Martin Shipton v The Information Commissioner & Anor [2023] UKFTT 77 (GRC)

Case Reference: EA/2022/0060[2023] UKFTT 00077 (GRC)
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 8 November 2022Date 20 January 2023
Information Rights
Heard by: determination on the papers
Before
TRIBUNAL JUDGE STEPHEN ROPERTRIBUNAL MEMBER JO MURPHYTRIBUNAL MEMBER MARION SAUNDERS
Between
MARTIN SHIPTONAppellantTHE INFORMATION COMMISSIONERRespondentSENEDD CYMRURespondentDecision: The appeal is DismissedREASONS

Preliminary matters

[1]In this decision, we use the following abbreviations to denote the meanings shown: Balancing Test: The last question of the Legitimate Interests Test, as referred to in paragraph 70. Commissioner: The Information Commissioner. DPA: The Data Protection Act 2018. Decision Notice: The Decision Notice of the Information Commissioner dated 10 February 2022, reference IC-109832-Z6G1, relating to the Request. FOIA: The Freedom of Information Act 2000. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f) of the UK GDPR, as set out in paragraph 64. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 69. Measure: The National Assembly for Wales Commissioner for Standards Measure 2009. Request: The request for information under FOIA made by the Appellant dated 29 January 2021, as referred to in paragraph 9. Requested Information: The information which was requested by way of the Request. Senedd: Senedd Cymru (Welsh Parliament). Standards Commissioner: The Senedd Commissioner for Standards, established by section 1 of the Measure. Standards Regime: The regime referred to in paragraph 37. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.[2]We refer to the Commissioner as ‘he’ and ‘his’ to reflect the fact that the Information Commissioner was John Edwards at the date of the Decision Notice, whilst acknowledging that the Information Commissioner was Elizabeth Denham CBE at the date of the Request and the date of the Appellant’s subsequent complaint to the Commissioner.[3]Unless the context otherwise requires (or as otherwise expressly stated), references to numbered paragraphs are to paragraphs of this decision so numbered.

Introduction

[4]This is an appeal against the Decision Notice, which held that section 40(2) of FOIA was engaged in respect of the Request and that, applying the exemption under that section, the Senedd was not required to provide to the Appellant the Requested Information.[5]The Decision Notice did not require the Senedd to take any steps.

Mode of Hearing

[6]The Appellant and the Commissioner consented to this appeal being determined by the Tribunal without a hearing. The Second Respondent stated that it was “essentially neutral” as to whether or not the appeal was held without a hearing and, whilst initially reserving its position regarding an application for an oral hearing (and potential additional submissions), ultimately made no such application and accordingly did not object to this appeal being determined without a hearing.[7]The Tribunal considered that this matter was suitable for determination on the papers in accordance with rule 32 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 and was satisfied that it was fair and just to conduct the hearing in this way.

Background to the appeal

[8]The background to this appeal is as follows.

The Request

[9]On 29 January 2021, the Appellant sent an email to the Senedd, requesting information in the following terms:
“In the light of various Freedom of Information requests and information coming from inside the Conservative group, did Commission staff investigate allegations that Julia Davies, employed as personal assistant to her husband Andrew RT Davies MS, did little or no work for him? If so I seek disclosure of the relevant reports. Was the matter referred to the Standards Commissioner? If so, I seek disclosure of the relevant correspondence between the Commission and the Standards Commissioner. Anticipating that the Commission will apply a public interest test, I would argue that this is a matter of strong public interest - even more so given Mr Davies' recent return to the role of group leader.”
.

The Senedd’s reply and subsequent review

[10]The Senedd responded by email on 17 February 2021, refusing to provide the Requested Information, stating: “Both parts to your request relate to the employment of a named individual. In our view, a disclosure of the requested information would contravene the first data protection principle as set out in Article 5 of the UK GDPR. As such, it is exempt from disclosure under section 40(2) and section 40(3A)(a) of the Freedom of Information Act 2000 (“FOIA 2000”).”.[11]Further information and explanations were also provided by the Senedd by way of an annex to that response.[12]The Appellant contacted the Senedd by email on 18 February 2021 requesting an internal review of the Senedd’s response.[13]Following an internal review, the Senedd sent an email to the Appellant on 9 April 2021, maintaining its previous position regarding the Request.[14]The Appellant contacted the Commissioner on 30 May 2021 to complain about the Senedd’s response to the Request and setting out further background information to the Request. The Appellant disagreed with the Senedd’s refusal to provide the Requested Information. He considered that the Senedd had incorrectly applied what he referred to as “the ‘legitimate interests’ test” in withholding the Requested Information and stated, amongst other things, that the focus of the Request was the conduct of Mr Davies, not that of Mrs Davies. The Appellant also set out his views on ‘legitimate interests’, referring to the Commissioner’s guidance, and why he considered that the Requested Information should be disclosed.

The Decision Notice

[15]In investigating the complaint made by the Appellant, the Commissioner wrote to the Senedd on 7 December 2021 requesting (amongst other things) information relating to the Senedd’s application, in connection with its response to the Request, of section 40(2) of FOIA and the Legitimate Interests Test. The Senedd responded on 21 January 2022 maintaining its position with respect to the application of section 40(2) of FOIA but also citing section 31 of FOIA (law enforcement) and section 41 of FOIA (information provided in confidence) as applicable exemptions.[16]In connection with the Commissioner’s ongoing investigation, the Senedd subsequently provided to the Commissioner a copy of the withheld information relating to the Request.[17]Following his investigations, the Commissioner decided, by way of the Decision Notice, that section 40(2) of FOIA applied to the Requested Information and accordingly that the Senedd was entitled to withhold the Requested Information.[18]Given that decision, the Commissioner did not go on to address in the Decision Notice the potential application of the exemptions in section 31 of FOIA or section 41 of FOIA which had also been cited by the Senedd.

The appeal

[19]The Decision Notice was given in response to the Appellant’s complaint made under section 50 of FOIA relating to the Request. This is an appeal against the Decision Notice made by the Appellant pursuant to section 57 of FOIA.[20]We consider that it is important to stress what is outside of the scope of this appeal. This appeal is not about the merits, effectiveness or operation of the Standards Regime, nor is it about any compliance with, or appropriate implementation of, the Standards Regime - whether with regard to Mr Davies, Mrs Davies or otherwise. The Tribunal has no power to determine those issues and nothing we say should be interpreted as an expression of opinion on any of those issues. The remit of the Tribunal is limited to that set out in section 58 of FOIA, having regard to the applicable law (as we explain below).[21]In its response to the appeal, the Second Respondent invited the Tribunal to “clearly demark the boundary between Senedd Cymru and the Commissioner for Standards; and to accurately reflect the standards regime in its determination”. For the reasons we have given, these matters are not within the Tribunal’s jurisdiction. For clarity, the role and powers which the Tribunal has in this appeal are as set out below and the Tribunal has no further powers for the purposes of this appeal and this decision.

The grounds of appeal

[22]Whilst acknowledging all of the contents of the Appellant’s grounds of appeal, we consider that, for current purposes, they can fairly be summarised as follows.[23]The Appellant stated that he considered that the Commissioner (as well as the Senedd) adopted the wrong approach to the Request. He stated that the Request followed statements made by a number of individuals who had worked for Mr Davies and/or the Welsh Conservative Party to the effect that Mrs Davies had done little or no work for the salary she was paid. The Appellant’s view is that it is the conduct of Mr Davies which is being scrutinised, not that of Mrs Davies. He states that “the area of concern and public interest lies not the personnel record of Mrs Davies, but in the issue that prompted the chief executive of Senedd Cymru to refer the matter to the Senedd’s then Standards Commissioner”.[24]The Appellant asserted that the issue of employing relatives of the Senedd’s Members has been a matter of controversy for years and that “any suggestion that a family member is not expected to undertake the duties they are employed to fulfil deserves the utmost scrutiny”. He expressed concern regarding the investigations which were undertaken after the referral of the matter in question to the Standards Commissioner. The Appellant also suggested that further investigations were not undertaken after a number of individuals loyal to Mr Davies denied that Mrs Davies had done little or no work whilst employed by Mr Davies.[25]In essence, the Appellant’s position is that the reason for the Request was to ensure that there is public scrutiny of the allegations relating to Mrs Davies’ employment by Mr Davies. The Appellant believes that there is a strong public interest case for releasing the reports of the investigations undertaken by the Senedd’s officials. He stated that the Decision Notice, in upholding the Senedd’s decision to withhold the Requested Information: “effectively means that an elected Member [of the Senedd] is completely protected and prevents any wrongdoing from being uncovered”.[26]As noted above, the Commissioner did not address the potential application of the exemptions in section 31 or 41 of FOIA in the Decision Notice. The Appellant likewise did not address those exemptions in his grounds of appeal.[27]We should also note that, whilst this was not expressly stated in the Appellant’s grounds of appeal, we consider that all of those grounds relate to the premise that, in his view, the Decision Notice was wrong in law.

The Commissioner’s response

[28]We do not set out here full details of the Commissioner’s response to the appeal, whilst acknowledging all of its contents.[29]Fundamentally, the Commissioner’s view is that the Appellant’s grounds of appeal:a. fail to address why the Decision Notice was not in accordance with the law, or that the Commissioner ought to have exercised his discretion differently; andb. do not contain any new arguments which were not previously addressed in the Decision Notice (or the Commissioner's prior investigation).[30]The Commissioner’s response sets out his views on the applicable law, including the exemptions for disclosure of information under FOIA which relate to personal data. The Commissioner explained in his response that:a. he formed the view (as reflected in the Decision Notice) that the Requested Information constituted the personal data of both Mr Davies and Mrs Davies; andb. having formed that view, he then considered whether the disclosure of that personal data would breach any of the data protection principles.[31]On the latter point, the Commissioner addressed the data protection principle set out in Article 5(1)(a) of the UK GDPR, relating to (amongst other things) personal data being processed lawfully. In considering the lawfulness of processing personal data in connection with the Request, the Commissioner’s position is that the most applicable lawful basis is the Legitimate Interests Basis. The Commissioner stated that he applied the Legitimate Interests Test, as referred to in the Decision Notice.[32]The Commissioner stated that his conclusions were (as set out in the Decision Notice) that there was a legitimate interest which would be served by the disclosure of the Requested Information and that this legitimate interest could not be met by less intrusive means. However, when considering whether the legitimate interest in disclosure of the Requested Information outweighed the interests or fundamental rights and freedoms of Mr Davies and Mrs Davies, the Commissioner found that, balancing the arguments put forward by the Senedd and the information provided by the Appellant, there was insufficient legitimate interest to outweigh those fundamental rights and freedoms.[33]The Commissioner considered that the Appellant’s grounds of appeal could be summarised as arguing that the Decision Notice “incorrectly balancedthe legitimate interests and the data subjects’ interests or fundamental rights and freedoms”. In addressing the Appellant's grounds of appeal, the Commissioner reinforced the reasoning in the Decision Notice and set out further details in support of why he considered that position to be correct.[34]In essence, the Commissioner’s view is that he was correct in his assessment of the law and in his application of the Legitimate Interests Test and rightly reached the conclusion that disclosure of the Requested Information would be unlawful. Accordingly, the Commissioner’s position is that the Decision Notice was in accordance with the law in concluding that the Senedd correctly applied section 40(2) of FOIA in refusing to disclose the Requested Information.[35]As we have mentioned, the Decision Notice did not address the potential applicability of sections 31 and 41 of FOIA and these are not raised by the Appellant in his grounds of appeal. The Commissioner made no further submissions in respect of those sections in his response to the appeal.

The Second Respondent’s response

[36]Again, we do not set out here full details of the Second Respondent’s response to the appeal, whilst acknowledging all of its contents.[37]The Second Respondent’s response to the appeal set out information regarding the Standards Commissioner and the applicable regime (which includes the associated functions of the Standards Commissioner) for, amongst other things, investigating and reporting on misconduct or alleged misconduct of Members of the Senedd. The Second Respondent stated that such regime is as set out in the Measure, together with the rules and procedures adopted by the Senedd under its Standing Orders pursuant to section 10(1)(b) of the Measure.[38]The Second Respondent also provided information about the relevant elements of the Standards Regime regarding the duties of the Clerk of the Senedd to communicate suspicions of certain potential misconduct to the Standards Commissioner and the subsequent duty of the Standards Commissioner to treat such communication as a complaint for the purposes of the applicable provisions of the Measure.[39]The Second Respondent considered that the Commissioner arrived at the correct conclusion in the Decision Notice but that he erred in some of his reasoning. The Second Respondent made submissions regarding the detail of the Commissioner’s analysis, which generally relate to the Second Respondent’s views that the Commissioner had made errors regarding his consideration of the Standards Regime and the hierarchical status of Members of the Senedd.[40]As noted, the potential applicability of sections 31 and 41 of FOIA are not raised by the Appellant in his grounds of appeal or in the Commissioner’s response to the appeal. Likewise, the Second Respondent made no further submissions in respect of those sections in its response to the appeal, save that it considered them to not be in dispute and it maintained that they provide further or alternative grounds for withholding the Requested Information.[41]Amongst other things, the Second Respondent considered that the Appellant’s grounds of appeal appeared to have placed some reliance upon his views that investigations into Mr Davies were carried out by senior officials at the Senedd. Referring to the Standards Regime, the Second Respondent asserted that no formal investigation was conducted by the Senedd. The Second Respondent also denied the Appellant’s allegation to the effect that the Standards Commissioner did not launch a formal investigation into the complaint regarding Mr Davies but decided not to take matters forward, stating instead that the Standards Commissioner investigated the complaint and summarily dismissed it pursuant to the Standards Regime.[42]The Second Respondent adopted the views set out in the Commissioner’s response as to the applicable law, save that the Second Respondent made certain submissions regarding:a. the application of the ‘necessity’ element of the Legitimate Interests Test (which in turn related to the Second Respondent’s views on certain positions adopted by the Commissioner, including with regard to his consideration of the Standards Regime and the hierarchical status of Members of the Senedd); andb. the application of the Balancing Test.[43]Whilst the Second Respondent’s position on the former of those two issues differs to that adopted by the Commissioner, the Second Respondent essentially put these submissions forward as alternative or additional grounds for determining that the Decision Notice was correct to conclude that the Requested Information should be withheld.

The Appellant’s reply to the Commissioner’s response

[44]In his reply to the Commissioner’s response, the Appellant accepted that it is necessary to apply the Legitimate Interests Test. He noted that the Commissioner determined that both the ‘legitimate interest’ element and the ‘necessity’ element of the Legitimate Interests Test were satisfied with regard to the Request. The Appellant submitted that the Commissioner correctly interpreted the law until the Balancing Test, at which point (in the Appellant’s view) the Commissioner arrived at the wrong conclusion. The Appellant contended that the conclusion of the Balancing Test should have resulted in favour of disclosure, on the basis that the “legitimate public interest” outweighs the fundamental rights and freedoms of Mr Davies and Mrs Davies as data subjects.[45]Accordingly, the Appellant considers that the question to be determined by the Tribunal is whether or not the Commissioner erred in concluding that a correct application of the Balancing Test would result in non-disclosure of the Requested Information.[46]We acknowledge all of the specific points made by the Appellant in this regard. In summary, though, his views as to why the application of the Balancing Test should have led to a conclusion favouring disclosure of the Requested Information included the following:a. the documents requested were written by officials of the Senedd and related to the allegations referred to above in respect of the employment by Mr Davies of his wife and the referral and investigation which the Appellant believes took place in respect of such allegations;b. such investigation was prompted by standards concerns relating to Mr Davies, rather than other concerns relating to Mrs Davies;c. Mrs Davies was, however, “no ordinary employee” of the Senedd and, as the wife of a senior elected politician who employed her (and her work being “unmediated by any input from officials” of the Senedd), she accordingly would not be entitled to confidentiality;d. in contrast to the arguments of the Commissioner that the personal data of Mr Davies and Mrs Davies being ‘inextricably linked’ supports the case for non-disclosure, the fact that the allegations involved mean that their personal data will inevitably be linked provides a compelling argument for disclosure and “the proper scrutiny of Mr Davies’ conduct would be fatally compromised” without such disclosure;e. there is an overwhelming public interest case for publishing the Requested Information and the public have a right to know what conclusion officials of the Senedd came to after its investigation;f. the Commissioner was influenced unduly by concerns regarding the expectations that both Mr Davies and Mrs Davies would have a reasonable expectation of privacy and their assertions that disclosure would cause them both significant distress and instead the Commissioner should have recognised “the major public interestin holding a leading politician to account”; andg. there has already been significant publicity relating to concerns about Mr Davies’ employment of Mrs Davies and any distress caused to them by publication of the Requested Information would relate to criticism of Mr Davies’ conduct by those who undertook the inquiry; consequently, a concern around any distress that disclosure may cause to either of them is not a legitimate reason to resist disclosure of such information.

The Appellant’s reply to the Second Respondent’s response

[47]In his reply to the Second Respondent’s response, the Appellant submitted that the Second Respondent wrongly applied sections of FOIA. In addressing the submission made by the Second Respondent that the potential application of sections 31 and 41 of FOIA was not in dispute, the Appellant asserted that this was not the case and that he considered that the Second Respondent had misapplied those sections.[48]The Appellant also submitted that the Second Respondent had misconstrued the nature of the inquiry undertaken by “Senedd Cymru’s own officials” into concerns relating to the employment by Mr Davies of his wife. The Appellant’s view was that “the information gathered during the course of that inquiry most certainly constituted an investigation” and that such investigation was a fact-finding exercise and was strongly in the public interest. He expanded on those views regarding the basis and purpose of such an investigation and his opinion as to why such information should be in the public domain, arguing that the content and conclusions of such investigation should be disclosed because the actions of politicians like Mr Davies ought to be open to public scrutiny in a democratic society.[49]Whilst we acknowledge all of the specific points made by the Appellant in his reply to the Second Respondent’s response, his additional submissions included (in summary) the following:a. the content and conclusions of the investigation should be viewed as discrete and consequently should be disclosable;b. the content and conclusions of the investigation do not prejudice law enforcement (such that section 31 of FOIA cannot apply) and do not relate to information provided in confidence (such that section 41 of FOIA cannot apply), including because the decision to make them the basis of a complaint to the Standards Commissioner came later, after due consideration of what had been established during the investigation;c. the Second Respondent was wrong to assume that all documentation relating to the investigation was an ‘integral part of the Standards Commissioner’s complaints process’ and accordingly was not disclosable;d. the fact that the complaint was dismissed should have no bearing on the case for disclosing, as a matter of public interest, the result of investigations which were carried out by officials of the Senedd before the complaint was made;e. the Second Respondent erroneously relied on certain case law which is irrelevant to this appeal, including because the publication of ‘something less’ (namely, for the purposes of this case, the Standards Regime) would not permit the level of direct scrutiny appropriate in the circumstances particular to this appeal;f. the Second Respondent was wrong to assert that the seniority in status of Mr Davies had no bearing on the subject matter of this appeal; rather, a higher standard of integrity applies to senior politicians and, accordingly, there is a greater public interest in disclosing evidence of potential misconduct; andg. it was wrong for the Senedd to resist disclosure of the Requested Information and disclosure should be allowed having regard to principles of democracy and transparency.[50]We also note that the Appellant considered that the Second Respondent had argued, in its response, that the Commissioner had erred in not considering the exemptions set out in sections 31 and 41 of FOIA. However, in our view, that was not the position of the Second Respondent in its response but rather that the Second Respondent recognised that the Commissioner had not addressed those sections in the Decision Notice and that they had not been raised in the grounds of appeal, but that the Second Respondent nevertheless considered them to be potential further exemptions which could apply such that the Requested Information can be withheld. We acknowledge, though, that the Appellant has nevertheless addressed those issues in his reply.

The Tribunal’s powers and role

[51]The powers of the Tribunal in determining this appeal are set out in section 58 of FOIA, as follows:
“(1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.”
[52]For the purposes of this appeal, therefore, the Tribunal’s remit is to consider whether the Decision Notice was in accordance with the law, or whether any applicable exercise of discretion by the Commissioner in respect of the Decision Notice should have been exercised differently. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts.[53]Accordingly, the primary issue for the Tribunal to determine in this appeal is essentially whether or not the Commissioner was correct to decide, by way of the Decision Notice, that section 40(2) of FOIA applied to the Requested Information. If we determine that his decision was incorrect, then we will need to go on to determine whether or not section 31 of FOIA or section 41 of FOIA are applicable exemptions which would apply to the Requested Information.[54]We note that the Second Respondent, in its response to the appeal, referred to the possibility of the Tribunal remitting back to the Commissioner issues regarding sections 31 or 41 of FOIA if necessary. This is not within the Tribunal’s powers; the role of the Tribunal is to make any relevant determinations itself (not to refer matters back to the Commissioner for determination). The law The statutory framework[55]Section 1(1) of FOIA provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[56]Accordingly, under section 1(1) of FOIA, a person who has made a request to a ‘public authority’ (such as the Senedd) for information is entitled to be informed in writing whether it holds the information requested. If the public authority does hold the information, that person is entitled to have that information communicated to him. However, these entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) of FOIA provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[57]It is therefore important to note that section 1(1) of FOIA does not provide an unconditional right of access to any information which a public authority does hold. The right of access to information contained in that section is subject to certain other provisions of FOIA.[58]Section 2(2) of FOIA is applicable for the purposes of this appeal, as a potential exemption to the duty to provide information pursuant to section 1(1)(b) of FOIA. Section 2(2) of FOIA provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[59]The effect of the above is that some exemptions set out in Part II of FOIA are absolute and some are subject to the application of section 2(2)(b) of FOIA, which is often known as the ‘public interest test’. Where an applicable exemption is not absolute and the ‘public interest test’ applies, this means that a public authority may only withhold requested information under that exemption if the public interest in doing so outweighs the public interest in disclosure.[60]Section 2(3) of FOIA explicitly sets out which exemptions in Part II of FOIA are absolute. That section provides, so far as is relevant for the purposes of this appeal: “For the purposes of this section, the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption— …(fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied, (g) section 41”.[61]Accordingly, in summary, the relevant exemptions to the duty to disclose information are as follows:a. section 40(2) of FOIA is an absolute exemption only in cases where a specific condition is satisfied (as referred to below) - otherwise the exemption is subject to the ‘public interest test’;b. section 31 of FOIA (which is not specified in section 2(3) of FOIA) is an exemption which is subject to the ‘public interest test’; andc. section 41 of FOIA is an absolute exemption.[62]So far as is relevant for the purposes of this appeal, section 40 of FOIA provides: “(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles…”.[63]Section 40(7) of FOIA sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA;b. the “data protection principles” are those set out in Article 5(1) of the UK GDPR, and section 34(1) of the DPA. The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”; andc. a “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”.[64]To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f) of the UK GDPR).[65]Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information by a public authority under FOIA.[66]The first recital to the UK GDPR is also relevant. This provides:
“The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.”
. The second recital to the UK GDPR also includes the following: “The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”.[67]So far as is relevant for the purposes of this appeal, section 31 of FOIA provides: “(1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— …(g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2), (2) The purposes referred to in subsection (1)(g) to (i) are— (a) the purpose of ascertaining whether any person has failed to comply with the law, (b) the purpose of ascertaining whether any person is responsible for any conduct which is improper, (c) the purpose of ascertaining whether circumstances which would justify regulatory action in pursuance of any enactment exist or may arise, (3) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would, or would be likely to, prejudice any of the matters mentioned in subsection (1).”.[68]Section 41 of FOIA provides:
“(1) Information is exempt information if— (a) it was obtained by the public authority from any other person (including another public authority), and (b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person. (2) The duty to confirm or deny does not arise if, or to the extent that, the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) constitute an actionable breach of confidence.”
.

Case law

[69]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner ([2013] UKSC 55 [paragraph 18]): “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[70]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last question of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[71]The approach set out above in the South Lanarkshire case was subsequently reiterated in the Upper Tribunal in the case of Goldsmith International Business School v Information Commissioner and Home Office ([2014] UKAT 563). In the Goldsmith case, Upper Tribunal Judge Wikeley also provided further helpful guidance relevant to this appeal, setting out various propositions derived from the relevant case law. We refer to those propositions in more detail below.[72]As the Appellant referred to the ‘public interest test’ in the Request, we should make it clear that the relevant test is not the ‘public interest test’ as it arises under section 2(2)(b) of FOIA, but rather the Legitimate Interests Test - and these tests are different. As explained by Upper Tribunal Judge Kate Markus QC (now KC) in the case of Information Commissioner v Halpin ([2019] UKUT 29 [paragraph 29]):
“At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”
. FOIA creates a general right to information subject to the exemptions in section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”” “…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.””

Evidence

[73]The Tribunal read and took account of an open bundle of evidence and pleadings comprising a total of 230 pages (including cover sheets and index pages). The Tribunal also read and took account of a closed bundle comprising a total of 147 pages (including cover sheets and index pages). The closed bundle contained various additional material which was excluded from the open bundle, as well as some unredacted material which had been redacted in the open bundle. Discussion and conclusions Outline of relevant issues

Discussion and conclusions

[74]We start by reminding ourselves that, as noted above, the primary issue for the Tribunal to determine in this appeal is essentially whether or not the Commissioner was correct to decide, by way of the Decision Notice, that section 40(2) of FOIA applied to the Requested Information. Only if we determine that his decision was incorrect in that regard will we need to go on to consider sections 31 and 41 of FOIA.[75]It may also be helpful to reiterate the Legitimate Interests Basis. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
. Translating that language to the context of this appeal: a. the disclosure of the Requested Information would be ‘processing’; b. the Appellant is the ‘third party’; and c. Mr Davies and Mrs Davies (as the individuals about whom the Appellant has sought information by way of the Request) are the ‘data subjects’.[76]It is common ground between the parties that:a. the Request does relate to the personal data of Mr Davies and Mr Davies (albeit the Appellant contended that the main purpose of the Request was to obtain information relevant to Mr Davies only) and consequently that this does engage section 40(2) of FOIA;b. the most relevant data protection principle is that set out in Article 5(1)(a) of the UK GDPR, relating to (amongst other things) personal data being processed lawfully;c. in considering whether the processing of the personal data in question is lawful, the most applicable lawful basis for processing is the Legitimate Interests Basis; andd. the Legitimate Interests Test is applicable.[77]Where the parties’ positions differ is in respect of the manner and outcome of the application of the Legitimate Interests Test. In summary, the Second Respondent considers that the Commissioner, in the Decision Notice, arrived at the correct final conclusion in his application of the Legitimate Interests Test (in deciding that the Requested Information should be withheld) but that he erred in some of his reasoning regarding the application of the Legitimate Interests Test. In particular, the Second Respondent considers that disclosure of personal data was not necessary to meet the Appellant’s legitimate interests (given the existence of the Standards Regime) and accordingly that the Balancing Test should not have been engaged. In contrast, the Appellant considers (in summary) that the Commissioner was correct to apply the Balancing Test but wrongly concluded that there was insufficient legitimate interest to outweigh the fundamental rights and freedoms of Mr Davies and Mrs Davies.[78]We should also mention at this point that, whilst the Appellant referred to the ‘public interest test’ in the Request, he has accepted (as noted in paragraph 44) that it is instead the Legitimate Interests Test which is applicable for the purposes of this appeal.[79]We also observe in passing that some of the documentation in the closed bundle was not personal data relating to either Mr Davies or Mrs Davies (but to third parties) and some was information which was already in the public domain (such as press articles written by Mr Davies). It has also not been necessary for us to address issues relating to the personal data of third parties, given our comments below. Also, in some instances, the documentation was additional material which we consider to be outside of the scope of the Request and therefore we have not needed to address any issues regarding that additional material. Application of

The law

[80]Given the legal framework which we have outlined above, we consider that it is helpful to address the propositions from the Goldsmith case which we briefly noted above. As mentioned, in that case Upper Tribunal Judge Wikeley listed (from paragraph 35 onwards) various propositions derived from case law as to the correct approach to be adopted. We set out seven of those propositions below (some of which we paraphrase or otherwise summarise) and we address each in turn with regard to the facts of this appeal. For completeness, we should mention that Judge Wikeley also referred to an eighth Proposition in the Goldsmith case, but this related to tests which were applied in relevant case law and which does not alter the other seven propositions we refer to.[81]Applying the propositions is not a sequential process, in that some later numbered propositions need to be considered and determined before returning to earlier numbered propositions. Moreover, some earlier numbered propositions may be superfluous after applying later numbered propositions.[82]Proposition 1: The three questions set out in the South Lanarkshire case (as we have addressed above – namely, the Legitimate Interests Test) must be applied. Consequently:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? In this case, it would be the Appellant to whom the relevant personal data are disclosed. The Appellant’s aim in seeking the Requested Information is, in essence, to ensure that alleged wrongdoing of Senedd Members is independently investigated and that there is accountability where appropriate. We agree with the Commissioner that such aim is legitimate and hence that there are legitimate interests being pursued by the Appellant by way of the Request.b. Is the processing involved necessary for the purposes of those interests? In order to address this, we need to turn to Propositions 3 to 5 (inclusive), which we do below.c. Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? Given Proposition 2, we do not address this question at this stage, but comment on this later.[83]Proposition 2: The test of “necessity” under the second of those questions must be met before the third question can be considered. Again, this requires us to turn to Propositions 3 to 5 (inclusive).[84]Propositions 3 to 5 (inclusive) all relate to the concept of ‘necessity’ and so we group them together before commenting on them:a. Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity.b. Proposition 4: It follows that the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality (albeit this may not add much to the ordinary English meaning of ‘necessity’).c. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.[85]With regard to those three propositions, we note that Lady Hale, in the South Lanarkshire case, stated that the word “necessary” must be considered in relation to the processing to which it relates.[86]We also note that, in the Halpin case, Upper Tribunal Judge Kate Markus QC (now KC) stated that: “the Goldsmith guidance…makes it clear that the question whether there are alternative measures (proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it…” [paragraph 31]. In the more recent case of Kol v Information Commissioner and Reigate and Banstead Borough Council ([2022] UKUT 74), Upper Tribunal Judge Edward Jacobs stated: “If there is another way of satisfying [the requestor’s] legitimate interests without disclosing the information, then disclosure is not necessary” [paragraph 22].[87]It is helpful to remind ourselves of the relevant wording from Lady Hale’s judgment in the South Lanarkshire case, in respect of which Upper Tribunal Judge Edward Jacobs was commenting and which is the authoritative decision on the meaning of ‘necessary’ for current purposes: “It is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15, [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.” [paragraph 27].[88]We consider that these principles (together with others from additional cases cited in the Goldsmith case) are encapsulated in the three propositions (namely, Propositions 3, 4 and 5). In our view, therefore (and taking into account the above comments of Upper Tribunal Judge Kate Markus KC in the Halpin case), we need to consider all three of those propositions in assessing whether or not the processing (disclosure) of the personal data of Mr Davies and Mrs Davies was necessary for the purposes of the legitimate interests being pursued by the Appellant by way of the Request.[89]As noted, the legitimate interests being pursued by the Appellant are, essentially, for alleged wrongdoing of Senedd Members to be independently investigated and for there to be accountability where appropriate. In the facts of the current case, we find that it is not necessary (within the meaning outlined in all three of those propositions) for the personal data in question to be disclosed in order to achieve those legitimate interests. In our view, those legitimate interests are fulfilled by the existence of the Standards Regime. Given that the legislature has established the Standards Regime, whichplainlyis fundamentally designed toachievethose legitimate interests, we are satisfied that the Standards Regime provides an apposite alternative to meeting those legitimate interests.[90]In view of the Request, the Appellant’s grounds of appeal and his subsequent submissions, the Appellant evidently considers that the Standards Regime is insufficient in meeting his legitimate interests or that it has not been properly observed. However, as already noted, it is not the role of the Tribunal to ascertain or opine on whether or not the Standards Regime is deficient or flawed in any way. This is a point which was recognised by the Appellant in his reply to the Second Respondent’s response to the appeal. However, the existence of the Standards Regime is germane to our assessment of the Legitimate Interests Basis and the relevant legal principles and tests we have referred to.[91]As we have explained, the remit of the Tribunal is to determine whether or not the Decision Notice was in accordance with the law. In this regard, we remind ourselves that when a third party’s personal data is involved in respect of any request for disclosure of information under FOIA:a. the starting point (in accordance with the legislation and case law we have referred to) is the principle of the protection of privacy with respect to the processing of personal data; andb. disclosure of personal data must be necessary, within the meaning outlined in the three propositions we have referred to, for the purposes of the legitimate interests being pursued with regard to such request for disclosure.[92]In addition, as set out in Proposition 5 (and taken from the judgment of Lady Hale in the South Lanarkshire case):
“a measure would not be necessary if the legitimate aim could be achieved by something less”
. The fact that there is something less which can achieve the Appellant’s legitimate aims is a material point in this appeal. Again, it is not for the Tribunal to determine the merits of, or other matters pertaining to, the Standards Regime as that ‘lesser means’, but rather for us to take into account in our decision making (as part of our assessment of ‘necessity’, as we have outlined) whether or not there are other means by which those legitimate aims could be achieved. In this appeal, the other means are those set out in legislation – being the Standards Regime.[93]Having determined that there is another means of satisfying the Appellant’s legitimate aims – and cognisant that such means is set out by the legislature - it would be wrong for us to then decide that individuals’ personal data should need to be disclosed as an alternative means of satisfying those aims. Not only would such a conclusion be contrary to the legal tests of ‘necessity’ and the principles of privacy and protection of personal data we have referred to, but it would be tantamount to us determining that the Standards Regime is somehow inadequate which, as noted, is beyond the remit of the Tribunal.[94]Accordingly, we agree with the submissions of the Second Respondent regarding the existence of the Standards Regime as meaning that ‘something less’ than disclosure of data subjects’ personal data is available to satisfy the legitimate interests of the Appellant. Consequently, we consider that the Commissioner erred in the Decision Notice in concluding that the legitimate interests which would be served by the disclosure of the Requested Information could not be met by less intrusive means. It follows that we disagree with the position of the Appellant and the Commissioner that the Balancing Test needs to be engaged. For those reasons, we do not need to address further the Appellant’s submissions in respect of the Balancing Test.[95]At this juncture, we should return toProposition 2. As we have noted, this requires the test of “necessity” under the second of the questions in Proposition 1 to be met before the third of those questions can be considered. Given our finding that the processing involved is not necessary for purposes of the legitimate interests being pursued by the Appellant (this is, our answer to the second question is negative) then, in accordance with Proposition 2, we do not need to consider the third of the questions in Proposition 1. In other words, as we have reached the conclusion that, for the purposes of section 40(2) of FOIA and the first condition in section 40(3A) of FOIA, the disclosure of personal data is not necessary and therefore the Legitimate Interests Basis is not satisfied, we do not need to go on to consider the Balancing Test between the legitimate interests of the Appellant and the rights and freedoms of Mr Davies and Mrs Davies, whose personal data is in issue.[96]The Commissioner had concluded, as part of his analysis in the Decision Notice, that disclosure was more likely to be necessary to satisfy the legitimate interests of investigating senior figures of the Senedd rather than more junior figures. Also, the Appellant submitted that the alleged seniority in status of Mr Davies means that there should be greater public interest in disclosing evidence of potential misconduct. The Second Respondent’s submissions included statements that the Commissioner was wrong to conclude that Mr Davies was a senior figure and that all members of the Senedd are in fact equal. It is not the place of the Tribunal to determine the hierarchy or otherwise of the Senedd, although we have no reason to doubt the position as outlined by the Second Respondent. In any event, our understanding of the Standards Regime that it applies to all members of the Senedd. Therefore, any perception regarding the hierarchy of individual members is irrelevant to our determination that, given the existence of the Standards Regime, disclosure would not be necessary to achieve the Appellant’s legitimate interests.[97]In that regard, we also recognise the merits ofthe following views of the Second Respondent in its response to the appeal:
“The logical conclusion of the ICO’s finding at §45 [of the Commissioner’s response to the appeal] is that in respect of “junior”
Members of the Senedd the legitimate interest is served by the Standards Regime (i.e. publication of complaints if upheld and not in the case of summary dismissal); but not in respect of “senior” members. That conclusion is irrational. It leads to the result that complaints which are not upheld or dismissed by the Commissioner must be disclosed (subject to the balancing test) even if dismissed. That analysis is flawed.”.[98]It is expedient at this point to turn briefly to some material points raised by the Appellant in reply to the responses to the appeal from the Commissioner and the Second Respondent, for completeness. For the reasons we have given:a. we do not accept that the personal data of Mr Davies and Mrs Davies being ‘inextricably linked’ provides a compelling argument for disclosure;b. whether or not all documentation relating to the investigation was an ‘integral part of the Standards Commissioner’s complaints process’ is immaterial to our analysis above;c. likewise, whether or not the complaint against Mr Davies was dismissed would not have affected that analysis; andd. we do not agree that a ‘higher level’ or ‘alternative means’ of scrutiny is required over and above the Standards Regime such that disclosure of personal data is required.[99]Proposition 6: Where there are no issues regarding an individual’s privacy rights, the question posed under Proposition 1 can be resolved at stage (ii) of the three-part test referred to (that is, the question can be resolved at the ‘necessity’ stage of the Legitimate Interests Test). Clearly, this appeal involves issues regarding the privacy rights of individuals (namely, the privacy rights of both Mr Davies and Mrs Davies) and therefore Proposition 6 is not applicable.[100]Proposition 7: Where there are issues regarding an individual’s privacy rights, the question posed under Proposition 1 can only be resolved after considering stage (iii) of the three-part test referred to - namely, the Balancing Test. For the reasons given, this appeal involves issues regarding the privacy rights of individuals (Mr Davies and Mrs Davies). However, as we have stated, given the application of Proposition 2 and our findings on ‘necessity’, we do not need to consider the third of the questions in Proposition 1. Accordingly, Proposition 7 becomes redundant in the context of this appeal.

Closing summary

[101]In summary, we disagree with the Commissioner’s position in drawing a distinction between senior and junior members of the Senedd and his conclusion that disclosure of the applicable personal data would be necessary to meet the Appellant’s legitimate interests. It follows that we also disagree that it was necessary to apply the Balancing Test.[102]However, our findings do not alter the decision ultimately reached by the Commissioner in the Decision Notice. The position remains that section 40(2) of FOIA is engaged and the Requested Information can be withheld. It is therefore not necessary for us to substitute the Decision Notice.

Application of other exemptions

[103]As we have concluded that the Decision Notice was ultimately correct in determining that section 40(2) of FOIA applied to the Requested Information, it is not necessary for us to determine whether or not section 31 of FOIA or section 41 of FOIA are applicable alternative exemptions.

Final conclusions

[104]For all of the reasons we have given, we conclude that the Commissioner was correct in determining that the Senedd was entitled to refuse to provide the Requested Information pursuant to section 40(2) of FOIA and therefore that the Decision Notice was in accordance with the law. We also do not consider that the exercise of any discretion by the Commissioner in respect of the Decision Notice should have been exercised differently.[105]We therefore dismiss the appeal.