Des Moore v Information Commissioner & Anor [2023] UKFTT 119 (GRC)

[2023] UKFTT 00119 (GRC)Appeal References: EA/2021/0274
First-tier Tribunal
General Regulatory Chamber
Date 14 February 2023
Information Rights
Determined, by consent, on written evidence and submissions.
Considered on the papers on 7 February 2023.
Before
TRIBUNAL JUDGE Stephen Cragg KCTRIBUNAL MEMBER Anne ChaferTRIBUNAL MEMBER Pieter de Waal
Between
DES MOOREAppellantINFORMATION COMMISSIONERRespondentCHIESF CONSTABLE OF BEDFORDSHIRE POLICESecond RespondentDecision: The appeal is Dismissed.Substituted Decision Notice: NoneREASONS

MODE OF HEARING

[1]The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.[2]The Tribunal considered an agreed open bundle of evidence of 91 pages together with a closed bundle and submissions.

BACKGROUND

[3]On 17 September 2020, the Appellant wrote to Bedfordshire Police to request information under FOIA as below: - I am interested in information relating to injury awards pursuant to the Police (Injury Benefit) Regulations 2006 SI 2006/932. 1. How many individuals currently receive injury awards from your force? 2. For each of the three years 2017/18, 2018/19 and 2019/2020 please provide the number of police officers granted an injury award. 3. For each of the three years 2017/18, 2018/19 and 2019/2020 please provide the amount paid to all those in receipt of injury awards. 4. For each of the three years 2017/18, 2018/19 and 2019/2020 please provide the number of reviews carried out of injury awards. 5. For each of the three years 2017/18, 2018/19 and 2019/2020 please provide the number of reviews that resulted in the level of pension: i. remaining unchanged; ii. increasing; and iii. reducing. 6. For each of the three years 2017/18, 2018/19 and 2020 please provide the number of individuals contacted regarding a review who did not answer the questionnaire sent to them in connection with their review. 7. Please provide a copy of the questionnaire sent to those in receipt of injury awards regarding their review. 8. Please provide the number of officers in receipt of an injury award (include those who were awarded injury benefit by another force) who currently work for your force, if any.[4]Bedfordshire Police responded on 16 October 2020. It provided the information for parts 1 and 3 of the request. For part 2 it cited section 40(2) FOIA, the exemption for personal information. For the remainder of the request, it advised the complainant as follows: - For questions 4, 5, 6, 7 & 8 from discussions with our consultants, reviews of injury awards were suspended some time ago. New guidance on injury award reviews were to be issued by the government but as yet have not been received.[5]The Appellant requested an internal review on 18 October 2020 in relation to part 2 of his request only, where section 40(2) FOIA had been cited. He contended that a ‘motivated intruder’ would not be able to identify any individual police officer should the number of police officers over the specified years be disclosed.[6]Following its internal review Bedfordshire Police wrote to the Appellant on 13 November 2020. It maintained its original position. The Appellant contacted the Commissioner on 20 November 2020 to complain about the way his request for information had been handled.[7]The Commissioner produced a decision notice dated 14 September 2021 in which the Commissioner said that the scope of the case was to determine if the Council was correct to withhold the information on the basis of section 40(2) FOIA. However, during the investigation Bedfordshire Police partly revised its position and said that due to the way the information is now held, it did not hold the information for 2018/19 or 2019/20 as to the number of officers to whom an award was granted in those years.

THE LAW

[8]Section 1(1) FOIA provides that any person making a request for information to a public authority is entitled:-(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.[9]The Commissioner’s guidance ('Determining whether information is held’, V3.0, 25 June 2015) states that:- When a public authority claims the information is not held, the Commissioner will decide whether this is the case on the balance of probabilities. He will reach a decision based on the adequacy of the public authority’s search for the information and any other reasons explaining why the information is not held, such as there being no business need to record it (p3).[10]Section 40 (2) FOIA reads as follows: - (2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1) (personal information of the applicant], and(b) the first, second or third condition below is satisfied.[11]Section 3(2) of the Data Protection Act 2018 (DPA) defines personal data as ‘any information relating to an identified or identifiable living individual’.[12]The Upper Tribunal (UT) has given judgment in the case of NHS Business Services v Information Commissioner and Spivack [2021] UKUT 192 (AAC) (Spivack) on 6 August 2021, which dealt with the issue as to what should be considered to be ‘personal data’ and which is potentially relevant to this appeal. A firm conclusion was reached by the UT in Spivack that the law ‘creates a binary test: can a living individual be identified, directly or indirectly? If the answer is ‘yes’, the data is personal data. Otherwise, it is not’ (paragraph 12). It is also stated that ‘The test has to be applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer….’ (paragraph 13).[13]In Information Commissioner v Miller [2018] UKUT 220 (AAC) at paragraphs 12-16, the Upper Tribunal acknowledged the ‘motivated intruder’ test, which relates to ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’[14]Again in Miller the UT noted that a similar approach was taken by the Court of Session (Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at paragraph 24:- …it is not just the means reasonably likely to be used by the ordinary man on the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist…[15]The adoption of this test was confirmed in Spivack at paragraph 33.[16]Of course, if it is established that a person has been identified, then the question arises as to whether the information relates to that person.[17]If the information is personal data then the relevant condition (as referred to in s40(2) FOIA) in this case is found in s40(3A)(a) FOIA:- (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles.[18]Under s40(7) FOIA the relevant data protection principles in this case are to be found in Article 5(1) of the UK GDPR. Materially, Article 5(1)(a) reads: - Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).[19]Further, by Article 6(1) UK GDPR: - Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…

THE DECISION NOTICE

[20]The Commissioner explains as follows: - 9. [The complainant] stated that, of the 24 police forces who had responded at the time of his complaint, only one other force cited section 40(2) for part 2 of his request. Whilst this is noted, the Commissioner will consider each complaint on its own merits. 10. During the course of the Commissioner’s investigation, Bedfordshire Police provided her with the withheld number for the period 2017/18.[21]In relation to the revised position in relation to the information about the number of officers to whom an award was granted in 2018/19 or 2019/20 (to the effect that Bedfordshire Police said that the information was not held), the Commissioner explained:-11. At the Commissioner’s request, Bedfordshire Police informed the complainant of its part-revised position on 20 July 2020. That same day, the Commissioner contacted the complainant to seek his view on the updated position.12. On 29 July 2021, the complainant wrote to the Commissioner. He said he was “puzzled” by Bedfordshire Police’s revised response, advising: “My puzzlement stems from the fact that the information provided in response to Request 3 [ie part 3] depends upon the existence of information for each of the three years specified in Request 2 [ie part 2]. Additionally, Bedfordshire Police has provided no reasoning to support its position. It may be that the information is held on its behalf by someone else (pension scheme administrator). Organisations are legally obliged to keep detailed records of their pension schemes, and it is concerning that Bedfordshire Police is stating that it holds no information. Information regarding pensions required to be held is included in the following guidance to pension scheme administrators: 'Information pension scheme administrators must give to members [https://www.gov.uk/guidance/pension-administrators-annual-and-lifetime-Allowance-Statements].13. On 20 July 2021 and 2 August 2021, the Commissioner wrote to Bedfordshire Police to investigate its part-revised position, specifically that it had said it did not hold the requested information for the years 2018/19 and 2019/20.14. Bedfordshire Police responded on 17 August 2021. It addressed the Commissioner’s search-related questions and explained more about the system change. The Commissioner found it necessary to make further enquiries to clarify her understanding.[22]In this case the Commissioner decided that the requested information for 2017/2018 was personal data (as defined above). The following basis for this was put forward: - 27…disclosure of the actual number of police officers granted an injury award during 2017/18 would not necessarily result in any individual police officer being able to be identified. However, the Commissioner is mindful that in this case the number is very low and that its disclosure could potentially reveal the identity of the data subject(s) and the fact that they have received an injury award.28. Bedfordshire Police has explained that injury awards are made confidentially and knowledge of such awards is restricted to those who “need to know”.29. A test used by both the Commissioner and the First–tier Tribunal in cases such as this is to assess whether a ‘motivated intruder’ would be able to recognise an individual if he or she was intent on doing so. The ‘motivated intruder’ is described as a person who will take all reasonable steps to identify the individual or individuals but begins without any prior knowledge. In essence, the test highlights the potential risks of re-identification of an individual from information which, on the face of it, appears truly anonymised. … 31. In summary, the motivated intruder test is that if the risk of identification is “reasonably likely” the information should be regarded as personal data. 32. The Commissioner considers that a motivated intruder could potentially identify a Bedfordshire Police Officer (or officers) through piecing together the number of officers (if disclosed), together with other information known to them about an individual or individuals. … 36. In this case, the Commissioner has taken into account other arguments provided by Bedfordshire Police which she is not able to reproduce here. Based on the information she has been provided, she is mindful that disclosure of the withheld figure would be likely to result in the individual(s) concerned being identifiable by other Bedfordshire Police employees who are likely to have a more in-depth knowledge of their own work force and any injuries to staff.[23]Next the Commissioner considered Article 5(1)(a) of the UK GDPR which means that the information can only be disclosed if to do so would be lawful, fair and transparent. As to lawfulness, the Commissioner considered the correct approach under Article 6(1)(f) of the UK GDPR (as set out above), as follows: - 45. …it is necessary to consider the following three-part test: -(a) Legitimate interest test: Whether a legitimate interest is being pursued in the request for information;(b) Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question;(c) Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.[24]The Commissioner approached the case by recognising a legitimate interest in the ‘disclosure of the number of police officers receiving injury awards – this would aid openness, transparency and provide context to how many times injury awards were granted during the year 2017/18’: paragraph 50.[25]The Commissioner considered that ‘Necessary’ in the second part of the test means ‘more than desirable but less than indispensable or absolute necessity’ (paragraph 51) and applied that to the request. The Commissioner said that that this could also involve consideration of alternative measures which may make disclosure of the requested information unnecessary. The Commissioner concluded:-52. Neither the complainant nor Bedfordshire Police made any submissions as to why disclosure of the number of injury awards is ‘necessary’. The Commissioner cannot identify any reason why it is necessary for the number of police office injury awards for 2017/18 to be disclosed in this case. By way of comparison, she considers that disclosure of the amount of money associated with such awards would potentially be of greater public interest, but she also notes that in this case, the expenditure has been disclosed for all 3 year periods stipulated by the complainant.53. As the Commissioner has decided in this case that disclosure is not necessary to meet the legitimate interest in disclosure, she has not gone on to conduct the balancing test. As disclosure is not necessary, there is no lawful basis for this processing and it is unlawful.[26]The Commissioner then considered whether, on the balance of probabilities, Bedfordshire Police holds the number of injury awards granted to its police officers for 2018/19 and/or 2019/20. The Commissioner notes that:-60. By way of an overview, Bedfordshire Police told the Commissioner: “Having spoken to the relevant departments I can confirm that since the change in system for the 2018/2019 year we don’t hold the date for which officers are granted an injury award within the pay system. I have also been informed that this is no longer recorded as it caused problems due to in some circumstances the date the injury award is granted and the effective date of the award are different, therefore we wouldn’t be able to provide it for such circumstances due to the way the system is configured.”61. The Commissioner found it necessary to clarify Bedfordshire Police’s response to her search questions. Having done so, she understands that since 2018/19 the requested information is now held by an external pensions provider (‘EPP’) which records injury award information relating to police officers for around half (but not all) the UK police forces. Whilst EPP’s system records the overall amount of injury award expenditure by year, it does not break this down by date or number of officers by year.62. Bedfordshire Police clarified it had been able to identify the number of police officers in receipt of an injury award for 2017/18 because it held that information on its old system before EPP were involved. It also explained that it had been able to provide the overall number of individuals in receipt of an injury award at the time of the request (as per part 1 of the request) because no breakdown by year had been requested by the complainant.63. Bedfordshire Police explained that it was aware that one of the police forces who had responded to the complainant’s request keeps its own records of dates and numbers of police officers in addition to the information held by EPP, and so had been able to respond to his request in full. However, Bedfordshire Police said it does not hold or maintain any such records itself.64. Bedfordshire Police said it had searched with its Human Resources and Finance departments whom it said it considered to be “the relevant departments”, as well as with EPP. It explained that searches included all electronic data that each department felt relevant to the request where they believed this information could be held. The search term ‘injury award’ was used on Bedfordshire Police’s networked resources as well as for EPP.65. Bedfordshire Police confirmed that any recorded information held relevant to the request would be held electronically. It said that no information had been held that had been deleted or destroyed. It also advised that there are no business purposes or statutory requirements upon Bedfordshire Police to hold and retain the requested information.[27]Based on the explanation provided by Bedfordshire Police, the Commissioner was satisfied, on the balance of probabilities, that no recorded information is held for the number of police officers in receipt of an injury award for the years 2018/19 or 2019/20.

THE APPEAL AND RESPONSES

[28]The Appellant’s appeal is dated 18 September 2021. In relation to the Commissioner’s decision that s40(2) FOIA applies to the information requested for 2017/2018, the Appellant refers to the Spivack case as set out above and argues that ‘the Commissioner has failed to demonstrate that actual identification would occur as a consequence of providing the information I have requested for the year 2017/18’. He also objects to the Commissioner dismissing the Appellant’s point that many other police forces have provided the information without relying on s40(2) FOIA, and the fact that the Commissioner says that each case must be considered on its own merits.[29]The Appellant appeals against the Commissioner’s finding that Bedfordshire Police does not hold the information for 2018/19 and 2019/20 as to the date upon which individual officers are granted an injury award. The Appellant says:- …the statutory regulatory system requires that certain information relating to individuals and their pensions be retained for at least the duration of the pension schemes – start date included. The Pensions Regulator confirms this:
'What records to keep As a pension trustee or someone running a public service scheme you need to keep certain records and data. This enables the administrator to accurately identify scheme members and value their benefits. You need to keep records relating to... 'member and beneficiary information, including the date each member joined the scheme'
. This appeal concerns important matters of transparency and accountability. The Commissioner was wrong to determine that searches carried out by Bedfordshire Police were adequate.[30]The Commissioner accepts that the test in Spivack is the test to be applied, and that the way the test is expressed in paragraph 31 of the decision notice is incorrect but goes on to say:- Notwithstanding this error, she submits that her analysis at paragraphs 32 to 36 of her Decision Notice shows that she was satisfied that the withheld material was ”personal data” within s3(2) DPA 2018 because, having regard to all the information that was reasonably likely to be used - including the ‘very low’ number and the information available to other Bedfordshire Police employees ‘who are likely to have a more in-depth knowledge of their own workforce and any injuries to staff’ (DN, para 36) — the disclosure of the withheld material would enable one or more individuals who had received injury awards in 2017/2018 to be indirectly identified as a result. In other words, the Commissioner was satisfied on the basis of the information reasonably likely to be used by a motivated intruder that one or more persons would actually be identified from the disclosure of the injury award data from 2017/ 2018.[31]In relation to the fact that other police forces have disclosed similar information the Commissioner says:- …the identifiability of individuals from the data depends in each case not only on the number of injury awards but also the circumstances particular to each police force. It is, therefore, nothing to the point that other police forces have disclosed the requested information, without taking account of the particular assessment that was made under 540(2) and/ or art 6(1)(f) in each case.[32]In relation to whether other information was held, and the Appellant’s reference to guidance from the Pension Regulator the Commissioner says:- …the guidance does not show that Bedfordshire Police was required to keep the particular information sought. The guidance requires only that organisations need to keep ‘member and beneficiary information, including the date each member joined the scheme’. It does not follow from this that Bedfordshire Police was therefore required to hold the particular information sought by the Appellant under item (2) in relation to years 2018/ 19 and 2019/ 20. … in any event, paragraphs 60-68 of the Commissioner’s Decision Notice sets out cogent reasons for her conclusion that it was more likely than not that Bedfordshire Police did not in fact hold the number of awards sought for the years in question, i.e. the shift to the EPP in 2018/ 19 which resulted in the information no longer being held. Nothing in the Appellant’s grounds serves to undermine the safety of that conclusion.[33]Bedfordshire Police was joined as a second respondent to this appeal by the Registrar on 24 November 2021. On 29 March 2022 Bedfordshire Police informed the Tribunal that it had nothing further to add to the Commissioner’s response. DISCUSSION[34]The Tribunal notes that the Commissioner accepts that the wrong test has been applied in the decision notice for analysing whether the withheld information (the number of officers to whom an award was granted in 2017/2018) is personal data. The task of the Tribunal is to apply the correct test and conclude whether or not the result reached by the Commissioner (that the withheld information is personal data) is the right one.[35]In short, applying the approach in Spivack, the Tribunal has to decide whether if the withheld information is disclosed, one or more individuals will, in fact, be identifiable.[36]From the decision notice we take the following:-(a) The number withheld is ‘very low’.(b) Injury awards are made confidentially, and knowledge of such awards is restricted to those who ‘need to know’.(c) The Commissioner’s view that disclosure of the withheld figure would be likely to result in the individual(s) concerned being identifiable by other Bedfordshire Police employees who are likely to have a more in-depth knowledge of their own work force and any injuries to staff.[37]The Tribunal is aware that, in paragraph 36 of the decision notice, it is stated that ‘the Commissioner has taken into account other arguments provided by Bedfordshire Police which she is not able to reproduce here’. As well as the actual number involved, the Tribunal has been provided with details of the information from Bedfordshire Police which is referred to in paragraph 36.[38]Having carefully considered this information, and the actual number withheld, the Tribunal finds that it agrees with the Commissioner’s conclusions on the ‘personal data’ issue. It is clear to the Tribunal that if the withheld information is disclosed then other employees who will have additional information about the Bedfordshire Police work force and injuries suffered by staff would be able to identify the individual(s) to whom an award was made in 2017/2018. Thus, the withheld information is information relating to an identifiable individual or individuals and so is ‘personal data’.[39]We reach that conclusion on the specific facts of this case as considered by the Tribunal. We are not aware of the factual situations which may have led other police forces to disclose similar information, and not rely on s40(2) FOIA, to which the Appellant refers. The fact that disclosure has happened in other cases cannot impact on our consideration as to whether it would be lawful in this case, and the Commissioner was right to take the same approach.[40]Having reached that conclusion on the ‘personal data’ issue, we must also consider the three-stage test considered by the Commissioner and explained in some detail above.[41]The appeal in this case does not raise any arguments as to whether disclosure should take place even if the information is personal data. We have carefully considered the application by the Commissioner of the three-stage test required by the legal provisions. We have set out the reasoning of the Commissioner at paragraphs 24-25 above. We agree with the Commissioner’s conclusion that there is a legitimate interest in disclosure in this case (essentially the understanding of the amounts paid by Bedfordshire Police in relation to injury awards and the number of officers in receipt of awards), but we also agree that the disclosure of the withheld information in this case is not ‘necessary’ to achieve that legitimate aim. Having reached that view, we do not need to go on to consider the third part of the test, which is also the approach adopted by the Commissioner.[42]In relation to the finding by the Commissioner that, on the balance of probabilities, Bedfordshire Police does not hold information on the number of officers who were granted injury awards in 2018/2019 and 2019/2020 we also agree with the Commissioner’s conclusions.[43]At first blush, we accept that it is surprising that Bedfordshire Police does not hold the information because(a) it has the information for 2017/2018 and(b) it knows the total amounts paid out in each year. Indeed, the Commissioner returned to Bedfordshire Police for a detailed explanation as to how this situation could occur. However, the Commissioner received a detailed explanation from Bedfordshire Police which is set out in the decision notice at paragraphs 60-63, which we have reproduced above, and which explains that a change of process is the reason for the different response in relation to the later years. The explanation makes sense and we have no reason to believe that it is not true.[44]The Appellant makes points about the information he believes should be available, but our task is to decide whether or not information is actually held. The Commissioner has set out at paragraphs 64-65 the details of the searches implemented by Bedfordshire Police to attempt to locate the information in its own records, and we agree with the Commissioner that these amount to a reasonable search for the information. The fact that Bedfordshire Police knows the total amount paid out in injury awards in a particular year (to all those in receipt of an award) does not necessarily mean that it must hold information about the number of people actually granted an award in that year, and Bedfordshire Police has explained why it does not hold that information.[45]On that basis we agree with the Commissioner that, on the balance of probabilities, Bedfordshire Police does not hold information relating to the number of persons to whom an injury award was granted in 2018/2019 and 2019/2020.

CONCLUSION

[46]For the reasons set out above this appeal is dismissed. Signed Judge Stephen Cragg KC Date: 10 February 2023