David Howard obo Lee Howard v The Information Commissioner [2023] UKFTT 828 (GRC)

[2023] UKFTT 00828 (GRC)Case Reference: EA/2022/0435
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 8 August 2023Date 9 October 2023
Information Rights
Heard by: determination on the papers
Before
TRIBUNAL JUDGE STEPHEN ROPERTRIBUNAL MEMBER EMMA YATESTRIBUNAL MEMBER DAVE SIVERS
Between
DAVID HOWARD obo LEE HOWARDAppellantTHE INFORMATION COMMISSIONERRespondentDecision: The appeal is DismissedREASONS

Preliminary matters

[1]In this decision, we use the following abbreviations to denote the meanings shown: Appellant: David Howard (acting on behalf of Lee Howard). Balancing Test: The last question of the Legitimate Interests Test, as referred to in paragraph 37. HCPC: The Health and Care Professions Council. Commissioner: The Information Commissioner. Decision Notice: The Decision Notice of the Information Commissioner dated 18 August 2022, reference IC-174748-TOX9, relating to the Request. DPA: The Data Protection Act 2018. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f) of the UK GDPR, as set out in paragraph 33. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 36. Public Interest Test: The test as to whether, in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, pursuant to section 2(1)(b) of FOIA (set out in paragraph 28). Request: The request for information made by the Appellant dated 18 June 2021, as referred to in paragraph 9. Requested Information: The information which was requested by way of the Request. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.[2]We refer to the Information Commissioner as ‘he’ and ‘his’ to reflect the fact that the Information Commissioner was John Edwards at the time of the Decision Notices, whilst acknowledging that the Information Commissioner was Elizabeth Denham CBE at the time of the Request and the Appellant’s subsequent complaint to the Commissioner.[3]Unless the context otherwise requires (or as otherwise expressly stated), references to numbered paragraphs are to paragraphs of this decision so numbered.

Introduction

[4]This is an appeal against the Decision Notice, which held that section 40(5B)(a)(i) of FOIA applied in respect of the Request and accordingly HCPC could neither confirm nor deny that it held the Requested Information. The Commissioner did not require HCPC to take any steps.[5]We consider that it is important to stress what was outside of the scope of the appeal. The appeal was not about the merits, effectiveness or operation of HCPC’s complaints handling regime, nor about any complaints which HCPC and/or the Appellant have been involved with outside of these proceedings, nor about the merits or otherwise of HCPC’s investigations, nor about any alleged misconduct or wrongdoing of any HCPC registrant. The Tribunal has no power to determine those issues and nothing we say should be interpreted as an expression of opinion on any of those issues. The appeal can only be determined with regard to the remit and powers of the Tribunal, to which we refer below.

Mode of Hearing

[6]The parties consented to the appeal being determined by the Tribunal on the papers.[7]The Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 and was satisfied that it was fair and just to conduct the hearing in this way.

Background to the Appeal

[8]The background to the appeal is as follows.

The Request

[9]On 18 June 2021 a firm of solicitors wrote to HCPC on behalf of the Appellant, requesting information in the following terms: "My client, Mr Lee Howard, has asked me to make a Freedom of Information Act request on his behalf for a copy of his complaint file regarding [redacted]. In particular, but not exclusively he wishes to see [redacted]'s response to the HCPC's final allegations, as well as any correspondence from [redacted] where she refers to him. Any correspondence from the HCPC to [redacted] that refers to Mr Howard should also be included, together with any professional opinions obtained from independent psychologists, If these exist.”.

HCPC’s reply and subsequent review

[10]HCPC responded on 26 July 2021. It provided a response giving information to which the Appellant was entitled under the DPA. HCPC refused to provide any further documents under FOIA on the basis that the information was exempt from disclosure, relying on sections 30(2)(a)(iii) and 40(2) of FOIA (respectively, investigations and proceedings conducted by public authorities and personal information). It stated that if it was not withholding the Requested Information under section 30(2)(a)(iii) of FOIA, then section 31(1)(g) of FOIA (law enforcement) would apply.[11]Following an internal review, HCPC wrote to the Appellant on 23 September 2021 upholding its position.[12]On 8 October 2021, the Appellant contacted the Commissioner complaining about HCPC’s response to the Request.

The Decision Notice

[13]The Commissioner stated that, in connection with its investigations, HCPC had confirmed that, in addition to relying on sections 30 and 31 of FOIA, its position was that it was neither confirming nor denying that it held the Requested Information under section 40(5B)(a)(i) of FOIA as to do so would disclose the personal data of a third person.[14]The Commissioner stated that his investigation focussed on HCPC's reliance on section 40(5B) of FOIA and that, if necessary, he would consider whether the appropriate subsections of section 30 and/or 31 of FOIA were engaged.[15]The Commissioner decided, by way of the Decision Notice, that HCPC was entitled under section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information as to do so would disclose the personal data of a third person. The Commissioner did not require HCPC to take any steps. The appeal The grounds of appeal

The appeal

[16]The Appellant’s grounds of appeal set out more context to the Request and provided the Appellant’s views regarding his legitimate interest in the Requested Information, including related to his dissatisfaction with the quality of HCPC’s investigation into a complaint which had been made on behalf of his son. The Appellant stated that, on behalf of his son, they were “seeking accountability and openness” by HCPC and the Commissioner, requiring satisfaction that the HCPC registrant featured in the complaint had acted impartially and professionally in compliance with HCPC's member regulations. The Appellant believed that the Requested Information would show otherwise.[17]The material points in the grounds of appeal were (in summary) as follows:a. HCPC was late in relying on the ability to neither confirm nor deny that it held the Requested Information, and should not have been allowed to do so.b. There seemed to be no logic in the Decision Notice raising the concern that disclosure of the Requested Information would identify a HCPC registrant and indicate to the wider world whether or not they had been subject to a complaint and investigation by HCPC, when the identity of the registrant was already known and the Requested Information was not to be disseminated to anyone except the Appellant, his son and their solicitor and because personal data could have been anonymised.c. The Commissioner did not carry out a fair investigation, and readily accepted HCPC’s internal procedures.d. There had been no transparency and the wider public interest had been disregarded.

The Commissioner’s response

[18]In his response to the appeal, the Commissioner generally relied on the reasons given in the Decision Notice in support of his view that the appeal should be dismissed.[19]The material additional points made by the Commissioner were (in summary) as follows:a. The Commissioner recognised the Appellant’s legitimate interest in the Requested Information.b. The Commissioner considered that the Appellant did not appear to dispute that the relevant information was the registrant’s personal data.c. The Tribunal had no jurisdiction regarding the quality of the Commissioner’s investigation or any concerns about the Appellant’s dissatisfaction about the standard of HCPC’s investigation.d. The Appellant was correct that HCPC did not raise its reliance on section 40(5B)(a)(i) of FOIA in its response to the Request but the law permitted public authorities to subsequently rely on exemptions that they had not previously raised.e. Disclosure of information under FOIA was disclosure to the world at large, even if the Appellant did not disseminate it further.f. In the Commissioner’s view, it was very unlikely that a complaint file, relating to the Appellant, relating to a very niche specialism of the registrant, could be truly anonymised.

The Appellant’s reply

[20]The Appellant provided some background information about another decision notice issued by the Commissioner relating to the Request, covering the response provided by HCPC under the DPA. The Appellant queried why two separate decision notices were issued, but also considered that this meant that the Decision Notice and the appeal could only be addressed in a restrictive manner.[21]In essence, the Appellant’s reply disputed the points made by the Commissioner in his response. Whilst acknowledging all of the contents of the Appellant’s reply, the material points made by the Appellant were (in summary) as follows:a. It was not accepted that personal data was “processed lawfully, fairly and in a transparent manner in relation to the data subject” in this case.b. The Appellant questioned whether the Commissioner had authority to decide that HCPC should be entitled to rely on section 40(5B)(a)(i) of FOIA, or to not require HCPC to take corrective steps.c. It was not accepted that the Requested Information would constitute disclosure of the registrant’s personal data, or that it would indicate to the wider world whether they have been subject to a complaint and investigation by HCPC. Disclosing the Requested Information could simply have been met utilising redactions and was not intended for wider dissemination.d. It was agreed that there was a legitimate interest in the Requested Information but not that it amounted to only a private interest. The honesty of a HCPC registrant and their suitability to practice was in question, as was HCPC’s standards.e. The Commissioner was wrong to consider that the public interest was met by HCPC’s investigation procedures. The Appellant believed that there had been concerns regarding HCPC’s complaints procedures for many years.f. It was not accepted that HCPC had already provided relevant information under the DPA.g. The Appellant had not accepted that the registrant’s personal data was comprised within the Requested Information.h. There was no mention of the Requested Information also including the Appellant’s son’s personal data.i. The Commissioner could not be correct by upholding HCPC’s reliance on section 40(5B)(a)(i) of FOIA, in the absence of him “first having a full appreciation of HCPC’s appalling record of handling both this and many other complaint procedures”.j. The Appellant challenged the statement that the conduct of the Commissioner’s investigation is beyond the scope of the Tribunal.[22]The Appellant’s reply also set out further background information regarding the background to the Request and certain concerns of his regarding HCPC.

The Tribunal’s powers and role

[23]The powers of the Tribunal in determining the appeal are set out in section 58 of FOIA, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[24]In summary, therefore, the Tribunal’s remit for the purposes of the appeal is to consider whether the Decision Notices were in accordance with the law, or whether any applicable exercise of discretion by the Commissioner in respect of the Decision Notices should have been exercised differently. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notices were based and the Tribunal may come to a different decision regarding those facts. The law The relevant statutory framework General principles - FOIA

The law

[25]Section 1(1) of FOIA provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[26]In essence, under section 1(1) of FOIA, a person who has requested information from a public authority (such as HCPC) is entitled to be informed in writing whether it holds that information. This is known as 'the duty to confirm or deny'. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, all of those entitlements are subject to the other provisions of FOIA, including some exclusions, exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) of FOIA provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[27]It is therefore important to note that section 1(1) of FOIA does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.[28]Section 2(1) of FOIA is applicable for the purposes of this appeal, as a potential exclusion of the duty to confirm or deny pursuant to section 1(1)(a) of FOIA. Section 2(1) of FOIA provides: “Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—(a) the provision confers absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.”.[29]The effect of the above is that some exclusions of the duty to confirm or deny which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) of FOIA explicitly lists which of those are absolute. Pursuant to that section, no other exclusions are absolute. Section 40(5B) is not included in that list.[30]Accordingly, in summary, the applicable exclusion for the purposes of this appeal (in section 40(5B) of FOIA) is a qualified exclusion, so that the Public Interest Test has to be applied, even if that section is engaged.

Section 40(5B) of FOIA – personal information

[31]So far as is relevant for the purposes of this appeal, section 40(5B) of FOIA provides: “The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles…”.[32]Section 40(7) of FOIA sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA;b. the “data protection principles” are those set out in Article 5(1) of the UK GDPR, and section 34(1) of the DPA. The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”; andc. a “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”.[33]To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f) of the UK GDPR).[34]Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information by a public authority under FOIA.[35]The first recital to the UK GDPR is also relevant. This provides:
“The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.”
. The second recital to the UK GDPR also includes the following:
“The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”
. Relevant Case law Legitimate Interests Test

Relevant Case law

[36]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[37]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last question of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[38]The approach set out above in the South Lanarkshire case was subsequently reiterated in the Upper Tribunal in the case of Goldsmith International Business School v Information Commissioner and Home Office [2014] UKAT 563 . In the Goldsmith case, Upper Tribunal Judge Wikeley also provided further helpful guidance relevant to this appeal, setting out various propositions derived from the relevant case law. We refer to those propositions in more detail below.[39]We should make it clear that the relevant test is not the Public Interest Test, but rather the Legitimate Interests Test - and these tests are different. As explained by Upper Tribunal Judge Kate Markus QC (now KC) in the case of Information Commissioner v Halpin [2019] UKUT 29, paragraph 29 :
“At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”
. FOIA creates a general right to information subject to the exemptions in section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”” “…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.””

Timing of reliance on exemptions/exclusions

[40]The Court of Appeal confirmed in the case of Birkett v Department for the Environment, Food and Rural Affairs (DEFRA) [2011] EWCA Civ 1606 that that a public authority is entitled to rely on new exemptions/exclusions on bringing an appeal before the First-tier Tribunal. This is so even if those exemptions/exclusions have not been raised by the public authority at an earlier stage (whether in its response to a request for information under FOIA, any subsequent review of that response or in its subsequent dealings with the Commissioner when the Commissioner is investigating a complaint relating to that request).

Evidence

[41]The Tribunal read and took account of an open bundle of evidence and pleadings. The Tribunal also read and took account of some separate ‘final’ submissions which were provided by the Appellant.

The Appellant’s further submissions

[42]In his additional ‘final’ submissions, the Appellant provided some more background information relating to the Request and set out further concerns about the conduct of HCPC. The Appellant also reiterated that the Commissioner’s documents in the appeal only referred to FOIA and not the DPA. Material additional points made by the Appellant (beyond those already raised) were, in summary, as follows:a. It was the Commissioner’s duty to satisfy himself as to whether HCPC complied with its obligations and professional requirements.b. The Commissioner did not follow his own guidance regarding the application of exemptions under FOIA and he did not establish that HCPC gave due consideration to the evidence they held before applying ‘blanket exemptions’.[43]In his further submissions, the Appellant requested that the Commissioner instruct HCPC (and onward to its registrant member) to preserve all their files. Discussion and conclusions Outline of relevant issues

Discussion and conclusions

[44]In accordance with the remit of the Tribunal to which we have referred, the fundamental issue which we need to determine in the appeal was whether the Commissioner was correct to conclude, in the Decision Notice, that HCPC could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny whether it held the Requested Information. Only if we determine that his decision was incorrect in that regard will we need to consider the potential operation of other sections of FOIA. Analysis and discussion; application of the law Preliminary observations

Analysis and discussion; application of the law

[45]We wish to start by acknowledging that there a tragic background to this case, and we understand the Appellant's interest in the Requested Information.[46]We feel that we should reiterate the scope of FOIA and, in turn, the scope of the appeal. In very general terms, FOIA gives persons a right (with the caveats we have mentioned) to access certain information which is held by public authorities. The legislation does not exist to deal with any concerns which individuals may have about the actions or failings of public authorities. Likewise the role of the Commissioner and the Tribunal, insofar as FOIA is concerned, is to address matters relating to compliance with that legislation and not otherwise. The remit of the Tribunal (and indeed the Commissioner) is not to investigate or determine concerns which persons may have about a public authority’s standards.[47]The Appellant commented in his reply to the Commissioner’s response that the Tribunal and the Commissioner appeared to have no jurisdiction over HCPC’s investigation procedures and the Appellant’s other concerns in respect of the conduct of HCPC regarding complaints it investigates. That is indeed the case. Nor is it the role of the Tribunal or the Commissioner to advise the Appellant on “whether there are other avenues that might be followed to ensure the Public Interest is properly served”, which was a question he also raised in his reply to the Commissioner’s response.[48]The Appellant also commented on the separate response by HCPC to the Request under the DPA and the separate decision notice issued by the Commissioner in respect of that. As noted in paragraphs 23 and 24, the Tribunal’s powers in respect of the appeal apply in respect of the Decision Notice (namely, the specific decision notice of the Commissioner which is the subject of the appeal in this case). We have no jurisdiction to consider the issue of another decision notice and accordingly our comments below focus on the application of FOIA (as opposed to the DPA) to the Request, which is the applicable subject matter of the Decision Notice.

Reliance on section 40(5B)(a)(i) of FOIA

(a) (i) of FOIA

[49]As we have noted, even if a public authority does not rely on certain exemptions/exclusions when refusing a request for information under FOIA (or on any subsequent internal review by it), it is entitled to rely on new exemptions/exclusions on bringing an appeal before the First-tier Tribunal. This is also the case in respect of the public authority’s dealings with the Commissioner prior to the issue of the Decision Notice. Whilst we recognise the Appellant’s frustrations regarding the change in HCPC’s position, it was nevertheless lawful for HCPC to rely on new exemptions/exclusions, even at a late stage. Was section 40(5B)(a)(i) of FOIA engaged? Personal Data

Was section 40(5B)(a)(i) of FOIA engaged?

[50]In considering whether personal data is involved, the relevant definitions (as we have referred to in paragraph 32) apply. In the case of the Requested Information, it is clear from the Request that some personal data would relate to the Appellant (or his son) and, as we have noted, a response to the Request was provided by HCPC under the DPA in that regard. However, the Requested Information could also contain the personal data of third parties (including, in particular, the named HCPC registrant referred to in the Request). Therefore the application of section 40(5B) is not precluded.

Data Protection Principle

[51]We do not consider it necessary to explore each of the data protection principles. In the context of the appeal and the Requested Information, we consider that the most relevant data protection principle is that set out in Article 5(1)(a) of the UK GDPR, relating to (amongst other things) personal data being processed lawfully.

Lawful Basis of Processing

[52]In assessing whether the processing of the personal data in question would be lawful, we also consider that the most applicable lawful basis for processing (in the context of the appeal and the Requested Information) is the Legitimate Interests Basis and that the Legitimate Interests Test is applicable.

Legitimate Interests Basis

[53]It may be helpful to reiterate the Legitimate Interests Basis. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
. Translating that language to the context of this appeal: a. the disclosure of the Requested Information under FOIA would be ‘processing’; b. the Appellant is the ‘third party’; and c. the ‘data subject’ would be the HCPC registrant referred to in the Request, as well as (potentially) any independent psychologists, given that the Request also soughtdetails of any applicable professional opinions obtained from them.[54]Accordingly, in the case of a request for information under FOIA, where the information which is requested contains the personal data of a data subject then that personal data would be processed when it is disclosed in response to the request. As we have noted, in respect of the first data protection principle, this means that the information can only be disclosed if to do so would be lawful, fair and transparent.[55]Those principles also apply when a public body, in response to a request for information under FOIA, confirms or denies whether it holds the information which is requested. This is because it can be possible for inferences to be drawn from an acknowledgement of the fact that information is held or not held and consequently could constitute a disclosure of personal data. Accordingly, a public authority (as we have noted) can in some circumstances refuse to confirm or deny that it holds information, as an exclusion from the general duty to confirm whether or not it holds the information which has been requested. The aim of such a response (a ‘neither confirm nor deny’ response) is to leave entirely open the position about whether the public authority holds the information which has been requested, so that no inferences can be drawn either way.

Legitimate Interests Test

[56]Given the legal framework which we have outlined earlier, we consider that it is helpful to address the propositions from the Goldsmith case which we briefly noted above. As mentioned, in that case Upper Tribunal Judge Wikeley listed From paragraph 35 onwards of that case various propositions derived from case law as to the correct approach to be adopted. We set out seven of those propositions below (some of which we paraphrase or otherwise summarise) and we address each in turn with regard to the facts of this appeal. For completeness, we should mention that Judge Wikeley also referred to an eighth Proposition in the Goldsmith case, but this related to tests which were applied in relevant case law and which does not alter the other seven propositions we refer to.[57]Applying the propositions is not a sequential process, in that some later numbered propositions need to be considered and determined before returning to earlier numbered propositions. Moreover, some earlier numbered propositions may be superfluous after applying later numbered propositions.[58]Proposition 1: The three questions set out in the South Lanarkshire case (as we have addressed above – namely, the Legitimate Interests Test) must be applied. Consequently:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? In this case, it would be the Appellant’s interests which are applicable, as the requester of the relevant information. The Appellant’s aim in seeking the Requested Information is, in essence, to ensure that alleged wrongdoing of a HCPC registrant and alleged failures regarding HCPC’s complaints handling are investigated and that there is accountability where appropriate. We agree with the Commissioner that such aim is legitimate and hence that there are legitimate interests being pursued by the Appellant by way of the Request.b. Is the processing involved necessary for the purposes of those interests? In order to address this, we need to turn to Propositions 3 to 5 (inclusive), which we do below.c. Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? Given Proposition 2, we do not address this question at this stage, but comment on this later.[59]Proposition 2: The test of “necessity” under the second of those questions must be met before the third question can be considered. Again, this requires us to turn to Propositions 3 to 5 (inclusive).[60]Propositions 3 to 5 (inclusive) all relate to the concept of ‘necessity’ and so we group them together before commenting on them:a. Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity.b. Proposition 4: It follows that the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality (albeit this may not add much to the ordinary English meaning of ‘necessity’).c. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.[61]With regard to those three propositions, we note that Lady Hale, in the South Lanarkshire case, stated that the word “necessary” must be considered in relation to the processing to which it relates.[62]We also note that, in the Halpin case, Upper Tribunal

Judge Kate Markus QC (now KC) stated Paragraph 31 of that case that:

“the Goldsmith guidance…makes it clear that the question whether there are alternative measures (proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it…”
. In the more recent case of Kol v Information Commissioner and Reigate and Banstead Borough Council [2022] UKUT 74, paragraph 22 , Upper Tribunal

Judge Edward Jacobs stated:

“If there is another way of satisfying [the requestor’s] legitimate interests without disclosing the information, then disclosure is not necessary”
. This principle would apply to confirming whether or not the information is held, as well as the disclosure of the information.[63]It is helpful to remind ourselves of the relevant wording from Lady Hale’s judgment in the South Lanarkshire Paragraph 27 of that case case, in respect of which Upper Tribunal Judge Edward Jacobs was commenting and which is the authoritative decision on the meaning of ‘necessary’ for current purposes: “It is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15, [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”.[64]We consider that these principles (together with others from additional cases cited in the Goldsmith case) are encapsulated in the three propositions (namely, Propositions 3, 4 and 5). In our view, therefore (and taking into account the above comments of Upper Tribunal Judge Kate Markus KC in the Halpin case), we need to consider all three of those propositions in assessing whether or not the potential processing of the third-party personal data (namely, disclosure by way of confirming or denying if the Requested Information was held) was necessary for the purposes of the legitimate interests being pursued by the Appellant by way of the Request.[65]As noted, the legitimate interests being pursued by the Appellant are, essentially, for alleged wrongdoing of a HCPC registrant and alleged failures regarding HCPC’s complaints handling to be investigated and for there to be accountability where appropriate. In the facts of this appeal, we find that it is not necessary (within the meaning outlined in all three of those propositions) for there to be confirmation or denial as to whether the Requested Information is held in order to achieve those legitimate interests. This is because, in our view, those legitimate interests are fulfilled by the existence of subject access rights under the DPA (rights which, as noted, had been exercised by the Appellant), the existence of the HCPC complaints handling process (as outlined by the Commissioner in the Decision Notice) and potential other legal action which may be open to the Appellant outside of FOIA.[66]In light of the Request, the Appellant’s grounds of appeal and his subsequent submissions, the Appellant evidently considers that these other means of meeting his legitimate interests are insufficient. However, as already noted, it is not the role of the Tribunal to ascertain or opine on whether or not HCPC’s complaints handling process is flawed in any way or whether or not there has been any wrongdoing by a HCPC registrant.[67]As we have explained, the remit of the Tribunal is to determine whether or not the Decision Notice was in accordance with the law. In this regard, we remind ourselves that when a third party’s personal data is potentially involved in respect of any request for information under FOIA:a. the starting point (in accordance with the legislation and case law we have referred to) is the principle of the protection of privacy with respect to the processing of personal data; andb. disclosure of personal data (in this case, by way of confirming or denying if the Requested Information is held) must be necessary, within the meaning outlined in the three propositions we have referred to, for the purposes of the legitimate interests being pursued with regard to such request for information.[68]In addition, as set out in Proposition 5 (and taken from the judgment of Lady Hale in the South Lanarkshire case):
“a measure would not be necessary if the legitimate aim could be achieved by something less”
. The fact that there is something less which can achieve the Appellant’s legitimate aims is a relevant point in the appeal. Again, it is not for the Tribunal to determine the merits of, or other matters pertaining to, the ‘lesser means’ by which the Appellant’s legitimate interests may be met, but rather for us to take into account in our decision making (as part of our assessment of ‘necessity’, as we have outlined) whether or not there are other means by which those legitimate aims could be achieved.[69]Accordingly, we agree with the Commissioner’s position that confirmation or denial as to whether the Requested Information is held is not necessary to satisfy the legitimate interests of the Appellant.[70]At this juncture, we should return toProposition 2. As we have noted, this requires the test of “necessity” under the second of the questions in Proposition 1 to be met before the third of those questions can be considered. Given our finding that the processing involved is not necessary for purposes of the legitimate interests being pursued by the Appellant (that is, our answer to the second question is negative) then, in accordance with Proposition 2, we do not need to consider the third of the questions in Proposition 1. In other words, as we have reached the conclusion that, for the purposes of section 40(5B)(a)(i) of FOIA, the disclosure of personal data (by way of ‘confirmation or denial’) is not necessary and therefore the Legitimate Interests Basis is not satisfied, we do not need to go on to consider the Balancing Test between the legitimate interests of the Appellant and the rights and freedoms of third party data subjects.[71]Proposition 6: Where there are no issues regarding an individual’s privacy rights, the question posed under Proposition 1 can be resolved at stage (ii) of the three-part test referred to (that is, the question can be resolved at the ‘necessity’ stage of the Legitimate Interests Test). Clearly, the appeal involves issues regarding the privacy rights of individuals (namely, potential third-party data subjects) and therefore Proposition 6 is not applicable.[72]Proposition 7: Where there are issues regarding an individual’s privacy rights, the question posed under Proposition 1 can only be resolved after considering stage (iii) of the three-part test referred to - namely, the Balancing Test. For the reasons given, this appeal involves issues regarding the privacy rights of individuals (potential third-party data subjects). However, as we have stated, given the application of Proposition 2 and our findings on ‘necessity’, we do not need to consider the third of the questions in Proposition 1. Accordingly, Proposition 7 becomes redundant in the context of the appeal. Did the public interest in maintaining the exclusion of the duty to confirm or deny outweigh the public interest in disclosing whether the public authority holds the information?[73]As we have noted, section 40(5B) of FOIA is not an absolute exclusion and accordingly the Public Interest Test must be applied. In that regard, we recognise (as did the Commissioner in the Decision Notice, albeit not in the context of the Public Interest Test) that there is a general, wider public interest in transparency around how medical professionals practice. We also recognise that there are public interests regarding the adequacy of the regulation of medical professionals and, specifically in this case, any alleged failings regarding HCPC’s complaints handling regime.[74]However, in our view the public interest in maintaining individual’s rights to privacy, based on the legal principles we have referred to, outweighs the preceding public interests. We view the principle of the protection of privacy with respect to the processing of personal data to be paramount. In this regard, we are mindful that disclosure of information under FOIA is disclosure to the world at large, which we comment on further below.

Conclusion regarding section 40(5B)(a)(i) of FOIA

(a) (i) of FOIA

[75]For all of the above reasons, we conclude that section 40(5B)(a)(i) of FOIA is engaged and that the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether HCPC holds the information. Accordingly, we find that HCPC could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information. It follows that we agree with the findings of the Commissioner in the Decision Notice in that regard.[76]Given that conclusion, it has not been necessary for us to consider the potential application of other exemptions under FOIA.[77]We note, however, that the Decision Notice did not address the application of the Public Interest Test and accordingly we find that it was flawed in that regard. We therefore agree with the Appellant’s submissions, insofar as applicable to this point, that the wider public interest had been disregarded by the Commissioner. However, this does not affect the outcome of the Decision Notice given that we have reached the same ultimate conclusion.

Other issues raised by the Appellant

[78]For completeness, we now briefly address any relevant remaining issues which were raised by the Appellant.[79]We acknowledge the Appellant’s comments that he knew the identity of the HCPC registrant in question and that the Requested Information, if disclosed to him, would not be disseminated more widely by him. However, disclosure of information under FOIA is, effectively, disclosure to the public (in other words, to the ‘world at large’). It cannot be restricted to a particular requester. Therefore this is not a reflection on assurances the Appellant would give about dissemination of the Requested Information but is simply how FOIA operates. It is for this reason that appropriate consideration and weight had to be afforded, in the application of the Public Interest Test, to the protection of individual’s privacy rights – namely, because disclosure of information under FOIA is disclosure to the general public.[80]Given the nature of the Requested Information, we consider that it could not be appropriately anonymised.[81]We have no jurisdiction to assess or determine whether or not there was any deficient or unfairness in the Commissioner’s investigation; the role of the Tribunal is not to conduct a judicial review of the Commissioner’s actions. However, we were able to undertake a ‘fresh review’ of the Decision Notice and had the ability to consider fresh evidence in accordance with our powers outlined in paragraphs 23 and 24.[82]The Commissioner’s remit extends only to certain matters relating to data protection, privacy and freedom of information legislation. Accordingly, we disagree with the submissions of the Appellant that it was the Commissioner’s duty to satisfy himself as to whether HCPC complied with its general obligations and professional requirements.[83]We have no jurisdiction to mandate that the Commissioner instruct HCPC (or others) to preserve their files.

Final conclusions

[84]For all of the reasons we have given, we conclude as follows.[85]Whilst we consider that the Decision Notice was flawed in not addressing the Public Interest Test, this does not affect the ultimate conclusion reached by the Commissioner in the Decision Notice. This is because, for the reasons we have given, we also find that HCPC could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information.[86]We therefore dismiss the appeal.