Edward Williams v Information Commissioner [2023] UKFTT 259 (GRC)

[2023] UKFTT 00259 (GRC)Case Reference: EA/2021/0086 and EA/2021/0110
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 8 September 2021Date 7 March 2023
Information Rights
Heard by: remote video hearing
Before
TRIBUNAL JUDGE LYNN GRIFFINTRIBUNAL MEMBER JOHN RANDALLTRIBUNAL MEMBER PAUL TAYLOR
Between
EDWARD WILLIAMSAppellantINFORMATION COMMISSIONERRespondentin person for AppellantHarry Gillow, counsel, instructed by Richard Bailey, Information Commissioner’s Office legal services for RespondentDecision: The appeals are DismissedREASONS
[1]The appeals reference EA/2021/0086 and EA/2021/0110 concern requests for information made to the ICO. The Respondent Information Commissioner is the public authority and the regulator; when referring to her actions as a public authority dealing with the request we will refer to the ICO and when referring to her actions as regulator dealing with the appellant’s complaint we will refer to the Commissioner. The hearing[2]The proceedings were held by video via the Cloud Video Platform. There was no objection to this mode of hearing. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.[3]I apologise to the parties for the time it has taken to reduce this decision to writing for it to be promulgated.[4]The Tribunal considered agreed open bundles of evidence as followsa. 220 pages in Appeal EA/2021/0086b. 193 pages in Appeal EA/2021/0110[5]In addition we received the following open evidencea. an authorities bundle of 386 pages, not including the indexb. a skeleton argument from the Appellant dated 14 July 2021c. a skeleton argument from the Respondent dated 31 August 2021d. ICO decision notice reference IC-42172-D5T1 provided by the appellant on 2 September 2021e. ICO guidance on use and disclosure of vehicle information (undated According to an extract included in an email from the Appellant dated 31 August 2021 this guidance may be dated 3 September 2007 ) provided by the appellant in his email of 6 September 2021 08:52 which included brief additional submissions and a request for any updated guidance.[6]Neither party relied on oral evidence from any witness. No witness statements had been served.[7]The tribunal received and considered a closed bundle in appeal EA/2021/0086. There was no closed session and there is no closed decision from the tribunal. Background to Appeal[8]The appellant has made a number of Freedom of Information Act 2000 [FOIA] requests to the ICO in respect of the data practices of the Driver and Vehicle Licensing Agency (“DVLA”). Before the requests that concern this tribunal he had made a request on 26 September 2019 which included a request for ICO audits of the DVLA. On 5 December 2019 the ICO disclosed a redacted copy of an audit report dated 13 May 2016. Further information was withheld under s40(2) and s31(1)(g) FOIA.[9]The area of Mr Williams interest, in so far as this series of requests is concerned, is the discretionary power, vested in the Secretary of State for Transport (via the DVLA) to release of by registration and licensing particulars to any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him pursuant to regulation 27(1)(e) of Road Vehicles (Registration and Licensing) Regulations 2002. This may include or lead to the identification of the keeper of a motor vehicle. He is concerned that the DVLA has been responsible for unlawful processing of personal data, as he alleges they have failed to ensure that private entities had “reasonable cause” to be provided with vehicle registration data, in particular in the light of the GDPR.[10]Mr Williams has made other FOIA requests direct to the DVLA which have led to complaints being made to the Information Commissioner and then appealed to this tribunal and beyond, including in DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) which considered the application of section 31 FOIA to the request Mr Williams had made of the DVLA asking for records relating to the action taken by the DVLA to prevent organisations selling driver details obtained by virtue of the system run by the DVLA, known as the KADOE service, to provide disclosure of the particulars from the DVLA register. The requests[11]On 12 February 2020, the Appellant emailed the ICO, he asked “did the audit check to see if the DVLA checks for reasonable cause for wanting data prior to releasing data to private parking companies etc. pursuant to Reg 27.1.e of The Road Vehicles (Registration and Licensing) Regulations 2002?” This is the request in EA/2021/0110.[12]On 13 February 2020, the Appellant sent a follow-up email asking as follows - “you sent me the executive summary, how about the full report etc.?”.[13]The ICO initially refused the request under the exemption provided in section 14(2) FOIA because they said it was a repeated request.[14]Following an internal review, requested by the appellant, the ICO refused on different grounds. They relied instead on the basis of the exemptions in sections 31(1)(g) and 40 FOIA.[15]The Appellant made his complaint to the Commissioner and in correspondence during the investigation into the complaint the ICO also relied on s.44 FOIA.[16]The refusal on the grounds of s.31 FOIA was upheld by the Commissioner in her Decision Notice IC-39673-F2Z8, dated 16 April 2021, which is the subject of appeal EA/2021/0110.[17]The withheld information in appeal 0110 is the information redacted from the 2016 ICO audit report that had previously been disclosed to Mr Williams.[18]On 26 April 2020, the Appellant emailed the ICO requesting information as follows “under the FOIA disclose all correspondence in the last 3 years with the Dept. of Transport/DVLA, regarding the DVLA releasing data under reg 27(1)(e) road vehicles (registration and licensing) regulations 2002 without checking the request for reasonable cause for wanting the data before release. Disclosure of Information 27 Disclosure of registration and licensing particulars (1) The Secretary of State may make any particulars contained in the register available for use-- (e) by any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him. I want to change broaden the request to:
“Please disclose all correspondence, internal ICO memos, reports and other communications etc. in the last 3 years with the Dept. of Transport/DVLA, regarding the DVLA releasing keeper data under reg the road vehicles (registration and licensing) regulations 2002.”
IF THIS EXCEEDS COST LIMIT THEN CHANGE 3 YEARS TO 18 MONTHS.” Disclosure of Information 27 Disclosure of registration and licensing particulars (1) The Secretary of State may make any particulars contained in the register available for use-- (e) by any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him. IF THIS EXCEEDS COST LIMIT THEN CHANGE 3 YEARS TO 18 MONTHS.”[19]The ICO refused this request on the basis of the exemption provided in s. 31(1)(g) FOIA. This was upheld by the Commissioner in her Decision Notice IC-45065-D8H5, which is the subject of appeal EA/2021/0086.[20]The information which the ICO is withholding in appeal 0086 is(i) An internal ICO handover note (March 2020);(ii) Various correspondence exchanged between the ICO and the DVLA (August 2018 to August 2019);(iii) Legal advice (dated, respectively: September, October and December 2019);(iv) Minutes of internal Tasking and Coordinating Group meeting (October 2019);(v) Internal email exchanges (February 2020);(vi) Agenda and minutes of a meeting (February 2020);(vii) Internal correspondence (January 2020);(viii) Draft Senior Leadership Team briefing paper (February 2020);(ix) DVLA options paper (February 2020); and(x) Draft letter from ICO Deputy Commissioner to DVLA CEO (February 2020)[21]The Appellant appealed against the Decision Notice IC-45065-D8H5 on 29 March 2021 (the “0086 Appeal”), and the Decision Notice IC-39673-F2Z8 on 16 April 2021 (the “0110 Appeal) on the grounds that the s. 31(1)(g) exemption was incorrectly applied by the Commissioner in both the Decision Notices. The grounds of appeal and the response[22]The Appellant’s arguments in the Appeals may be summarised as followsa. 0086 Appeal i. A decision had already been made in the ICO’s investigation into the legality of the DVLA’s actions at the time of the request and so the s.31(1)(g) exemption was not engaged; and/or ii. There is a very strong public interest in the public whether the ICO has complied with its statutory duty to enforce data protection law, and the Commissioner erred in holding that the public interest favoured withholding the information requested.b. 0110 Appeal i. The audit that formed the subject of the 0110 Request did not fall within the grounds of s. 31(2)(a) or (c); and/or ii. The Commissioner erred in holding that the public interest favoured withholding the information requested. iii. he does not seek disclosure of any personal information contained in the Reportc. he has received documents pursuant to another decision notice relating to a request he made of the DVLA which demonstrate that the ICO is not performing its statutory functions adequately.[23]The Commissioner submits that s. 31(1)(g) FOIA was correctly applied and also seeks to rely in the 0086 Appeal on s. 42(1) FOIA in respect of some of the information, and in the 0110 Appeal on s. 40(2) FOIA. The Commissioner maintains her position that there would be no real legitimate public interest in the withheld names of DVLA staff members, and therefore disclosure would be unlawful and also unfair. The law[24]Section 1 FOIA sets out the duty on a public authority to communicate information requested of it as follows “(1) Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.” It is to be noted that disclosure made pursuant to s1 FOIA is regarded as made to the world at large and not simply to the requestor. (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.”[25]However, the duty in section 1 does not apply to “exempt information” by virtue of section 2: “(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.[26]Section 31(1)(g) FOIA provides, so far as relevant, that:(1) Information which is not exempt information by virtue of section 30 [investigations and proceedings] is exempt information if its disclosure under this Act would, or would be likely to, prejudice— … (g) the exercise by any public authority of its function for any of the purposes specified under subsection (2) … …(2) The purposes referred to in subsection (1)(g) to (i) are— (a)the purpose of ascertaining whether any person has failed to comply with the law, … (c)the purpose of ascertaining whether circumstances which would justify regulatory action in pursuance of any enactment exist or may arise, ….[27]The test for prejudice is set out in the case of Hogan v Information Commissioner [2011] 1 Info LR 588 at [29]-[30], [34]-[35] and was approved by the Court of Appeal in DWP v Information Commissioner [2017] 1 WLR 1 at [27]). The test involves the following three stepsa. Identifying the “applicable interests” within the relevant exemption that would be prejudiced;b. Considering the “nature of the prejudice” claimed, with a requirement for the party claiming prejudice to demonstrate that there is “some causal relationship” between disclosure of the information and the prejudice claimed and that the prejudice is “real, actual or of substance”; andc. Determining the likelihood that prejudice would occur on disclosure: “the chance of prejudice being suffered should be more than a hypothetical or remote possibility; there must have been a real and significant risk”.[28]The Information Commissioner’s regulatory functions are contained in Articles 57 and 58 of the GDPR (now in the UKGDPR), given effect in the UK via section 115 of the Data Protection Act 2018 (“DPA 2018”) and include conducting investigations and ensuring compliance with the data protection legislation.[29]Section 40 FOIA provides, so far as relevant:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles … (7) In this section— "the data protection principles" means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; "data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); "the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act). (8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”[30]Therefore, where the requested information is not the personal data of the applicant, the information may only be disclosed where disclosure would not contravene the data protection principles. Personal data is defined in section 3 of the DPA 2018 as (2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.[31]Article 5(1)(a) GDPR, provides that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”. In the context of an FOIA request, processing occurs when the personal data are disclosed in response to a request.[32]Article 6(1) GDPR provides the requirements for lawful processing. The most applicable lawful basis is that in Article 6(1)(f) GDPR, which states that data may be lawfully processed where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”[33]Section 42 FOIA provides, so far as relevant: (1) Information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality of communications could be maintained in legal proceedings is exempt information.[34]The High Court has stated at [2009] EWHC 164 (QB) at [47]-[48], that there is a “strong public interest in non-disclosure in-built into legal professional privilege” which must be given “significant weight”.[35]FOIA exemptions must be assessed according to the circumstances at the time of the response to the Request: R (Evans) v Attorney General [2015] UKSC 21, [2015] A.C. 1787 and All Party Parliamentary Group on Extraordinary Rendition (APPGER) v Information Commissioner and Foreign & Commonwealth Office [2015] UKUT 377 (AAC), followed in Maurizi v Information Commissionerand others [2019] UKUT 262 (AAC) at [184].[36]The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows: “If on an appeal under section 57 the Tribunal considers -(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal. On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.” (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, Oral Submissions and evidence[37]As to the facts there was no witness evidence from either party. We have read and considered all of the material placed before us. We were provided with a bundle of authorities and further guidance. We refer in this decision only to those parts of the evidence and bundles that are necessary to our decision making. We have taken a similar approach to the submissions made. Just because a document, or submission is not referred to specifically in this decision does not mean it has not been considered.[38]Mr Williams submitteda. we could infer from the documents that there was no ongoing investigation at the time at which his request was refused in appeal 0086b. the ICO did not deal adequately with the DVLA, and should have used, or threatened to use powers of enforcement and penalty; this goes to the PIBT (Public Interest Balancing Test)c. the correspondence obtained from a request made of the DVLA, demonstrates that there have been a number of complaints as to the lawful basis on which data is being processed by the DVLA, if millions of data subjects have, arguably, had their data unlawfully processed this goes to the PIBT. That situation would be a huge scandal.[39]On behalf of the Commissioner it was submitteda. The decisions of DVLA and the ICO are made according to the differing exemptions applicable to them as a public authority. FOIA may require one public authority to disclose that which another may notb. No proper inference may be drawn from the correspondence produced by the appellant. This is not a hearing about the conduct of the ICO or about delays in any investigationc. The issue is about whether the exemption in section 31 and/or the exemption for legal professional privilege applies to the material requestedd. As to the matters redacted from the audit report the appellant does not seek the personal data therein.e. Appeal 0110 - Disclosure of the requested material would be likely to lead to prejudice and that prejudice would be significant. Disclosure would make public authorities less willing to comply with audits and this would have an adverse effect on the ICO’s ability to perform its regulatory function. The tribunal can read the material that has been withheld and draw its own conclusions.f. Appeal 0086 – receipt of legal advice does not mean the investigation is complete. Legal advice may be taken at other stages. The investigation was ongoing. The tribunal can look at the material and draw its own conclusions.g. Disclosure of the material would prejudice future investigations as data controllers would be less likely to comply if they thought there would be disclosure of information before the completion of the investigation. The material would reveal lines of enquiry which could tip off those being currently investigated or in future.h. Whether or not the ICO has complied with its statutory duties is not something that can be determined before the end of an investigationi. There are no compelling reasons to override the inherently strong public interest in maintaining the exemption from disclosure of legally privileged material. The public interest in the maintenance of the exemption outweighs the public interest in transparency and in knowing whether there is proper application of data protection law.j. It is preferable for a regulator to use powers that do not rely on compulsion. Audits rely on compliance. There is no guarantee that using an enforcement power will capture the information required, their use is a drain on resources and harms the prospect of disclosure[40]Mr Williams submitted in reply thata. The important part of s31(1)(g) is the exercise by a public authority of its functions, the information was not withheld on that basisb. The tribunal had been given no explanation of why disclosing the letters he had obtained from another source would cause damagec. The ICO had last obtained legal advice in December 2019 but it was not clear what they had been doing in the period until June 2020. This goes to the public interest and the issue of whether they were being a responsible regulator. He has had to step into the shoes of the ICO to point out the issues, they should have done what he suggested. Analysis and conclusions[41]The principles to be applied by the tribunal were not in dispute. The parties disagreed on how those principles were properly applied to this case. The focus was on the engagement of the qualified exemption in s31 FOIA and application of the public interest balancing test [“PIBT”].[42]There was no dispute that personal data should not be disclosed. Thus, information that has been identified as personal data within the withheld material in both appeals should not be disclosed.[43]All public authorities subject to FOIA must respond to requests for information with reference to the authority’s specific circumstances, role and responsibilities. ICO guidance may assist in understanding how to apply the law in the circumstances but is not binding, the Upper Tribunal and higher courts’ decisions will clarify the meaning of the law and the factors to take into account but each decision about how to respond to a request made under FOIA will be unique to that public authority in the light of that guidance and binding authority. Thus, the question of whether s31 FOIA is engaged in relation to the same information will necessitate the consideration of different circumstances dependant on the public authority to whom the request has been made. The respondent is correct to point out that the decisions of DVLA and the ICO about Mr Williams’ requests for information have been made according to the differing circumstances and the exemptions applicable to them as a public authority. FOIA may require one public authority to disclose that which another may not.[44]We then turn to consider the material withheld in appeal 0110; the material redacted from the audit report when it was previously disclosed to Mr Williams. We have considered the unredacted version of the withheld material provided to us in the CLOSED material. We would observe, without trespassing on the withheld content of the report, that the vast majority of the audit report was already disclosed to the appellant and it is only a small proportion of the redacted information that is now withheld due to being personal data, we shall term this the “remainder” of the withheld information. Moreover that remainder does not affect the sense or reasons for the conclusions therein which he has seen.[45]Having considered the three step test, as to that remainder of withheld information in appeal 0110 we are satisfied that the exemption in s31 is engaged. We have concluded that disclosure of the “remainder” of the withheld information would be likely to lead to prejudice to the exercise by the ICO of its functions for the purpose of ascertaining whether any person has failed to comply with the law, or is responsible for any conduct which is improper. An audit performed by the regulator upon an organisation that it regulates falls squarely within the parameters of s 31(2)(a) and (c), the conduct of the entity being audited is being scrutinised in order to determine whether they have complied with the law and/or they are responsible for improper conduct and we can see no arguable basis on which it can be suggested otherwise.[46]There is a clear causal relationship between disclosure and prejudice in these circumstances. We have decided that the prejudice to the interests of the ICO would be significant. Disclosure would make public authorities less willing to comply with audits and this would have an adverse effect on the ICO’s ability to perform its regulatory function which relies on a regulator’s ability to engage effectively with those it regulates in a constructive and collaborative way. If those who the ICO regulate are concerned that the information they provide will be made public prematurely or inappropriately they will be more reluctant to provide information. Disclosure of the information would be likely to have the effect of fewer data controllers agreeing to such audits or in voluntarily providing relevant information. These are real and not hypothetical risks.[47]In this case we have concluded that the public interest factors in disclosing the information are as followsa. Disclosure would help to demonstrate that the ICO is complying with its duties by overseeing the performance of organisations.b. Increased transparency in the data protection practices and measures in place at individual organisations.[48]The factors in favour of maintaining the exemption and withholding the information are as followsa. The public interest in ensuring that organisations are not deterred or inhibited from participating fully and candidly with the auditing process,b. Ensuring that the ICO is able to have effective and productive relationships with the organisations they regulate and that the regulated entities continue to engage with the ICO in an open, cooperative and collaborative way without fear that information provided to the ICO will be made public prematurely or, as appropriate, at all.c. There is a public interest in the ICO not disclosing the measures that organisations have in place regarding their data protection practices where such a disclosure could undermine the effectiveness of those measures.[49]We have concluded having considered all of the evidence and submissions that the public interest in maintaining the exemption as regards the remainder of the information in appeal 0110 outweighs the public interest in disclosing it.[50]Turning to appeal 0086, the heart of the dispute in that appeal, is about the legal advice that forms part of the withheld material in this case.[51]An investigation to ascertain whether a data controller is in breach of the GDPR should not be rushed. The serious potential consequences for a data controller of an adverse conclusion means that any regulator should ensure that their investigation is thorough albeit it should not be allowed to drift. We recognise that such investigations will include not only the investigation into the facts but also a consideration of the appropriate regulatory response. In this case the investigation in issue was complicated by a new statute, DPA18 and the GDPR. These were significant changes in the law and in our view it is right for the ICO, as regulator, in these circumstances to have taken time to consider whether any view they previously held remained valid in the context of the new legislative framework which included new regulatory enforcement tools.[52]In submissions we noted that Mr Williams expressed his views of what should have been done, or how the ICO should have approached an issue. The ICO is the regulator tasked by Parliament to perform the functions given by statute. Whether they could have or should have undertaken those functions differently or more swiftly is not a question for us in this appeal. We find that the ICO investigation was still ongoing at the time of their response to the request; we draw that conclusion from all the documents we have seen.[53]We have considered whether the letters produced by Mr Williams assist us in our decision making. Theses are the documents he obtained from the DVLA. Mr Williams’ submission that the correspondence demonstrates that there have been a “number of casework complaints” made to the ICO as to the lawful basis on which data is being processed by the DVLA, is a correct interpretation of the ICO letter (undated but clearly from June 2019), addressed to the Head of Data Protection Policy at the DVLA. The letter says so in the third paragraph of page 2 but that letter goes on to make clear that those complaints had not yet been investigated. The response to the ICO is a detailed explanation of the DVLA position.[54]Mr Williams may not agree with that position but these pieces of correspondence do not permit an inference that millions of data subjects have had their data unlawfully processed. He is quite right that such a situation would be a cause for concern but it is not for us to determine whether or not such unlawful processing is or was happening. The letters show that in the middle of 2019 the investigation was not concluded and indeed the complaints received had not been considered by the ICO. This is consistent with our reading of the documents and conclusion that the investigation was ongoing at the time of the request.[55]The letters were obtained as a result of a FOIA request to the DVLA but as we have pointed out in this decision, FOIA must be applied to each request by each public authority. The release by the DVLA says nothing about factors to be considered in this case or the interests of the ICO as they arise under s31. The fact that Mr Williams has obtained them is irrelevant to our decision making.[56]We agree with the Commissioner that receipt of legal advice does not mean an investigation is complete. Legal advice may be taken at other stages of an inquiry; a regulator would be wise to do so where the law is complex, in transition, and to take account of developments in their investigation.[57]Having considered the withheld material in 0086 and all the submissions in that regard and applied the three step test, we have concluded that the exemption in s31 is engaged. Disclosure of the withheld information would be likely to lead to prejudice to the exercise by the ICO of its functions for the purpose of ascertaining whether any person has failed to comply with the law, or is responsible for any conduct which is improper. The prejudice caused would be directly related to the disclosure. It would be likely to prejudice future ICO investigations and that prejudice would be significant as data controllers would be less likely to comply if they thought there would be disclosure of information before the completion of the investigation. In response to the Tribunal’s question as to why voluntary compliance mattered given that the Information Commissioner has enforcement powers, the response to the question identified thata. Enforcement powers are time consuming to apply and not as efficient as voluntary compliance;b. The fallibility of enforcement powers, e.g. failure caused by a flaw in the process;c. Costs involved in pursuing enforcement powers have a public interest impact. Furthermore, the material would reveal lines of enquiry and ways of working which could “tip off”, or be useful to, those being currently investigated or in future. This would reduce the efficacy of the ICO as a regulator. These are real and not hypothetical or improbable risks.[58]In this appeal the public interest factors in favour of disclosing the information are as followsa. Increased transparency in the way in which the ICO carries out its regulatory functionsb. The interests of those members of the public who feel aggrieved by the sharing of personal data by the DVLA.[59]The public interest factors in maintaining the exemption are as followsa. disclosing information while regulatory action is ongoing would be likely to compromise the ICO’s ability to conduct future investigations and therefore affect the discharge of their regulatory function, including the ability to influence the behaviour of data controllers and to take formal action;b. there is a public interest in the ICO being able to maintain effective and productive relationships with the parties they communicate with so that organisations continue to engage with the ICO in a constructive and collaborative way without fear that the information they provide us will be made public should it be inappropriate to do so;c. there is a public interest in the ICO maintaining its ability to conduct its regulatory activities without external interference.[60]Having considered all of these factors we have taken the decision that in appeal 0086, the public interest in maintaining the exemption (ie withholding the information) outweighs the public interest in disclosing it, and the information is exempt from disclosure under s31(1)(g) FOIA.[61]Furthermore, although in the light of our decision above, we need not go on to decide any other matters such as the engagement of other exemptions, but we would observe that in this case it is clear to us that s. 42(1) FOIA is engaged in respect of some of the withheld information and there are no compelling reasons to override the inherently strong public interest in maintaining the exemption from disclosure of legally privileged material. The public interest in the maintenance of the exemption outweighs the public interest in transparency.[62]For the reasons set out above we dismiss both these appeals. Signed Judge Lynn Griffin Date: 7 March 2023 Corrected by Judge Griffin due to an accidental omission, rule 40 on 16 March 2023