Matthew Robert Illsley v The Information Commissioner [2023] UKFTT 207 (GRC)

[2023] UKFTT 00207 (GRC)Case Reference: EA/2022/0239
First-tier Tribunal
General Regulatory Chamber
Date 24 February 2023
Information Rights
Decided without a hearing
On: 2 February 2023
Before
TRIBUNAL JUDGE HAZEL OLIVERTRIBUNAL MEMBER JO MURPHYTRIBUNAL MEMBER ROSALIND TATAM
Between
MATTHEW ROBERT ILLSLEYAppellantTHE INFORMATION COMMISSIONERRespondentDecision: The appeal is DismissedREASONS

Background to Appeal

[1]This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 21 July 2022 (IC-145737-T1N8, the “Decision Notice). The appeal relates to the application of the Freedom of Information Act 2000 (“FOIA”). It concerns information about the name of an individual in a document in closed file DEFE-24-1940-1_2 requested from the National Archives (“TNA”).[2]The parties opted for paper determination of the appeal. The Appellant initially requested a hearing, but opted for a paper determination because the witness he had intended to call at the hearing was not available to attend. The Commissioner considered that it would be appropriate for the appeal to be decided on the papers and had consented to a paper hearing. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).[3]On 28 July 2021, the Appellant wrote to TNA and requested the following information (the “Request”):
“I wish to be given access to an unredacted copy – electronic and/or physical – of page 35 of file DEFE-24-1940-1_2. The page itself is a lined, handwritten sheet beginning, ‘UFO Incident: Saturday 4th August…”
[4]The Request relates to a record held by TNA about an alleged UFO incident on 4 August 1990 (the Calvine incident). The redacted document is a handwritten record about an eyewitness account and photographs taken of a “large diamond shaped UFO”. The document redacts the name of the witness and of an RAF press officer. The document says that colour photographs were taken by an eye witness, and were provided to the Scottish Daily Record and the RAF.[5]TNA responded on 3 September 2021 and withheld the information under section 40(2) FOIA, personal data. The Appellant requested an internal review on 15 September, and clarified that he was “now only seeking the name of the witness as shown on the handwritten sheet of page 35”. TNA responded on 12 October 2021 and maintained its position.[6]The Appellant complained to the Commissioner on 13 December 2021. The Commissioner decided that the requested information was personal data and TNA was entitled to rely on section 40(2) to withhold it:a. The most applicable lawful basis for disclosure of the information was Article 6(1) GDPR, the legitimate interest test.b. There was a legitimate interest in disclosure of the information, and disclosure was necessary because the name is not in the public domain and the file remains closed until 2076. The appellant also argued that there was a strong public interest in the accountability of the Ministry of Defence regarding the Calvine incident.c. The privacy rights of the individual overrode those legitimate interests, based on a reasonable expectation that the information would not be disclosed and the likelihood they would be contacted due to the public interest in the paranormal and UFOs.

The Appeal and Responses

[7]The Appellant appealed on 17 August 2022. In summary, his grounds of appeal are:a. The “100 year rule” limiting disclosure of personal information is unwarranted and contrary to the notion of freedom of information.b. The data subject would have a reasonable expectation that their name may be disclosed. The individual had voluntarily contacted staff at the Daily Record, provided photographs, and consented to be interviewed by its staff and the MoD’s press officer. The 30 year rule applied at the time. There is no evidence that the individual required the information to be kept confidential.c. There is no evidence that others who have made more dramatic claims have been subject to harassment or intrusion by the press. The Appellant simply wants to send the individual a polite request to talk to him.d. There are two individuals who allege the witness was intimidated by two MoD officers after the incident. The potential value of the requested information to the public manifestly outweighs the public interest in protecting the witness’s privacy.e. There was an alternative basis for disclosure, Article 6(1)(e) GDPR (processing is necessary for the performance of a task carried out in the public interest).[8]The Commissioner’s response maintains that the Decision Notice was correct. The Commissioner notes that he can only apply the law as it stands, and that disclosure under FOIA is disclosure to the world rather than for a specific purpose. The Commissioner also says that Article 6(1)(e) GDPR does not apply because it is limited to tasks or functions that have a clear basis in law, and in any event cannot apply because disclosure under FOIA is to the world at large.[9]The Appellant submitted a detailed reply which we address in the discussion below.

Applicable law

[10]The relevant provisions of FOIA are as follows. 1 General right of access to information held by public authorities. (1). Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b). if that is the case, to have that information communicated to him. ……[2]Effect of the exemptions in Part II. ……. (2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. …….. 40 Personal information. (1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2). Any information to which a request for information relates is also exempt information if – (a) it constitutes personal data which do not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles ……. 58 Determination of appeals (1) If on an appeal under section 57 the Tribunal considers— (a). that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.[11]Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise makingavailable” (s.3(4)(d) DPA), and so includes disclosure under FOIA.[12]The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation (“UK GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be:
“processed lawfully, fairly and in a transparent manner in relation to the datasubject”
. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include: a. Where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” (Article 6(1)(a). b. Where “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Article 6(1)(e)). c. Where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)).[13]The balancing test under Article 6(1)(f) involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?(ii) Is the processing involved necessary for the purposes of those interests?(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Issues and evidence[14]The main issue is whether TNA was entitled to withhold the requested information under section 40(2) FOIA. There is no dispute that the name of the individual is personal data.[15]There is a dispute about whether Article 6(1)(f) UK GDPR applies to allow disclosure of the information. The issues are:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?b. Is the processing involved necessary for the purposes of those interests?c. Are these interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? This is the key issue in dispute.[16]The Appellant also says that Article 6(1)(e) UK GDPR potentially applies to allow disclosure of the information.[17]By way of evidence we had an agreed bundle of open documents, and two additional documents from the Appellant (a TNA document “Access to Public Records” from 1999, and minutes from an Information Rights Tribunal User Group from 17 April 2013).

Discussion and Conclusions

[14]In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision.[15]General application of section 40(2) FOIA. The Appellant has made a general point that the “100 year rule” is incorrect and/or should not be applied as a blanket rule. He has referred to earlier documents which predate the DPA. These refer to the previous 30 year rule that was used for release of public records and the need to show risk of damage or distress in order to withhold personal information. If the Appellant is saying that all public records containing personal data should not be automatically withheld for 100 years, he is correct. However, that is not how any 100 year rule has been applied in this case. The DPA covers personal data about living individuals. Where it is not known whether a data subject is still alive, it is assumed that they are still alive until they would have reached the age of 100. This 100 year calculation is simply used to decide whether the DPA applies to an individual’s personal data at all. If the DPA does apply because the individual is presumed to still be alive, it does not mean that the personal data should not be disclosed. It simply means that the usual DPA tests must be used to ensure that any disclosure of personal information about an individual is lawful.[16]Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? The Commissioner found that there are legitimate interests in disclosure of information (although the reasons for this in the Decision Notice are not particularly clear). TNA has noted in its correspondence to the Commissioner that there is a distinction between public curiosity and the public good. However, we accept that there are general public interests in transparency and accountability, specifically in this case relating to the Ministry of Defence. The Appellant refers to evidence from two unnamed individuals about alleged intimidation of the witness by the Ministry of Defence. This adds to the weight of public interest in knowing the identity of the witness so that there can be more transparency about the truth of these allegations. The Appellant also has a personal interest in the information as he wishes to speak to the witness (if he is still alive) as part of his historical research. We therefore find that legitimate interests would be pursued by disclosure of the information under FOIA.[17]Is the processing involved necessary for the purposes of those interests? This is not disputed by Commissioner. It appears that the individual’s identity is not easily available elsewhere, and so disclosure under FOIA is reasonably necessary for the purposes of the legitimate interests.[18]Are these interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? The Appellant challenges the Commissioner’s decision on this point in a number of ways.a. The Appellant says that other evidence has been destroyed, and so this is the only way the matter can be investigated now. It does appear that the individual’s identity is not available for other means. This does not mean that release of their name under FOIA is the only way that this matter can be investigated, but we accept that it is one possible way (depending on whether the individual is contactable and/or wishes to assist with an investigation).b. The Appellant says that this is non-sensitive data. That is correct. This is not special category data which has additional safeguards under the DPA. However, it is still personal data, and so the usual tests for fair and lawful processing apply. We are applying those tests in this decision.c. The Appellant says that there is no evidence that the individual wanted anonymity or provided information to the Ministry of Defence in confidence. He points to TNA having said there is no evidence of the individual seeking anonymity, serving notice to restrict access to his personal data, or providing personal data in confidence. He is correct that we have not seen any positive evidence of this. However, there is also no evidence that the individual was happy for his name to be released publicly. It is very unclear from the information we have whether the individual ever contacted the Ministry of Defence himself or provided any information to them directly. According to the information the Appellant has cited from the RAF Press Officer, now known to be Mr Craig Lindsay (A56 in the bundle), Mr Lindsay alleges that he phoned the Daily Record to obtain the data subject’s details and provided them to the Ministry of Defence. This suggests that the individual had only contacted the Daily Record and had never provided his details directly to the Ministry of Defence.d. The Appellant also says that the individual voluntarily gave information to the press, and this means he would expect to be contacted. We do not agree. It appears that the individual provided photographs to the Daily Record, and these together with his contact details were passed on to the RAF/Ministry of Defence. We do not know whether the individual was aware of this or gave permission for this to happen. We also do not know what the individual said to the Daily Record about publication of his identity – it seems his name has never been published (and the newspaper did not publish his photographs or any information about the incident), and we have no information about whether he wanted publicity in the media or had asked for anonymity. We also note that expectations can change over time. If the allegations about intimidation of the individual are in any way true, or even if there was simply a discussion about the situation with representatives from the Ministry of Defence, this would provide a reason for the individual to wish to remain anonymous. We certainly have no evidence that this individual was expecting his name to be published to the world at large in connection with the photographs.e. The Appellant says that the individual would have an expectation of the 30 year rule applying to his personal data, and that time has now passed. We note that these events occurred before the latest version of the DPA and UK GDPR. Individuals’ expectations of personal data privacy are shaped by the current law, which provides additional protection for personal data under the UK GDPR as compared to the 1990s.f. The Appellant says that no distress was caused to Mr Lindsay when he was contacted. However, we find that this person is likely to have very different expectations from the data subject in this case. He is a former RAF press officer, who would know what he was dealing with in terms of publicity and was acting in a professional role. He seems to have chosen to be interviewed and photographed by the press. This is very different from the individual who took the original photographs.g. The Appellant alleges that the individual was subject to criminal actions – intimidation by Ministry of Defence officials, and theft of his photographs which were not returned. We note that there is some evidence in the bundle that the photographs were returned to the Daily Record (for example, in the redacted document itself at page 45 in the bundle). We have dealt with the allegations of intimidation in our discussion about legitimate interests. This adds weight to the legitimate interests in disclosure, but also adds weight to why the individual may not want his name to be made public.h. The Appellant says that there is no mention of the paranormal in the matter, and so the Commissioner was incorrect to refer to this in the Decision Notice. He also says that a stigma can’t be attached to taking photographs of UFOs. This relates to comments from TNA which are set out in paragraph 47 of the Decision Notice, that public interest in the paranormal and UFO’s creates likelihood that the individual would be contacted. We note that this matter does not necessarily involve the “paranormal”, but it does involve a photograph of a UFO. There is general public interest in sightings of UFOs, as shown by the recent media reports in relation to the Calvine incident after Mr Lindsay was interviewed. This is not a “stigma”, but does suggest there would be interest from the press and others if this individual’s identity was revealed. It is also likely that this interest would be enhanced by the allegations made by the unnamed individuals about intimidation.i. The Appellant makes the point that this individual is only one of thousands of already named individuals in relation to UFO sightings. He says there have been no Press Complaints Commission complaints about harassment following alleged UFO sightings, or complaints from people whose names had been released. He also says that withholding this individual’s name is inconsistent with treatment of similar files. Again, it is important to remember that the rules about protection of personal data have changed over time. We are applying the current law under the DPA and UK GDPR, which is very different from the more limited protection of personal data which applied when names were released in the past. We are making an assessment on the facts of this case. The fact that names have been released in other cases does not mean that this name should be released. We also note that the Appellant has described this as a “uniquely documented and historically important case, centred on the man who took ‘the best UFO photograph ever’”. This means there is likely to be more press and public interest in this individual than in other cases.[19]We have considered the reasonable expectations of the individual in this particular case. We do not know the basis on which he spoke to the Daily Record, whether he wished to remain anonymous, and whether his wishes changed after speaking with the RAF/Ministry of Defence. We note that this individual has never identified himself in the press, and has not done so even after the press reports following the interview with Mr Lindsay. There is no indication that he wished or wishes his name to be made public. We find it is likely that release of the individual’s name would cause press and public interest, and lead to attempts to contact the individual. We also find that it is very likely this would cause distress to an individual who was not expecting his name to be released in this way. This would be particularly intrusive if combined with attempts to investigate serious allegations such as alleged intimidation.[20]We have taken into account the legitimate interests in disclosure, as discussed above. However, we find that these interests are overridden by the privacy rights of the data subject in this case, taking into account his expectations of privacy and the likely consequences if his name were to be released. We therefore find that disclosure of the redacted name under FOIA would breach the data protection principles and would not be lawful under the UK GDPR. It is exempt from disclosure under section 40(2) FOIA.[21]Does Article 6(1)(e) UK GDPR apply to allow disclosure of the information? We find that Article 6(1)(e) does not apply here. We do not agree with the width of the Appellant’s interpretation of this provision. More importantly, this provision would not allow disclosure to the world at large under FOIA. At most it would allow disclosure to a particular person/body for a specific task. The Appellant has asked for this information under the freedom of information regime. This means that any disclosure must be to the world at large.[22]Other matters raised by the Appellant.a. The Appellant has also suggested that we should require TNA to find out if the individual is still alive and seek consent to disclosure. TNA is not required to do this under FOIA and/or the DPA, and this Tribunal is not able to require them to do so.b. The Appellant has also asked whether the Tribunal can make an order for privileged disclosure just to him. We are unable to do this. As explained above, disclosure under FOIA is to the world at large. Our role is limited to deciding whether the Commissioner’s decision in relation to the application of FOIA was in accordance with the law.c. Similarly, this Tribunal is also unable to send a request to the individual to ask whether he wishes to speak to the Appellant.[23]We find that the Commissioner’s decision was in accordance with the law and TNA was entitled to withhold the requested information under section 40(2) FOIA. We dismiss the appeal. Signed Judge Hazel Oliver Date: 24 February 2023