Raymond Lawton v The Information Commissioner & Anor [2022] UKFTT 241 (GRC)

Appeal Number: EA/2021/0025

[2022] UKFTT 00241 (GRC)

First-Tier Tribunal

(General Regulatory Chamber)

Hearing Heard on the papers

Information Rights

On: 23 rd June 2022.

Panel: Brian Kennedy QC, Susan Wolf and Jo Murphy.

Raymond Lawton

Appellant:

The Information Commissioner

First Respondent:

The University of Central Lancashire

Second Respondent:

Between

Raymond LawtonAppellant

The Information CommissionerRespondent

The University of Central LancashireRespondent

Raymond Lawton, as a litigant in person. for Appellant

for 1 st Respondent: Sapna Gangani, Solicitor through the Commissioner’s written Response dated 08/03/2022.

for 2 nd Respondent: Written response from Information Governance Manager & Data Protection Officer, Legal and Governance, University of Central Lancashire, Preston, PR1 2HE

Decision: The Tribunal dimiss the appeal.

REASONS

Date 2022-06-30

[28]Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing). (4A) The third condition is that— (a). on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b). on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section. (5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1). (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a). giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—(i) would (apart from this Act) contravene any of the data protection principles, or

(ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b). giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing); (c). on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a); (d). on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section. (6). Omitted (7) In this section—“the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act). (8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted. (as amended by Schedule 19 of the Data Protection Act 2018) Section 40(1) FOIA is an absolute exemption by virtue of s.2(3)(f) FOIA, and is therefore not subject to the public interest test under s.2(2)(b) FOIA. Personal data is defined as “any information relating to an identified or identifiable living individual.” (s.3(2) Data Protection Act 2018 (“DPA”)), and the ‘processing’ of such information includes “disclosure by transmission, dissemination or otherwise making available” (s.3(4)(d) DPA), and therefore includes disclosure under FOIA. The data protection principles referred to in s.40(3A)(1) FOIA are set out in Article 5(1) of the General Data Protection Regulations EU2016/679 (‘GDPR’), and s.34(1) DPA18 (the latter with regards to law enforcement processing) (s.40(7) FOIA). The first data protection principle under Article 5(1)(a) GDPR is that personal data shall be:

“processed lawfully, fairly and in a transparent manner in relation to the data subject”

. The information can therefore only be disclosed if to do so would be lawful (i.e. would meet one of the conditions of lawful processing listed in Article 6(1) GDPR), fair, and transparent. In considering the application of Article 6(1)(f) of the GDPR in the context of a request for information under the FOIA, it is necessary to consider the following three-part test:- i) Legitimate interest test: Whether a legitimate interest is being pursued in the request for information; ii) Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; iii) Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject. Commissioner’s Decision Notice: [10]. The Commissioner investigated the matter and held that part of the brochures were exempt from disclosure under section 40(2) FOIA. [11]. In the circumstances of this case, having considered the withheld information, the Commissioner was satisfied that the information relates to the data subjects. The names of individuals, alongside their graduate qualification, quite obviously is information that both relates to and identifies those concerned. This information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA. [12]. The fact that information constitutes the personal data of an identifiable living individual does not automatically exclude it from disclosure under the FOIA. The second element of the test is to determine whether disclosure would contravene any of the DP principles. [13]. The Commissioner referred to Article 5(1)(a) of the GDPR and Article 6(1) in respect of the lawfulness. Further, the Commissioner considered the three-part test to be applied under Article 6(1)(f), which is as follows: i) Legitimate interest test: Whether a legitimate interest is being pursued in the request for information; ii) Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; iii) Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject. [14]. The Commissioner give due consideration to each element of the test and decided that disclosure would cause unwarranted damage or distress to those named in the brochures, nor would these individuals have a reasonable expectation that their personal data would be disclosed in response to an information request. Further, that it would be disproportionate to obtain consent from each graduate. Grounds of Appeal: [15]. The Appellant’s Grounds of Appeal does not question that section 40(2) applies to the withheld information and that the information does constitute personal data. The Appellant focuses on the balance of legitimate interests. The Grounds of Appeal can be summarised as follows:

“(a) with regard to the decision, I object on the following grounds: Point 46) The information was also posted on the University website at the time. Point 47) The graduates concerned would have had a reasonable expectation of such disclosure, since website publishing was widely used by them. Disclosure to the “world at large” has already happened long ago. There can be no objection based on this point”

. The Commissioner’s Response: [16]. The Commissioner maintained her position as outlined in the DN and resisted the appeal. The Commissioner accepted that, if the names of the data subjects/the graduation brochures were published on the internet back in 1997-1998 then this may have some bearing on the balancing exercise. [17]. The Commissioner received confirmation from the University that they did not publish the names of the data subjects online at the time. The Commissioner denied that disclosure to the world at large had already happened. The Commissioner maintained the balancing exercise was correct and that the legitimate interest of the Appellant in seeking the withheld information did not outweigh the reasonable expectation of the graduates that their names and grades would not be disclosed to the world at large. Further, the Appellant has failed to produce any compelling reason to overturn the balancing test in favour of disclosure. The Commissioner invited the Tribunal to dismiss the appeal. Second Respondent’s Submissions: [18]. The Second Respondent provided a response to the Appellant’s specific grounds of appeal. In response to the contention that the information was also posted on the University website at the time, the Second Respondent confirmed that there were two graduation ceremonies which occurred in 1997 and 1998, and stated that this information was not published on the University website. [19]. In relation to the argument that disclosure to the world at large had already happened long ago, the Second Respondent argued that graduates would not have had a reasonable expectation of such disclosure of this nature since disclosures of this nature did not take place at the time. The Second Respondent opposed the Appellant’s Grounds of Appeal on the basis that they are not factually accurate, as the information was not published on the University’s website in 1997 and 1998 and further because the individuals in question would not have had a reasonable expectation that this information would be disclosed either in 1997 or 1998, or the present day. The Second Respondent confirmed that redacted copies of brochures were provided to the Appellant. The Second Respondent invited the Tribunal to dismiss the appeal. The Hearing on the papers: [20]. The Tribunal is satisfied that the names of graduands and their degrees and classifications is personal data as defined Section 3(2) of the DPA. This defines personal data as: “any information relating to an identified or identifiable living individual”. [21]. Personal data must be processed in accordance with the data protection principles set out in Article 5 of the GDPR. The Tribunal agrees with the Commissioner that the most relevant principle in this case is Article 5(1)(a) personal data shall be processed lawfully, fairly and in a transparent manner. [22]. The Tribunal considered the lawful basis for processing under the GDPR and agreed with the Commissioner that Article 6(1)(f) (legitimate interests) was the most applicable. The Tribunal considers that to obtain consent from the data subjects would involve disproportionate effort by the data controller due to the numbers involved and the passage of time and is unlikely to lead to a meaningful disclosure. [23]. In considering the application of Article 6(1)(f) the Tribunal considered the three-stage test: a) The legitimate interest test: Whether a legitimate interest is being pursued in the request for information; b) The Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; and c) The Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject. [24]. The Tribunal accepts and adopts the Commissioners’ considered assertion that the legitimate interest is only that of the complainant’s own interest and as such there is limited legitimate interest. The Appellant may have a sentimental interest but the appellant has failed to offer any wider legitimate interest in the information other than sentimental purposes. [25]. In relation to the necessity test, the Tribunal is required to consider whether disclosure is necessary to meet the legitimate interest in question. Necessary means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity and involves consideration of alternative measures which may make disclosure of the requested information unnecessary. Disclosure under the FOIA must therefore be the least intrusive means of achieving the legitimate aim in question. The Tribunal accepts and adopts the Commissioners view, and is satisfied in this case that there are no less intrusive means of achieving the legitimate aims identified. [26]. On the balancing test the Tribunal has to consider whether the requestor’s legitimate interests override the fundamental rights and freedoms of the data subjects, in this case the graduands referred to in the Graduation Ceremony Brochures. The Tribunal accepts and adopts the Commissioners assessment that a key issue is whether the individuals (the graduands) concerned would have a reasonable expectation that their information will not be disclosed. The Tribunal agree that these expectations can be shaped by factors such as an individual’s general expectation of privacy, whether the information relates to an employee in their professional role or to them as individuals, and the purpose for which they provided their personal data. There is no evidence before us that the graduands understood, or would have expected, that their information would be exposed to the world at large. [27]. The Appellant argues that the data subjects would have had a reasonable expectation that information would be disclosed because he argues that the information was made public in the brochure and he asserts that it would have been published, at the time, on the University Web Site. [28]. The University states that the brochures were only made available to those attending graduation ceremonies. The University states that this information would not have been published on its web site in 1997/98. The University has provided an archived version of its web site from 1998 which can be publicly viewed at this link: https://web.archive.org/web/19980124144412/http://www.uclan.ac.uk/althom3.htm [29]. This does not include or contain any information about the graduands or graduation brochures. The Tribunal therefore accepts the University’s assertion that in 1998 this information was not made publicly available other than to those attending the ceremonies. Therefore, the Tribunal concludes that graduands of 1997 and 1998 would not have any expectation that information about their graduation and degree award would be made public now, some 25 years later, to the world at large. Conclusion: [30]. The Tribunal concludes that the requestor's legitimate interests, which are entirely personal, are insufficient to outweigh the fundamental rights and freedoms of the data subjects. [31]. For the above reasons we find the Appellant has failed to identify any error of Law in the DN and accordingly we must dismiss this appeal. Promulagtion date 30th June 2022