfulness: resolving that issue involves consideration of three questions (South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55) [18]:

Question c. above was framed by reference to the Data Protection Act 1998, which is now replaced by the DPA and the GDPR. It should therefore now reflect the words used in the GDPR - whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In consideration of these questions, we think it important first to identify correctly the factual scope of the request.

In his Grounds of Appeal the Appellant states that an employee who sits on a panel to award £1.2 million in public funding is not a junior employee and that they should have a reasonable expectation that their name will be disclosed as part of the minute taking and made available, if requested. However, as we understand it, the part of the process to which the disputed information relates is the Council’s assessment of the various applications, not the ultimate decision to award any grant.

The Council has explained the structure and sequence of the full grant award process: the scoring matrix used in the assessment process; the presentation of a report to the Grant Aid Panel; the presentation of a report to the Regeneration and Community Committee, which included the report presented to the Grant Aid Panel and minutes of the Grant Aid Panel meeting; the report presented to the Grant Aid Appeals panel, including appeal letters; and a final report to the Regeneration and Community Committee including the Grant Aid Appeals Panel report and minutes of the Grant Aid Appeals Panel meeting.

In relation to the first question, therefore, we find that the interest pursued by the request is confined to the assessment of the applications for a grant, and does not extend to the decision to make a grant, but we accept that that interest is legitimate: seeking to establish the fairness of the assessment process in the wider grant process, and transparency and accountability in the Council’s operations in that context.

In relation to the second question: the word “necessary’ in this context must be interpreted consistently with its interpretation in EU jurisprudence, from which the concept derives in the GDPR and carries over into the UK GDPR. There it has a specific meaning: reasonable necessity rather than strict or absolute necessity. The processing to which the word “necessary” applies must be proportionate to the aim pursued by that processing and entail the minimum interference with the privacy rights of the data subject that will achieve the aim in question (R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin) [76]). It requires the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question (Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC)) [39] and South Lanarkshire [27]. For something to be necessary, there must be no other reasonable means of achieving it: Information Commissioner v Halpin [2020] UKUT 29 (AAC).

As the Appellant accepts, he has open to him alternative avenues to pursue his concerns: recourse to the Local Government Auditor in the Northern Ireland Audit office or to the Northern Ireland Public Services Ombudsman, or possibly both.

However, the Appellant says that disclosure of the disputed information is “central to whether a complaint would be lodged with either body”. To the extent that the Appellant means that he needs the disputed information to achieve recourse to the complaint and investigation processes of either body, we reject that submission.

In our view, it would be sufficient for him to lay before either body the information he already holds so that it might consider his complaint and make such enquiries of the Council as it considers appropriate. It cannot be the case that either body could only consider a complaint if presented with the disputed information, or, to put it the other way around, could not consider a complaint without the disputed information.

We find that the existence of such recourse with no requirement for the disputed information, means that disclosure of the disputed information under FOIA is not reasonably necessary for the purposes of the legitimate interest of the request. Such disclosure would not be the least intrusive means of achieving the legitimate interest.

Given that finding, there is no need for us to go on to consider what is effectively the balancing exercise required by the third question identified in South Lanarkshire, as now necessarily refined by the advent of the UK GDPR: whether such interest is overridden by the interests or fundamental rights and freedoms of the Council's employees which require protection of their personal data.

By extension, because we find that disclosure of the disputed information would not be lawful, it is not necessary for us to go on to consider whether its disclosure would be fair or transparent. If disclosure is not lawful, it would contravene Article 6(1(f) UK GDPR. The disputed information is therefore exempt from disclosure pursuant to s40(2) FOIA.

We find that the Commissioner was correct to conclude that the disputed information was exempt from disclosure pursuant to s40(2) FOIA. To that extent, the Decision Notice is in accordance with the law.

The Appeal must be dismissed.