[2022] UKUT 74 (AAC)
Kol v Information Commissioner and Reigate and Banstead Borough Council
The Upper Tribunal
(Administrative Appeals Chamber)
Upper Tribunal Case No: UA-2020-000328-GIA (GIA/1760/2020)
Decided following an oral hearing on 1 March 2022
|
Representatives |
|
|
Ms Kol |
Spoke on her own behalf |
|
Information Commissioner |
Rupert Paines of counsel instructed by the Information Commissioner’s office |
|
Reigate and Banstead Borough Council |
Took no part |
Decision of Upper Tribunal Judge Jacobs
On appeal from the First-tier Tribunal (General Regulatory Chamber)
|
Reference: |
EA/2020/0017P |
|
Decision date: |
6 October 2020 |
The decision of the First-tier Tribunal did not involve the making of an error on a point of law under section 12 of the Tribunals, Courts and Enforcement Act 2007.
Corrected
This decision has been corrected in paragraph 19 to insert the appellant’s name.
Reasons for Decision
First, a word of explanation about the case number. The parties will know the case as GIA/1760/2020. The case has now been renumbered on transfer to a new database as UA-2020-000328-GIA.
What Ms Kol wanted to know
Ms Kol made a request under the Freedom of Information Act 2000 (FOIA) for information from the local authority on 22 August 2019:
Please can you provide me with:
1. Verifiable institutional details and dates of the accredited and professional qualifications of the specified public officers. The qualifications to be disclosed under the FOIA need only relate to those that bear relevance to their official role at council and performance of public duties.
Andrew Benson (Head of Planning)
John McInally (Conservation Officer)
Michael O'Grady (Senior Enforcement Officer)
Matthew Holdsworth (Graduate Planning Officer)
2. Description of the continuing professional development training and courses (if any) that has been made available to the members of the Planning Department over the past 5 years (2014-2019).
3. The attendance record (by way of course and date) of the specified public officers in 1 above on any of the CPD courses described in 2 above.
What the law says
The request was governed by section 40 FOIA:
40 Personal information.
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) either the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).
(4A) The third condition is that—
(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.
…
(7) In this section—
‘the data protection principles’ means the principles set out in—
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
‘data subject’ has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
‘the GDPR’, ‘personal data’, ‘processing’ and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).
(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
GDPR stands for the General Data Protection Regulations, which are Regulation (EU) 2016/679. The relevant provisions are Article 5 and 6:
Article 5
Principles relating to processing of personal data
1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
…
Article 6
Lawfulness of processing
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The first recital to the Regulations is also relevant:
Whereas:
(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.
What the local authority replied
The local authority replied on 3 September 2019. It refused the request, relying on section 40(2) FOIA. This was the core of the authority’s reasons:
In our opinion disclosing this level of detail about individual employees’ qualifications and training would be overly intrusive and would not be within the reasonable expectation of the staff.
Public interest test
While the specific information requested may be of interest to the requestor, the Council is not convinced that its disclosure is of sufficient wider public interest to warrant overriding the rights and expectations of privacy of the individuals to whom that information relates.
Ms Kol made a detailed application for review on 20 September 2019, which received a detailed response on 2 October 2019. As part of the response, the authority provided Ms Kol with information that was already in the public domain about Mr Benson and Mr O’Grady. Otherwise, the response refused the review, essentially for the same reasons as originally given, but with a fuller explanation that dealt in detail with Ms Kol’s arguments.
What the Information Commissioner decided
Ms Kol complained to the Commissioner under section 50 FOIA. The Commissioner gave her decision under Reference FS50889409, deciding that the authority had correctly applied section 40(2). This was the Commissioner’s reasoning:
The information requested was personal data.
Disclosing the information would be processing, so Article 5(1)(a) applied.
Article 6(1)(f) applied.
There was a legitimate interest in the information requested:
‘In the circumstances of this case, the Commissioner recognises that there is a legitimate interest in ensuring that council officers are appropriately qualified and trained in order to undertake their roles. This is particularly so in respect of those officers who are involved in planning decisions, as these may have significant impact on both residents and the local environment.’
The Commissioner relied on the information provided by the authority to find that ‘appropriate processes are in place to ensure that officers within the department are fully able to understand the roles. It is also apparent to the Commissioner that any public concerns about the conduct or ability of an officer can be escalated to an independent authority for review.’
Given that conclusion, there was no lawful basis for disclosing the information.
The appeal to the First-tier Tribunal
What Ms Kol argued
Ms Kol exercised her right to appeal to the tribunal. She set out her case in her grounds of appeal. This is what she said about her interests in asking for the information:
7. Appellant made a FOIA request for verifiable accredited professional qualifications of a sample of public officers and the training that has been offered to (and taken up by) the officers paid for from public funds.
8. The legitimate interest here is transparency and accountability for transparency and accountability sake, being the baseline expectation for constituency members paying taxes to a democratically elected local council for its services and being the raison d’ȇtre for the FOIA.
9. The public’s confidence in the integrity of the Council is served by increased transparency and accountability.
10. Specifically, Appellant’s FOIA request is about wanting to know what education and training a public officer has received from an establishment whereby the educational service quality of the establishment has been recognised and listed by a country’s government (the United Kingdom or otherwise). …
11. …
12. The FOIA requested information is about the public deriving comfort from a national Government approved institution’s seal of quality assurance that has delivered an education and training to individual talent who are interfacing with the public by virtue of their holding a public office in local government.
13. This is why Appellant used the words ‘verifiable’ and ‘accredited’ in framing her FOIA request, to represent a certain standard of quality.
In short, Ms Kol asked for transparency through disclosure of the officers’ qualifications and training in order to hold the council accountable for the calibre of the persons holding office in the planning Department.
What the First-tier Tribunal decided
Although the tribunal dismissed the appeal, it disagreed with some parts of the Information Commissioner’s analysis:
31. This is a case which turns on the issue as to whether the Commissioner was correct to decide that disclosure was not necessary to meet the legitimate interest of accountability and transparency in the Council’s decision-making processes.
32. We should say something about the necessity test. The Appellant relies on the analysis in paragraph 27 of the South Lanarkshire case. In that paragraph, Lady Hale says that ‘necessity is well established in community law as part of the proportionality test’. But as Lady Hale went on to say in paragraph 27 what that means is that a ‘measure would not be necessary if the legitimate aim could be achieved by something less’. Applying that to the context of this case, if the ‘legitimate aim’ of ensuring that officers are properly qualified and trained that the Appellant seeks through her FOIA request for personal data can be achieved ‘by something less’, then disclosure of personal data will not be necessary.
33. In our view, this is the approach that the Commissioner took in the decision notice. Essentially, the Commissioner accepted that the Council had recruitment processes and individual training plans in place to ensure that officers were properly qualified and trained, and that there were processes in place for challenging the actions of individual officers. It was also the case that the qualifications of two of the officers were in the public domain already.
34. On that basis, ‘something less’ than the disclosure of personal data was available to meet the Appellant’s legitimate aim and so disclosure was not ‘necessary’. That analysis is straightforward and addresses the statutory tests in the FOIA and the DPA. The Appellant seems to complain that there is no consideration of Article 8 of the ECHR in the Commissioner’s decision (see paragraph 39 of the Appellant’s 3 April 2020 document), but that is not required when the task of the Commissioner was to apply the statutory framework in relation to the disclosure of personal data. There is no argument that the proper application of the tests in FOIA would lead to anything other than an Article 8 compliant result.
35. Thus, we agree with the approach taken by the Commissioner. However, when considering the alternatives available it does not seem right to us to place very much weight at all on the processes for challenging the actions of individual officers. That does not seem to us to be an alternative means of ensuring that officers are properly qualified and trained. It is perfectly possible for a properly trained and qualified officer to be guilty of misconduct or poor performance, a complaints procedure would not necessarily be the correct forum for challenging qualifications and training, and these issues might not even be in issue in a complaint process.
36. Nonetheless, in our view, even taking the availability of a complaints process out of the equation, in our view the Council’s processes of recruitment and individual training, when coupled with the availability of the qualification of the two senior officers enquired about are sufficient to meet the Appellant’s legitimate interests as set out above. On that basis we agree with the Commissioner on this issue and find that the disclosure of personal data is not necessary for the purposes of FOIA and that the exemption in s40(2) FOIA is rightly relied upon by the Council. Having reached that conclusion, we do not need to go on to consider a balancing exercise between the legitimate interests and the rights of those whose personal data is in issue.
37. We should say something about the ‘treasury solicitor case’, as it is referred to on a number of occasions by the Appellant. We note that the Commissioner is not bound, in this case, by any conclusions reached in a previous decision notice, and neither is this Tribunal.
38. In decision notice number FS50146907 dated 23 March 2010, the Commissioner decided that s40(2) FOIA did not prevent the disclosure of the identities, contact details, areas of work, branch or profession and date of qualification of all lawyers in the Treasury Solicitor’s Department (TSol).
39. In that case the Commissioner decided that as the lawyers concerned were senior officers then disclosure of their personal information would not be unfair. There was a legitimate interest in the TSol being open and transparent in the public knowing that TSol lawyers were qualified to perform their roles. The Commissioner considered that disclosure was necessary to achieve that aim, and that disclosure would not lead to unwarranted interference with the rights of the individuals concerned.
40. In the decision notice in the present case the Commissioner addressed that previous decision in terms set out above, and said that it involved ‘significantly senior roles (‘... compared with civil servants in general ...’) within national government, and that to undertake those roles individuals needed to be legally qualified to practice as a solicitor or barrister’. That may be one difference with the present case. We also note that in the TSol case, the Commissioner gave no detailed consideration as to whether disclosure was necessary, simply stating that this was the view of the Commissioner. Significantly, it seems to us, the Commissioner does not seem to have considered whether there were any less intrusive measures for meeting the legitimate aim (for example, considering whether the TSol required legal qualifications as part of the recruitment process). In the current case, the Commissioner has given that issue further consideration (perhaps in the light of more recent case law such as the South Lanarkshire case) and concluded that disclosure is not necessary.
41. The Commissioner is entitled to take a different approach to that taken in 2010. In our view to do so, and to reach the conclusions she has done, does not reveal an error of law.
The appeal to the Upper Tribunal
Post hearing submissions
After Mr Paines had made his submissions, I gave Ms Kol the option of responding at the time or putting her response in writing. She opted for the former. On reflection, she also send the Upper Tribunal a written response, which I have taken into account.
The tribunal had to apply FOIA and GDPR
Ms Kol addressed her argument around the balancing of Articles 8 and 10, reflecting the issues in the cases that she cited. The tribunal, though, had to deal with the issues as they arose under FOIA and GDPR. This involved distinguishing between the officers’ public lives and private lives. Ms Kol referred to the Information Commissioner’s Guidance on the distinction, and asked where the demarcation was between the two. The answer is that the demarcation had to be drawn within the context of the legislation that the tribunal had to apply. In particular, that meant Article 6(1)(f) GDPR. I remind myself of what it provides:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Translating that language to the context of this case:
the disclosure of the information requested would be processing;
Ms Kol is the third party; and
the officers about whom she sought information are the data subjects.
Ms Kol relied on the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421. This is what Lady Hale said about what is today Article 6(1)(f) – it was then slightly differently worded and called condition 6:
18. It is obvious that condition 6 requires three questions to be answered: (i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
Having set them out, she went on to remark:
19. It is not obvious why any further exegesis of those questions is required. …
Lady Hale was undoubtedly correct that Article 6(1)(f) contains the three elements she identified. I will take her three questions, personalised to this case, and apply them to Ms Kol’s argument.
Is Ms Kol pursuing a legitimate interest or interests?
Both the Commissioner and the First-tier Tribunal accepted that Ms Kol was pursuing a legitimate interest in requesting the information from the authority.
I have quoted Ms Kol’s statement of the legitimate interests she was pursuing. She expressed her interests in general terms - ‘transparency and accountability for transparency and accountability sake’ – but she pinned this to the importance of knowing that the officers qualifications have been awarded by a recognised institution. That was the case put to the First-tier Tribunal, that was the case it dealt with, and it is by reference to that case that I must judge whether the tribunal made an error of law.
There is another way of making the same point. Ms Kol argued that in its decision the tribunal had focused too narrowly on the information she had asked for rather than on meeting her legitimate interests. The way the tribunal analysed the case was correct. The structure of FOIA is centred on the request and the information to which it relates. It is only necessary to skim through FOIA to confirm this. The process begins with a request for information. The public authority must confirm or deny whether it holds the information and, if it does, it must provide the information unless it is exempt. The Commissioner’s role under section 50 is to check whether the request for information was dealt with in accordance with the legislation. Throughout, the legislation comes back to the request and the information to which it referred. The same is true of Article 6(1)(f). It refers to processing, which can only mean the processing of the data. In this case, that means disclosing the information requested. The issue is whether it is necessary to disclose that information for the purposes of Ms Kol’s legitimate interests. It is the information that is the focus of the enquiry.
I mention this because, at the hearing before me Ms Kol put the emphasis more on the general than the particular. She referred to integrity, accountability and openness in public service. In support, she cited the Nolan principles for the conduct of public life and argued that these required having the right people at the right level. As I have said, I have to assess the tribunal’s decision by reference to the case that she put to it, which is what I now do as I come to the next question.
Is the processing involved necessary for the purposes of those interests?
The authoritative decision on the meaning of ‘necessary’ is the South Lanarkshire case. Ms Kol and Mr Paines had an exchange of views about what precisely Lady Hale said in that case. I need only deal with Ms Kol’s argument in so far as necessary to decide her appeal.
This is the important passage from Lady Hale’s judgment in South Lanarkshire:
27. … It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary …. The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. …
Whatever uncertainties there may be about exactly what the Supreme Court decided in that case, that passage is clear. If there is another way of satisfying Ms Kol’s legitimate interests without disclosing the information, then disclosure is not necessary. That is the approach that the Commissioner took and the tribunal took the same approach. The tribunal’s conclusion is at paragraph 36 of its written reasons.
So, the tribunal was entitled to take the approach it did. In other words, it directed itself correctly on the law. That leaves the issue: did its conclusion involve the making of an error on a point of law for the purposes of section 12 of the Tribunals, Courts and Enforcement Act 2007?
I remind myself that the Upper Tribunal does not substitute its own assessment of what was necessary for that of the First-tier Tribunal. Its role is to ask whether that tribunal was entitled to come to the conclusion that it did.
The tribunal decided that Ms Kol’s legitimate interests were sufficiently satisfied by the combination of: (a) recruitment processes; (b) individual training; and (c) the publicly available qualifications of the senior officers. I am satisfied that those reasons provide a sound alternative to meeting Ms Kol’s legitimate interests as she put them to the tribunal. The qualifications of the officers would be checked as a matter of course during recruitment. The actual qualifications of two named officers that were public identify the awarding institutions. And the knowledge that training was personalised to the needs of the individual officer provides an assurance that they are attending courses appropriate to their level of experience with a view to enhancing their skills.
Are Ms Kol’s interests overridden by the interests of fundamental rights and freedoms of the officers?
The order of Lady Hale’s three questions is important. Necessity only arises if Ms Kol has a legitimate interest in disclosure. And the interests of the officers only arise if disclosure would otherwise be necessary. That follows from the wording. The interests of the officers would only arise if required to trump Ms Kol’s legitimate interests in disclosure.
The Commissioner and the tribunal both decided that Ms Kol had a legitimate interest but that disclosure was not necessary. That is why they did not consider the interests of the officers. If that was correct, the trump card would not come into play.
Even if the rights and freedoms of the officer were relevant, Ms Kol’s argument about them was misconceived. She argued that disclosing the information she wanted would do no harm to the officers and cause them no distress. That may well be true, but it is not the point. The starting point for data protection law is this: a person’s data is protected from disclosure except in accordance with the legislation. There is no precondition that it is protected if, and only if, disclosure would have some particular effect on the data subject. It is protected just because it is a person’s data. A simple illustration will make the point. Suppose someone has arthritis. That is information about themselves. It is not embarrassing for others to know about it. Most people would not be ashamed or distressed if others found out about it. But it is subject to protection under GDPR. In fact, it is given stronger protection than other data because, as it is about the person’s health, it is classified as sensitive. To reduce it to its simplest: personal data is protected just because it is personal data. That is what the first preamble to GDPR says. Just to be clear, I am not saying that the effect of disclosure on the data subject is irrelevant. It is relevant, but only if it is necessary to resolve a conflict between the interests of the person who requested the information and the person to whom it relates. In this case, the Commissioner and the tribunal did not reach that stage.
In short, Ms Kol presented her case in a way that brought the interests of the officers into the analysis as part of the earlier questions. That is not consistent with the language and structure of Article 6(1)(f). And even if those interests could be considered at an earlier stage, Ms Kol’s argument is based on a misunderstanding of the fundamental basis on which protection of personal data is based.
|
Authorised for issue
|
Edward Jacobs
|