Advice North West v The Information Commissioner

This is an appeal under s57 Freedom of Information Act 2000 (“the Act”) by the Appellant against Decision number IC-286471-Z4Z1, issued on 8^th August 2024.

The Appellant brings an appeal against the Decision of the Respondent that the Department for Communities was entitled to refuse to confirm or deny that it held the information the Appellant requested.

The matter was listed for oral consideration on 24^th February 2025 but the Appellant was unable to attend, owing to reasons outside its control. The hearing was adjourned to a date to be fixed and the parties agreed, in the interim, that the matter could be heard on the papers.

On 24^th March 2025 the Appellant wrote to the Tribunal to confirm that it was content for the matter to proceed without a hearing. The Respondent had already confirmed, in a case management questionnaire returned on 25^th September 2024, that it was content for the matter to proceed without a hearing.

Rule 36 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 allows the matter to be determined in a party’s absence if the Tribunal is satisfied that the party had notice of the hearing and it is in the interests of justice to do so. Both parties had consented to the matter being considered in their absence and the matter was, therefore, considered on the papers.

The Tribunal considered an open bundle and a closed bundle, each of which had been prepared by the Respondent. A gist of the closed bundle had been sent to the Appellant and the Tribunal on 10^th February 2025.

Freedom of Information Act 2000 s1:

Freedom of Information Act 2000 section 31(1)(a):

Data Protection Act 2018 section 44:

Data Protection Act 2018 section 67:

On 23^rd November 2023 the following request was made by the Appellant of the Department for Communities (“the Public Authority”):

A response was issued on 2nd January 2024. The Public Authority refused to confirm or deny that it held the information and relied upon s30(3) of the Act (investigations).

An internal review was requested by the Appellant on 3^rd January 2024. The Appellant made the following arguments:

The outcome of that review was communicated to the Appellant on 26^th January 2024. The Public Authority upheld its decision. A reference to s43 of the Act was made in this correspondence but that was later confirmed to have been an error and no reliance was ever, in fact, placed on that section.

The Appellant submitted a complaint under s50 FOIA to the Respondent on 4^th February 2024 and an investigation was commenced. The response of the Department was challenged, in part, on the grounds that it was not compliant with ss44 and 67 Data Protection Act 2018 (“DPA”) although it was not asserted how it was not compliant and no reasoned arguments were ever set out on that point. The Appellant wrote:

The Appellant also asserted that it believed that the public interest was best served by the provision of the information requested. The writer noted that he took the view, implicit in the response of the Department, that it was capable of determining the location of “a customer” from a log-in to their Universal Credit account.

On 28th May 2024, the Respondent wrote to the Public Authority requesting information to assist him in dealing with the Appellant’s complaint. In summary, it was not clear how s30 was relied up on as it had not been explained in either the initial response or the response to internal review.

On 13^th June 2024, in response to that enquiry, the Public Authority revised its position and determined that it would withdraw its reliance on s30(3) and instead rely on s31(1)(3) in conjunction with s31(1)(a) of the same Act (prejudice to the prevention or detection of crime).

The Appellant’s case is set out in detail in an email to the Respondent dated 19^th June 2024. In summary, the position is as follows:

The Respondent issued his decision notice with regard to the revised reliance on s31 on 8^th August 2024.

In his Decision Notice, the Respondent agreed with the Public Authority that the public interest in maintaining the refusal to confirm or deny whether it held the information outweighed the public interest in confirming or denying that the information was held. His decision was based on the following analysis:

The Respondent noted that the Department’s position was that confirming or denying that the requested information was held would prejudice its ability to detect and investigate cases in which people were claiming benefits in circumstances in which they were not entitled to; i.e. spending significant time outside the UK and failing to declare that in the appropriate way. The Northern Ireland Government website advises that Universal Credit may be claimed in the usual way for up to one month during temporary trips abroad, but for longer trips, or if the individual resides abroad, entitlement may be affected.

The Respondent accepted the argument that confirming or denying that the requested information was held would provide fraudulent claimant with insight into the Department’s ability to identify where they were logging in from. This in turn would assist those individuals who wished to make fraudulent claims.

He was therefore satisfied that Department had identified a prejudice, in confirming or denying that the requested information was held, which related directly to the interests that s31(1)(a) was designed to protect: the ability to prevent or detect crime.

The Respondent was also satisfied that the Department was entitled to rely on the higher level of prejudice: disclosure would have the prejudicial effect identified (as opposed to disclosure being likely to have the prejudicial effect). He was satisfied that there was a real and significant risk of the prejudice occurring. He found that there was a clear link between the requirement to reside in the UK and the Department’s ability to establish the location of the login.

The Respondent went on to consider the balance of the public interest test. His decision can be summarised as follows:

The Respondent found that there was a significant public interest in maintaining the refusal to confirm or deny that the information was held.

On 21^st August 2024 the Appellant submitted an appeal to the Tribunal. The grounds of appeal can be summarised as follows:

The Respondent responded to the appeal on 25^th September 2024. The response was brief and can be summarised as follows:

In response, the Appellant provided an email dated 2^nd October 2024 in which it stated:

On 9^th December 2024 the Appellant provided the Tribunal with a further document, which was a response, dated 4^th October 2024, from the Department for Work and Pensions (in London), to a similar request made by the Appellant on 10^th September 2024 which stated, in summary:

The starting point, under s1 FOIA, is that when a request for information is made under the Act, a Public Authority must, in the first instance, confirm or deny that it holds the information (“the duty to confirm or deny”). The information must then be provided, if held, unless an exemption applies under the Act.

One of those duties is found in s31, which states that information is deemed exempt if its disclosure would, or would be likely to, prejudice the prevention or detection of crime (s31(1)(a)). Further, the duty to confirm or deny does not arise, to the extent that compliance with it would, or would be likely to prejudice the prevention and detection of crime (s31(3)).

s31(3) is a qualified exemption. This means that, if it finds that the exemption applies, the Tribunal is required to move on to balance the public interest in maintaining it against refusing to do so.

The Respondent characterised the appeal as relating solely to the application of the public interest test. It was held by the Respondent, in his decision notice, that s31(3) applied and that this was not appealed.

The panel had some reservations about that approach. The appeal form does indeed engage with the public interest test but the Appellant also states, “I take the view that the Department’s investigative functions would not be compromised”. The panel therefore began by considering whether s31(1)(a) was engaged.

Before entering into a discussion of the merits of the appeal, it should be noted that the Appellant included in the documents he had sent to the Respondent a copy of a decision, on appeal, of the Social Security Commissioner of Northern Ireland dated 22 September 2020. The only explanation from the Appellant as to the relevance of this decision was to direct the Respondent (during his investigation) to a paragraph in which it is acknowledged that certain Government computer systems could have been assumed to have recorded information made available through a different system. The decision is not binding on this Tribunal and that case did not turn on any provision of FOIA. Thus it was determined by the panel in the present case that it had no relevance in the current proceedings.

The Respondent’s response to the appeal did not set out why s31(1)(a) was engaged. It referred instead to the Department’s previous correspondence with the Appellant and the Respondent.

It was unambiguous and was therefore held by the Tribunal that the Department had the power to investigate specific offences of fraud under s103A of the Social Security Administration (Northern Ireland) Act 1992.

If the information was held, the Department had stated in their revised response to the Appellant of 13^th June 2024, it would be exempt under s31(1)(a) because its disclosure would be likely to prejudice the prevention or detection of crime. It noted that:

This was accepted by the Respondent in its Decision Notice and the finding of the Respondent was that there would be a prejudice, which would be more likely than not, based on the “clear link between the requirement to reside within the UK and the Department’s ability (or otherwise) to establish the location of the login”.

Although the appeal notice stated that it was the Appellant’s view that the Department’s investigative powers would not be compromised, there were no submissions in support of this point and there was no evidence to undermine or raise questions regarding the Respondent’s submission.

The Tribunal therefore accepted the submissions of the Respondent and determined that s31(1)(a) is engaged, although we did not agree with the analysis of the Respondent (in the decision notice) that a disclosure would prejudice the prevention or detection of crime. In its revised response of 13^th June 2024 the Department’s case was that disclosure would be likely to prejudice the prevention or detection of crime and that is the finding of this Tribunal.

Again, the Respondent made no arguments in support of the public interest test, but simply referred to the Decision Notice. In that, however, he had not considered the public interest test as it applied to the disclosure of information but had only considered it as it applied to the decision to rely section 31(3) i.e. the balance of the public interest in maintaining the refusal to confirm or deny that the requested information is held against the public interest in confirming or denying that the requested information is held.

Without any arguments before us, the Tribunal could not form a view as to whether the public interest in disclosure outweighed the public interest in withholding the information, if indeed it were held.

The Respondent held, in the Decision Notice, that it is a matter of great public interest to protect the ability to prevent and detect crime and that the appropriate weight to be afforded to the public interest is therefore significant.

While the Respondent had accepted that either confirming or denying that the information was held would have detrimental consequences, he was mindful of the general principle in FOIA that openness is in the public interest.

Ultimately, the Respondent argued, the public interest in maintaining the refusal to confirm or deny outweighed the public interest in confirming or denying that the requested information was held.

The arguments raised by the Appellant with regard to the application of the public interest test were not always clear and did not appear to be directed towards the relevant provisions of FOIA. We have extrapolated them as best we can from the submissions and carefully considered what we determined to be the Appellant’s case.

The Appellant appeared to make an argument that the public purse was best protected by the disclosure of the requested information or the Department confirming or denying that it held the information.

The panel failed to see how the public purse was best protected by either confirming or denying that the information was held. While there is undoubtedly a public interest inherent in reducing spend on fraudulently claimed benefits, the view of the Tribunal was that it would take a leap of logic to make a direct link between confirming or denying that the information is held and a future reduction in fraudulent claims.

We preferred the argument of the Department, contained within its response to the Respondent and relied upon in the Decision Notice, that to allow it to maintain its “neither confirm nor deny” position and thereby effectively discharge its investigatory obligations would protect the public purse from would-be fraudulent benefit claimants.

In correspondence, the Appellant stated that it considered that people had a right to know if they were being monitored. The panel has assumed that that is where the arguments in respect of the Data Protection Act 2018 have arisen. In the appeal notice, the Appellant said nothing further than “I seek to challenge this response on the grounds that it does not comply with the Data Protection Act 2018, for example sections 44 and 67”.

s44 sets out the general duties imposed upon a data controller. The panel was careful not to stray too deeply into matters of data protection but in short:

With no clear argument on the point, the panel could not establish how the section was said to support the contention that the response of the Commissioner was not compliant with the Data Protection Act 2018. The Tribunal takes the view that s44 deals with individual requests made by data subjects, not general requests for information made under FOIA.

Data protection and freedom of information are two very different regimes and each is governed by its own principles and legislation. If, indeed, the Appellant wished to argue that s44 DPA meant that individuals have a right to know if they are being monitored, the Tribunal would note that that is a matter that does not fall to be determined in this case. Of more relevance is the fact that the Tribunal did not feel that any rights of data subjects under s44 outweighed the public interest in maintaining the refusal to confirm or deny whether the information was held.

s67 obliges a data controller to make the Commissioner aware of any personal data breach for which it is responsible. The section sets out when, how and in what circumstances such a report must be made.

Again, the panel could not identify the relevance of that s67 obligation to the decision that fell to be made. The panel did not consider that anything in this section supported an argument that the public interest was best served by the Department confirming or denying that the information was held.

We considered that the principal argument in favour of confirming or denying that the information was held would be the general public interest in transparency. It is important that our state powers of investigation, detection and prevention of crime are transparent and that enforcement authorities, as agents of the state, are accountable. The panel was of the view, however, that that test is met by way of clear legislation and regulation of the authorities and that the scrutiny and accountability of those processes is the preserve of the criminal justice system and operates on a case by case basis.

Transparency in the circumstances of the prevention and detection of criminal activity does not mean the nuts and bolts of each investigation. To reveal any information about how fraudulent benefit claimants are identified, be it by means of checking their log-ins or otherwise, would be to reveal some information that would be bound to be of use to those intending to defraud the state. The release of even those small fragments of the whole picture is capable of leading to potential fraudsters piecing together a picture, “a patchwork effect”, as to how benefit fraud is investigated.

In relation to the public purse argument, the Tribunal finds that the public purse is best protected when the Department is able to detect and prevent criminal activity effectively. It was the finding of this panel that relying on this exemption puts the Department in a stronger position in that regard.

The Tribunal did not need to determine whether or not the requested information was, in fact, held. Additionally, it did not need to determine whether confirming or denying would have a different effect. In circumstances where either to confirm or to deny would reveal something of the answer to the request, and prejudice would (or would be likely to) arise, a Public Authority may issue a “neither confirm nor deny” response.

The panel took that view that the exemption allowing a Public Authority to neither confirm nor deny that information is held is a protective concept, which allows for a consistent approach by public authorities where matters of public policy and protection are under consideration.

Reliance on s31(3) allows for a consistent approach. It is conceivable that an individual may make repeated or multiple requests of the same Public Authority. If the question is slightly varied on each occasion, such that a series of responses are received stating that the information is not held followed by one which is “neither confirm nor deny”, that response immediately sheds light on what the substantive response might be.

This is alluded to by the Appellant in the appeal form, in which it is stated “I take the view, implicit in their response, is my belief that the Department can determine the location of a customer from a log-in of their Universal Credit account” [sic]. The Tribunal make two observations on this point. The first is that this tends to support the analysis at paragraph 62 and is an important factor in the Department’s argument that even to confirm or deny that the information is held might inadvertently reveal something of the nature of the information itself. The second is that the Appellant may well believe that but the fact is that his belief is not the same as an organisation providing information to substantiate that belief, nor does it follow that, just because an individual holds a belief, the Public Authority is in any way obliged to confirm or refute that belief.

For these reasons the Tribunal came to the view that the public interest in maintaining the refusal outweighed the public interest in confirming whether or not the Department holds the requested information.

The appeal is dismissed accordingly.