Martha Wardrop v Information Commissioner & Anor [2022] UKFTT 261 (GRC)

First-tier Tribunal

General Regulatory Chamber

[2022] UKFTT 00261 (GRC)

Information Rights

Appeal Reference: EA/2021/0273

Decided without a hearing

On 1 April & 1 August 2022

Before

Judge HAZEL OLIVER

AimÉe gasston

susan wolf

Between

martha wardropAppellant

information commissionerRespondent

THE METROPOLITAN POLICE SERVICERespondent

Decision

Date 2022-08-15

Background to Appeal

[1]This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 23 August 2021 (IC-111481-Y9T6, the “Decision Notice). The appeal relates to the application of the Freedom of Information Act 2000 (“FOIA”). It concerns information about the disciplinary record of a named former police officer requested from the Metropolitan Police Service (“MPS”).

[2]The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).

[3]On 14 August 2020, the appellant wrote to MPS and requested the following information (the “Request”):

“As a local elected councillor for the Hillhead ward, Glasgow City, I am seeking information on a former police officer of the Met in the interests of protecting the public. His name is [name redacted], [job title redacted] at the University of Glasgow. [Name redacted] was a Detective Constable at [name redacted] Police Office. Information is requested referring to [name redacted] as the subject of a disciplinary process in 2003 which led to his dismissal or resignation.”

[4]MPS responded on 18 August 2020 and refused to confirm or deny whether it held the requested information, based on section 40(5) FOIA (personal data).

[5]The appellant requested an internal review on 22 December 2020. MPS responded on 26 April 2021 and maintained its position.

[6]The appellant complained to the Commissioner on 12 March 2021. The basis of her complaint was the interests of protecting the public, and reassurance that the officer is suitable to implement measures to address gender-based violence. The Commissioner decided:a. Confirmation or denial would constitute disclosure of a third party’s personal data – the former police officer is specifically named, a reply would reveal whether he was the subject of any disciplinary procedures or hearings, and this information is not in the public domain.

b. There is some legitimate interest in confirmation or denial – it would go some way towards informing the public about the MPS’s accountability in its disciplinary procedures, public safety issues, and student and staff welfare at the University.

c. Confirmation or denial is reasonably necessary as there are no less intrusive means of achieving the legitimate aims.

d. The matter was finely balanced, but there is insufficient legitimate interest to outweigh the named individual’s fundamental rights and freedoms. The named individual would have no reasonable expectation that MPS would confirm or deny whether the requested information was held. Revealing under FOIA whether the MPS carried out disciplinary proceedings in this particular case is not necessary in order to maintain public confidence, and confirming or denying whether or not information is held may potentially cause damage and distress to the named former police officer.

The Appeal and Responses

[7]The appellant appealed on 20 September 2021. Her grounds of appeal are:a. The rights of young women and girls at the University of Glasgow should be prioritised over the individual rights of a former police officer employed at the University.

b. As a public servant, a police officer can expect to be held accountable for their actions whilst on duty, and conduct enquiry records should be publicly available to protect members of the public and support the highest standards of policing.

c. The only option is for information to be released in the public interest.

[8]The Commissioner’s response maintains that the Decision Notice was correct. The Tribunal notes that the response says that confirmation or denial was not necessary for several the legitimate interests relied on by the appellant. This appears to be different from the Commissioner’s decision, which states in paragraph 41 that “there are no less intrusive means of achieving the legitimate aims identified”. The response states:a. Confirmation or denial is not necessary to meet the legitimate interest in ensuring safety, as there are less intrusive means of doing so. The named individual’s place of work would be responsible for safety checking and it is likely that security and employment checks would have been carried out.

b. Confirmation or denial is necessary to meet the legitimate interest in whether the MPS took disciplinary action in a case, although this is reduced as the information is 17 years old.

c. Confirmation or denial is not necessary to safeguard the welfare of girls and young women. Processing would not be confined to the appellant or a limited audience. Concerns could be raised directly with the University’s Principal, and the appellant could ask for reassurance as to the appropriateness of the appointment.

d. Confirmation or denial is not necessary to hold police officers accountable for their actions and support the highest standards of policing, as they could be addressed by the disclosure of alternative information relating to police officers in general rather than one specific incident in relation to one named former police officer.

e. In any event, the balance between the legitimate interests and the rights and freedoms of the data subject remains in favour of upholding section 40(5).

[9]The Tribunal met on 1 April 2021 and decided it was not possible to make a fair decision without further information from the MPS. Then MPS was joined to the proceedings as the second respondent, and the Tribunal made directions which asked for various issues about disciplinary/misconduct outcomes to be covered in its response.

[10]MPS’s response maintains its position:a. They agree that the potentially lawful basis for processing is the legitimate interests test.

b. The interests identified by the appellant are the rights of women and girls, and transparency and accountability. Disclosure is not necessary for those purposes.

c. The rights of women and girls can be assisted more effectively by other avenues such as providing information to the police service or through the individual’s employer. The passage of time reduces weight of this interest, as does the “right to be forgotten”.

d. Transparency and accountability is served by some disciplinary outcomes being published on the MPS website, and the MPS does not accept that making other police conduct records available would be an appropriate way of implementing transparency and accountability. The appellant can also discuss any concerns with the individual’s employer.

e. Any legitimate interests are outweighed in this case. Confirmation or denial would be likely to result in damage or distress to the named former officer. This is enhanced by the age of the information and the reasonable expectations of the officer at the time that such information would remain private, which is lowered further by the officer’s junior rank. The appellant herself has raised concerns about the risk of harm.

[11]Neither the appellant nor the Commissioner provided a reply to the response from the MPS.

Applicable law

[12]The relevant provisions of FOIA are as follows. 1 General right of access to information held by public authorities. (1). Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him. …….

[40]Personal information. (1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1). (a). Giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) – (i) would (apart from this Act) contravene any of the data protection principles… ……. 58 Determination of appeals (1). If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2). On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

[13]A “neither confirm nor deny” response can be used to protect personal data, whether or not a public authority actually holds the requested information. There are situations where merely confirming or denying whether information is held will reveal personal data about a third party and breach the data protection principles.

[14]The Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise makingavailable” (s.3(4)(d) DPA), and so includes disclosure under FOIA – including disclosing whether or not information is held.

[15]The data protection principles are those set out in Article 5(1) of the General Data Protection Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall be:

“processed lawfully, fairly and in a transparent manner in relation to the datasubject”

. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) GDPR. These include where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.

[16]The Article 6(1)(f) balancing test involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner

[2013] UKSC 55

):(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii) Is the processing involved necessary for the purposes of those interests?

(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

[17]As noted by the Commissioner, the GDPR has been replaced by the UK GDPR after the end of the Brexit transition period. We have considered this case in accordance with the GDPR, as the Request was received before the end of the transition period. We note that application of the UK GDPR would involve the same legal analysis.

Application for redaction of names

[18]The appellant emailed the Tribunal on 2 and 6 December 2021 asking for names in the bundle and submissions to be redacted. She provided further information in an email of 15 December 2021, requesting that any names and job titles in the bundle are not made public to prevent existing and former police officers from being identified. The appellant said that due to the level of media interest in policing matters, she was concerned that the information could result in serious harm to identified individuals and they would seek compensation for damage to their careers of character.

[19]Judge McKenna considered this application on 30 December 2021. She made no order, and directed that the matter should be decided by the Tribunal panel hearing the appeal. She made some observations, including that the Decision Notice is drafted in terms that do not reveal the name of the individual about whom the information request is made, and it would be open to the Tribunal panel to do the same thing. She also noted that the bundle is not published, and the parties would be consulted before the bundle was released to the public after the hearing.

[20]The appellant replied on 6 January 2022. She said there is a risk that if it is determined that information from disciplinary proceedings prior to 2015 can be made publicly available, then this may impact on job prospects, reputation and financial position of some police officers or former police officers.

[21]The Commissioner provided submissions on this point on 28 January 2022. This provides details of names and job titles in the bundle, and confirms that three existing and former officers could be identified. The Commissioner submits that the concerns raised by the appellant are a factor to take into account in determining whether section 40(5) was correctly engaged, but points out that any decision is only binding on the parties to this appeal and would not mean the requested information (if it exists) would need to be disclosed or that other police forces would be required to confirm or deny the existence of similar information.

[22]We have considered the application and submissions. We have decided that the appeal may be decided fairly and justly without publicly revealing the name or job title of the individual about whom the information request is made, taking into account the fact the appeal is based on data protection issues. It is also not relevant or necessary to name any other existing or former police officers in the appeal decision. It is not necessary to redact the bundle at this stage in the proceedings. If there is a request from a member of the public to view the bundle after the appeal has been decided, the parties will be given the opportunity to make further representations about redactions before it is released. Any decision about confirmation or denial in this case will only relate to this specific Request, and would not mean that similar information would necessarily need to be confirmed or denied in other cases.

Issues and evidence

[23]The overall issue is whether MPS was entitled to rely on section 40(5B)(a)(i) to refuse to confirm or deny whether it held the requested information, on the grounds it would contravene the data protection principles. The breaks down into the following issues:a. Would confirmation or denial constitute disclosure of third-party personal data?

b. If so, would confirmation or denial contravene one of the data protection principles? In particular, would the processing be lawful under Article 6(1)(f) GDPR? i. Is there a legitimate interest in disclosure of the personal data? ii. Is confirmation or denial necessary for the purposes of those interests? iii. Are such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?

[24]By way of evidence and submissions we had an agreed bundle of open documents, which we have read and taken into account in making our decision.

[25]On behalf of the MPS we had a written witness statement from Mr Damion Baird (Acting Senior Information Manager within the MPS Data Office), which explains how the MPS responds to FOIA requests about police employee conduct and discipline. We also had a written witness statement from Mr Scott Didham (Police Inspector with the responsibility for the MPS Directorate of Professional Standards Misconduct Hearings Unit), which explains the history of the publication of information about police misconduct matters.

Discussion and Conclusions

[26]In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision.

[27]It is a well-established principle that a public authority can issue a “neither confirm nor deny” response to a request for information, irrespective of whether or not the information is held. It is important for public authorities to be able to give a consistent response. If a public authority always revealed when information was not held, a neither confirm nor deny response would effectively give away the fact that information was held. We do not know in this case whether the requested information is held or not, and it is not necessary for us to know this in order to make our decision.

[28]We deal in turn with the issues.

[29]Would confirmation or denial constitute disclosure of third-party personal data? We find that it would, and this is not disputed by the respondents. The Request relates to a named individual, and confirmation or denial would provide information about whether he had been subject to a disciplinary process which led to dismissal or resignation.

[30]If so, would confirmation or denial contravene one of the data protection principles? In particular, would the processing be lawful under Article 6(1)(f) GDPR? The legitimate interests test under Article 6(1)(f) appears to be the only relevant lawful processing condition in this case.

[31]Is there a legitimate interest in disclosure of the personal data? A number of legitimate interests are relevant in this case.a. The safety of girls and young women at the University – the issue here is ensuring that the individual is suitable for the role in which he is employed, particularly in the context of the Sarah Everard case.

b. Accountability of police officers for actions when on duty – the appellant says that police conduct records should be available to protect vulnerable members of the public.

c. The general interests in transparency of MPS records of disciplinary proceedings.

[32]Is confirmation or denial necessary for the purposes of those interests? The test is whether this is reasonably necessary, and we have considered whether there are less intrusive ways of furthering these interests.

[33]In relation to the safety of girls and young women at the University, the Commissioner says that there are less intrusive means of achieving this. The named individual’s place of work would be responsible for safety checking and it is likely that security and employment checks would have been carried out. The MPS also takes this position. They say that they have invited the appellant to contact the police about safety concerns. They also say that the issue of the suitability of the individual for the role could be more effectively pursued via their named employer, who would be responsible for recruitment and performance. Mr Baird’s statement refers to voluntary disclosures during the application process, employment-related and character references, and vetting processes such as a Disclosure and Barring Service (“DBS”) check.

[34]We agree that the individual’s employer is responsible for recruitment and checking suitability for employment in a particular role. This includes obtaining references, asking the individual for information, and potentially conducting DBS checks (depending on the role). This would go some way towards addressing the appellant’s concerns and would be less intrusive. However, it would only partially meet this legitimate interest. There might be failures with the employer’s recruitment checks. More importantly, these checks will only reveal partial information. A DBS will only reveal records of offences (plus some additional information with enhanced checks), previous employers are under no obligation to provide a reference, and an individual may not provide complete information. We accept that information about whether an individual resigned or was dismissed as a result of disciplinary proceedings may be relevant to their suitability for a role at the University. This would not necessarily be revealed by employer checks, particularly if the individual resigned during the process. We therefore find that confirmation or denial is necessary for this purpose.

[35]In relation to transparency and the accountability of police officers for actions when on duty, the current publication scheme operated by the MPS goes some but not all of the way to meeting this legitimate interest. Not all information about disciplinary matters is published, and this Request relates to a time before publication happened at all. Mr Didham makes the point that the current system of publishing misconduct outcome rationales increases accountability and transparency. However, the current publication system does not further accountability of police officers from the time before this was implemented. Similarly, general transparency interests relating to disciplinary records from that time are not furthered by the current approach. We note the Commissioner’s point that the Request only relates to one named individual. Nevertheless, we therefore find that confirmation or denial is reasonably necessary for this purpose.

[36]Are such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? As requested, MPS has provided information about the information that is published about police misconduct matters. This is relevant to the balancing exercise and is explained in Mr Didham’s statement.a. Prior to 2015, all police misconduct matters were private. There was no public access to misconduct hearings, and they were chaired by a Senior Officer.

b. The position on publication of information changed on 1 May 2015. The Police Conduct regulations 2012/2632 were amended in various ways, introducing a legally qualified Chair, publicly accessible hearings, pre-hearing notices, and post-hearing notices (publishing the result of the public hearing for at least 28 days). These changes were not retrospective for any matters prior to 2012.

c. In 2017, regulations were introduced which require that details of any police officer dismissed for gross misconduct are placed on a publicly searchable list.

d. In 2020, the new Police (Conduct) Regulations 2020/4 were introduced. The post-hearing notice was replaced by publication of the misconduct hearing panel’s full rationale. It is up to the Chair of the panel as to the content of the document, and the Chair can decide not to publish at all if appropriate.

[37]We have considered the strength of the legitimate interests identified above.a. In relation to accountability and transparency, we note that the Request only relates to the disciplinary process for one officer in 2003. Confirmation or denial as to whether this record exists would further accountability and transparency in a limited way. It would potentially show what happened with one officer at that time, but would not provide wider information about police misconduct issues in 2003.

b. In relation to the safety of girls and young women at the University, we recognise that this is a very important issue. This is particularly so in light of the Sarah Everard case, and general public concern about the conduct of police officers towards women and the general safety of women in today’s society. We note, however, the arguments put forward by the Commissioner and MPS about other steps that could be taken to check the suitability of an individual for employment at the University. In particular, the checks that can be carried out by an employer prior to and during employment. These do not provide a complete answer to the appellant’s concerns, which is why we have found confirmation or denial is reasonably necessary for this purpose. But, they do go some way to addressing safety concerns - particularly as these checks are likely to pick up more serious issues such as criminal offences (through a DBS check) or dismissals for gross misconduct (through work-related references).

[38]We have considered the strength of the named individual’s rights, in particular his privacy rights.a. We find that the individual does have a reasonable expectation that any information relating to police disciplinary proceedings when he worked for MPS will remain private. The Request relates to information from 2003. As explained by the MPS witnesses, at this time all police misconduct matters were private. No information was provided to the public. Publication of some details first happened in 2015. When this individual worked for MPS, he had a clear reasonable expectation that this information would remain private. The 2015 changes happened much later. Although it appears they applied retrospectively to some matters back to 2012, they clearly did not apply to information from 2003. The changes were neither imminent nor on the horizon at this time.

b. The MPS has also referred to the individual’s status as a junior officer, and says this is relevant to reasonable expectations of privacy. Mr Didham’s statement explains that a junior police officer would not have supervisory, leadership or strategic responsibilities. He also refers to the Commissioner’s guidance that senior employees should expect their posts to carry a greater level of accountability. We are not satisfied that this argument carries much weight in this case. We note that junior police officers are likely to have extensive contact with the public, meaning that information about misconduct which may be relevant to public safety is as important as for more senior officers. We do accept that senior officers may hold more power and so are more likely to expect that their actions will generally be open to public scrutiny, but this does not provide a blanket rule that automatically protects junior officers.

c. We have considered the potential for damage or distress to be caused to the individual by confirmation or denial. This is a request for specific personal data. Confirmation that the requested information is held would not reveal the nature of any misconduct, or details about the disciplinary process. However, it would still be very likely to cause distress to an individual who had no expectation that this information would be made public. This would be a confirmation to the world at large under FOIA. It would also be likely to cause speculation about the disciplinary process, damage to the individual’s reputation, and potentially affect employment prospects. This is particularly likely due to the high levels of concern about police misconduct allegations following the Sarah Everard case. Even if no information is held, a denial may still cause speculation about why the question was asked, and associated damage to reputation.

[39]We have balanced the legitimate interests in confirmation and denial against the named individual’s rights. We found this to be a finely balanced question. The legitimate interest in ensuring the safety of girls and young women at a University is very important. However, as discussed, this can partly be achieved through less intrusive means than public confirmation or denial under FOIA. The individual’s reasonable expectations of privacy are strong, particularly considering the age of the information and the gap in time before any details about police misconduct matters were made public. Distress and damage to the individual is likely, taking into account the strength of the expectations of privacy here and potential effects of public confirmation of a disciplinary process (if this information is held). On balance, we therefore find that the interests in confirmation or denial are overridden by the individual’s privacy rights.

[40]This means that confirmation or denial would contravene the data protection principles, because there is no lawful basis for this processing. MPS was entitled to rely on section 40(5B)(a)(i) to refuse to confirm or deny whether it held the information requested by the appellant.

[41]In relation to the desired outcome from the appeal, the appellant says that the decision by MPS not to publish information about disciplinary proceedings and the outcome should be subject to detailed scrutiny and challenged, as it does not provide openness and transparency relating to conduct inquiries for all police officers. We have considered this in relation to this particular request as discussed above. We also observe that MPS practice has changed, and information about misconduct hearings is now publicly available. Although there is limited transparency about events in 2003, the position is different now. Mr Baird explains in his statement how FOIA requests for misconduct and disciplinary records are now dealt with. There is now enhanced openness and transparency, and the outcome in this case may have been different if the request related to recent disciplinary proceedings.

[42]We also note that we are not setting any precedent for future requests. Paragraph 36 of the Commissioner’s response to the appeal says that once a public authority has denied (or disclosed) certain information to a particular requester, it must then do the same for anyone else. It is important to be consistent in confirmation and denial cases in order to avoid inadvertently revealing information by giving a “neither confirm nor deny” response only when information is held. However, it is not right to say that the same response must be given to every request for the same information which involves personal data. Each request must be treated on its own merits, and the relevant balancing test carried out in all the circumstances of the case. The legitimate interests in asking for the same information may differ, and may outweigh individual privacy interests in some cases but not others.

[43]We dismiss the appeal for the reasons set out above. Signed: Hazel Oliver Judge of the First-tier Tribunal Date: 15 August 2022 Promulgated: 15 August 2022