Fiona Thompson v The Information Commissioner [2024] UKFTT 131 (GRC)

Case Reference: EA/2023/0003[2024] UKFTT 00131 (GRC)
First-tier Tribunal
General Regulatory Chamber
[Information Rights]
Heard: GRC Remote Hearing Rooms
5 July 2023 & 7 February 2024.
Decision given on: 14 February 2024.
Promulgated on: 14 February 2024.
Before
Tribunal Judge: Brian Kennedy KC.Tribunal Member: Rosalind Tatam.Tribunal Member: Stephen Shaw.
Between
Fiona ThompsonAppellantThe Information CommissionerRespondentHis Majesty’s TreasuryRespondentFiona Thompson as litigant in person and also represented by her proxy Lee Thompson on 7 February 2024. for Appellant for First Respondent: Helen Wrighton in written Response but not in attendance. for Second Respondent: Ruchi Parekh of Counsel at the oral hearing on 7 February 2024.Result: The Tribunal issue the following Substituted Decision Notice:1.a) The appeal is Allowed in relation to one email containing a“sent from my iPhone"signature. This was clearly a message sent from the iPhone that is the subject of the FOIA request in this appealed Decision Notice and has been disclosed since the Appeal was adjourned on 5 July 2023.b) The remainder of the retrieved sent emails were not, on the balance of probabilities, sent from the iPhone subject of the FOIA request – and therefore fall outside the scope of the Request.Accordingly, the Tribunal require no further steps to be taken by the Second Respondent.c) As for Received emails, there is no technical or other search to determine where such emails were first read. But based on (i) the limited, if any, mobile data and cellular services usage by Amyas Morse whilst leading the Independent Loan Charge Review; and (ii) Amyas Morse’s recollections, it appears more likely than not that Amyas Morse did not use his iPhone as his primary device and that accordingly, he read/accessed his emails on a different device(s). on a balance of probabilities these emails too would therefore fall outside the scope of the Request.d) In relation to other messages (i.e. SMS or WhatsApp. Etc.): On the evidence before us, we find that this information is simply not held, and was not held at the date of the request.e) The Second Respondent is not required to take any further steps.REASONSDate 2023-02-14

Introduction:

[2]This decision relates to an appeal brought under section 57 of the Freedom of Information Act 2000 (“the FOIA”), against the Decision Notice of 6 December 2022 Ref. IC-179260-X8F3 ("the DN") which is a matter of public record.

Factual Background to this Appeal:

[3]Full details of the background to this appeal, the Appellant’s request for information and the Commissioner’s decision are set out in the DN. The Appellant requested incoming and outgoing messages from a HM Treasury (“HMT”) smartphone (“iPhone”) issued to Lord Amyas Morse for use in his capacity leading the independent Loan Charge Review (“LCR”). The Commissioner’s decision was that HMT did not hold the requested information although the Commissioner was somewhat misled by, and critical of HMT’s Response.[4]The Commissioner has maintained the position set out in his DN. The Appellant appealed against the DN. The Commissioner opposed the appeal and has invited the Tribunal to uphold the DN.

History and Chronology

[5]On 7 June 2021, the Appellant wrote to HM Treasury and requested information in the following terms: “Dear HM Treasury On 10 September 2019 at 13:18 an unnamed official in HM Treasury sent an email to Amyas Morse. The email contained the following request: “We have been able to set you up on HMT IT so that you will have an email address and a Treasury laptop and smartphone when you come in on Thursday which you will be able to take away with you. Amyas Morse confirmed by email at 14:30 on the same day that he would be at HM Treasury at 10am on (Thursday) 12 September 2019. Please provide all incoming (received) and outgoing (sent) messages of any type or format, from the Treasury smart phone, which was supplied to Amyas Morse, from the date he collected the phone to the date it was returned to the Treasury”.[6]HMT responded on 5 July 2021. It stated that the information was not held. It explained that the LCR was independent to the work of HMT, and any information produced by Amyas Morse would have been destroyed at the conclusion of the LCR, as per the conditions in the terms of reference for his review. (see Page 71 therein: - “D.15 All evidence received by the Review will be destroyed at its conclusion and those that provided evidence were informed of this at the time. “)[7]On 1 September 2021 the Appellant requested an internal review explaining that they were requesting incoming and outgoing messages, therefore the iPhone used by Amyas Morse would also contain information received rather than solely information produced. The Appellant also disputed HMT’s reliance on the terms of reference for the Review, which they state covered the destruction of information received from the public as part of the review and not information produced by Amyas Morse or others.[8]Following an internal review HMT wrote to the Appellant on 12 October 2021 confirming that in its internal review HMT amended its position and stated that it was refusing the request under section 12(2), anticipating that the cost of complying with the request would exceed the appropriate limit of £600. HMT explained that Amyas Morse may have sent messages to HMT staff not seconded to the LCR, however, to establish this would:
“require a wide-scale search and examination of information by a large number of officials… it is also unlikely that we would be able to identify whether that device was used to send any such messages.”
[9]The Appellant contacted the Commissioner on 13 October 2021 to complain about the way their request had been handled. The Commissioner wrote to HMT to establish its position, however, HMT failed to respond within the specified timeframe.[10]On 21 June 2022 the Commissioner issued a decision under IC-134697- P3P3 finding that HMT had failed to demonstrate that section 12(2) was engaged and requiring it to issue a fresh response within 35 calendar days.[11]On 1 July 2022 HMT provided a fresh response. It stated that, on review, it had identified current staff members who may have been contacted by Amyas Morse and asked them to perform a search of their records. All officials confirmed that they did not hold any information.[12]HMT concluded that the requested information was not held.[13]On 5 July 2022, the Appellant complained to the Commissioner about HMT's further refusal.[14]On 6 December 2022, the Commissioner issued the DN now under appeal in which he found, on the balance of probabilities, that HMT did not hold the requested information.

Commissioner’s Decision Notice:

[15]The Commissioner considered the scope of the complaint in relation to the request for information. On foot of this, he decided that HMT did not hold the requested information. The Appellant provided the Commissioner with a copy of HMT’s email to Amyas Morse in which an iPhone was offered to him; however, the Commissioner had not been presented with any evidence to contradict HMT’s assertion that the iPhone was not collected. The Commissioner considered the explanation provided to be sufficient for the purposes of the present DN. However, the Commissioner recognised that HMT’s overall handling of the request has been less than satisfactory.

Grounds of Appeal:

[16]The Appellant, in her grounds of appeal, disputes that the reliability of HMT's assertion that Amyas Morse did not collect an iPhone is almost entirely undermined by the time at which it was first raised. The Appellant argued that HMT's earlier responses " ... directly contradict...." its later assertion that Amyas Morse did not collect any iPhone. The Appellant disputed that Amyas Morse did not collect an iPhone.[17]The Appellant argued:
"…in its response to the Commissioner and as included in the latest Decision Notice, HM Treasury also claim that its IT service provider has apparently confirmed that the costs limit ... would be exceeded if it was asked to access Local Charge Review email accounts. Yet, in its response to a Freedom of Information request from another individual on 23 April 2020, HM Treasury supplied three files ... This would once again appear to contradict HM Treasury's position and is further evidence of its inconsistent and dubious reasoning which I ask the tribunal judge to please take into account as part of this appeal..."
[18]Further, the Appellant argued that she does not believe that the Commissioner has:
“...fully considered, nor properly reviewed those significant and important facts which are integral to this case, ...the Commissioner has failed to take into account the strength of the evidence I have provided, nor has he demonstrated an understanding of the wider issues at stake and the political context within which this Freedom of Information request clearly sits, ...I do not accept, nor do I consider that these concerns have been properly or appropriately addressed by the Information Commissioner's Office during its most recent investigation...”
[19]Finally, the Appellant stated:
“……Although this specific appeal is directly linked to one ... request, there is a much wider impact at stake for members of the public attempting to hold HM Treasury to account in relation to its legal obligations and responsibilities under the Freedom of Information Act particularly on the subject of Sir (now Lord) Morse and the Loan Charge Review he undertook on behalf of the current government in 2019...”
[20]The Commissioner resisted the appeal. The Commissioner relied upon the DN and findings therein. The Commissioner expressed, his "dissatisfaction..." with HMT's handling of this matter and, in particular, his disappointment that it took sixteen months to ascertain that HMT stated on … that the iPhone was not collected or used by Amyas Morse.[21]The Commissioner contended, irrespective of any reason(s) as to why the information should be held; it was HMT's position that no information was (based on its searches) in fact held.[22]The Commissioner maintained that any indication that Amyas Morse intended to collect the relevant device does not mean that he did, in fact, do so.[23]The Commissioner acknowledged that it appears HMT has provided different responses to requests seeking information connected to the LCR. Specifically, it appears to have disclosed some information in April 2020 in response to one request, relied upon section 12 in relation to another and, in this case, has indicated that the requested information is not held.[24]The Commissioner stated that the Tribunal cannot consider the process by which the Commissioner reached his substantive decision and reminded the Appellant that the remit of this Tribunal is only concerned with HMT’s handling of one specific request and the Commissioner’s findings in relation thereto.

Appellant’s Reply (prior to 5 July 2023):

[25]In reply the Appellant stated that the Commissioner excluded part of HM Treasury’s original responses specifically the LCR. Further, that the Commissioner made no reference as to the reasons why an internal review was requested. The Appellant averred that the Commissioner was selective in which parts of her argument were used for the purposes of the response. The Appellant argued that the DN was issued after the Commissioner had asked HM Treasury to provide a detailed explanation, but none had been received.[26]The Appellant indicated that the Commissioner has attempted to set aside facts relevant to the appeal. The Appellant provided information in relation to her assertion that HM Treasury have provided no evidence that the iPhone was not collected. The Appellant reminded the Commissioner that his job is to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The Appellant refuted the claim that the Commissioner understands the frustrations caused by HM Treasury’s handling of this request. The Appellant provided supplementary evidence to the appeal and asked the Tribunal to consider the same.[27]According to the Government Legal Department their client, HM Treasury stated that they made further enquiries to confirm the most up-to-date factual position of their clients for the parties in this appeal and suggest that in a spirit of candour, they were providing that further information. Further, their client's technical support team had now completed an additional investigation into whether Amyas Morse was issued with and used a Departmental mobile phone. This has included contacting Amyas Morse again, who confirmed that he has no recollection of ever collecting or personally using a department-issued phone. As a result of further searches for information, their client has also identified an old report completed by an IT supplier showing a phone was assigned to Amyas Morse, which had an associated cellular phone number. Searches on the number reveal that that phone was used on mobile data between 10th and 27th September 2019, and that a request was made by the Loan Charge Review (“LCR”) secretariat for the international bar on the telephone to be lifted for Amyas Morse’s use while abroad.[28]The Government Legal Department argued their client’s records show that the number was reallocated to a different individual in December 2020 (postdating the conclusion of the LCR and in line with usual practice. The individual in question is entirely unconnected to the LCR; the phone was redeployed and reallocated for further general use by an HM Treasury civil servant. Any messages previously sent from or received by that device would have been routinely wiped at that point. It had established – by 1st July 2022 – that, all possible recipients of any such messages have confirmed that they hold no messages from Amyas Morse.[29]As such, HM Treasury remained confident it did not hold information within the scope of the request, and that the finding in DN IC-179260-X8F3 that they did not hold the requested information remained sound.

The Hearing (on the papers): on 5 July 2023

[30]The Appellant in her submissions dated 22May 2023 made several assertions as to why the disputed information must be held. This was submitted in response to an ‘update’ letter received from the Government Legal Department on behalf of HM Treasury dated 10March 2023. The Tribunal had no certainty as to the veracity of these assertions. Equally, however, we had no response from HM Treasury upon which to make a judgement as to whether they are correct and thus whether the information is held or not. The Tribunal was of the view that this can only be adequately addressed by joining HM Treasury and receiving witness evidence in relation to these assertions.[31]Accordingly under Rule 9 of the Tribunal Procedure (First-Tier Tribunal) (General Regulatory Chamber Rules 2009 joined the Public Authority, herein i.e. HM Treasury (“HMT”) as Second Respondent and directed that an oral hearing take place to provide the Tribunal with sufficient evidence and reasons, through such comprehensive evidence and submissions as are required, in order to properly determine whether the requested information is held and identify any exemptions relied upon. The Tribunal issued the following Case Management Directions; “Without prejudice to the foregoing, the Tribunal seek all material evidence pertaining to all incoming (received) and outgoing (sent) messages of any type or. format, from the Treasury smart phone, which was supplied to Amyas Morse, from the date he collected the phone to the date it was returned to the HMT to include but not exclusive to –: a) Open (and if necessary Closed) evidence – b) Copy of the Terms of the request to the HMT’s technical support team. c) copy of the report received from the team, regarding the search for archived messages to and from Lord Morse in the relevant time period. d) Copy of the archived messages in scope that have been, or can be retrieved (if any); e) Copy of the HMT’s schedule for electronic records management (or equivalent) regarding the criteria for archiving or retention of documents, texts and electronic messages, and the criteria and timescales for storage, removal, or deletion.

The Second Respondent’s Legal Submissions further to the Case Management Directions:

[32]The Second Respondent’s position at this stage then became as follows:a. The mobile phone at the heart of the Appellant’s request was supplied to and was used – on at least one occasion by Amyas Morse.b. HMT continues to hold emails within Amyas Morse’s Loan Charge Review email account. However, this includes all emails sent or received by Amyas Morse, whether via his mobile phone, laptop or an internet browser. The emails that fall within the scope of the Appellant’s request (i.e. “outgoing (sent) messages”) have been disclosed as [Exhibit HS/18]. HMT does not hold any information on “incoming (received)” messages on the mobile phone.c. HMT does not hold any other information from the mobile phone itself, such as text messages, which would have been deleted in accordance with data retention policies for HMT devices.[33]The Second Respondent’s position is focused on the information falling within the scope of the request and is to be read alongside the two witness statements.[34]HMT’s updated position is that Amyas Morse did collect and use an iPhone in connection with the LCR. HMT does hold some information falling within the scope of the Request, and this has now been disclosed as [Exhibit HS/18]. Beyond what is disclosed, HMT does not hold any further information which falls within the scope of the Request.[35]In light of the above, HMT accepts that the information it provided to the Commissioner, and which informed the Decision Notice of 6 December 2022, was wrong, and as such, the Appellant’s appeal should be allowed. However, HMT respectfully invites this Tribunal to make a ‘no steps’ order, as HMT has disclosed the information which it holds, and which falls within the scope of the Request. It is submitted that there are no further searches that HMT can conduct in this case: all available avenues have been explored by officials in both policy and technical teams, and there is no further information within the scope of the Request which can now be uncovered.

Witness Statement of Oliver Haydon:

[36]Oliver Haydon, Deputy Director for Personal Taxation in HMT provided a witness statement on the 25 September 2023, that stated:a. HMT in fact holds information contained in the mailbox email account used by Amyas Morse.b. A search conducted of that mailbox found an email chain between Amyas Morse and a support staff member at the LCR. A copy of that email chain is exhibited to the witness statement of Huw Stephens.[37]Accordingly, in light of these developments, it is now accepted by HMT that Amyas Morse did collect and use an iPhone issued by HMT during the relevant period to send and receive emails and that the previous conclusions of HMT Policy Officials were incorrect.[38]However, HMT argue they no longer hold the information stored locally in the iPhone. The phone number associated with the handset issued by HMT was reassigned to a different named individual in December 2020. Any incoming or outgoing messages (including SMS and WhatsApp messages) stored on the phone would have been deleted, in accordance with the process for ‘wiping’ returned IT equipment detailed in the witness statement of Huw Stephens.[39]Mr Haydon understands, from the witness statement of Huw Stephens, that it is not technically possible to determine whether a given email preserved in Amyas Morse’s email account was first received on an iPhone, laptop or other browser. Further, save for the sole email containing ‘Sent from my iPhone’ exhibited to Huw Stephens’s witness statement (and referred to at para. 41(b) of his statement), it is not possible to determine whether any given email was sent from the email account by means of the mobile phone or his laptop.

Witness Statement of Huw Stephens:

[40]Huw Stephens, Deputy Director Level as Chief Information Officer and Head of Treasury Business Solutions in HMT provided a witness statement on the 25th of September 2023 which amongst other information made the following assertions; a) In answer to the Tribunals Case Management Directions of 5 July 2023, there is no single report from HMT IT detailing its investigations concerning the Appellant’s FOIA request. The involvement of, and investigations conducted by the HMT IT team in relation to the request were further detailed. b) As set out in Oliver Haydon’s statement, HMT IT were contacted by HMT’s Information Rights Team for the first time in relation to Amyas Morse’s phone on 22 August 2022. A subsequent Microsoft Teams meeting, on or around the 7 September 2022, discussed whether there was a record of Amyas Morse having collected and/or returned an HMT phone. c) In October 2022, the HMT IT team concluded that there was no evidence that the iPhone referred to in the Appellant’s request for information was ever collected by Amyas Morse. The evidential basis for this conclusion was set out as follows. (i)The monthly mobile telephone reports from the HMT IT supplier were searched for the period between 1 September 2019 and 31 December 2019. These searches indicated that no mobile phone was registered to Amyas Morse, nor his email account, “independentreviewer@loanchargereview.org.uk”. Unfortunately, the search tool used for these searches does not record the date upon which the search was carried out. (ii) The monthly phone reports from EE, the supplier of the mobile network, were searched for the period between 1 September 2019 and 31 December 2019. These searches showed no results for a mobile phone registered to Lord Morse, nor his email account, “independentreviewer@loanchargereview.org.uk”. (iii) Subsequently later in 2022, further searches were carried out. In particular, the “independentreviewer@loanchargereview.org.uk” email address was used as a search term. For the first time, an internal report of one of HMT’s IT Suppliers showed that a phone had been assigned to Amyas Morse with an associated phone number. (iv) A further search using the associated phone number as a search term took place. This search produced records of a request made on 18 October 2019 to have an international bar removed from a phone and the associated number. (v) The monthly phone records produced by EE were also searched again using the associated phone number as a search term. Although the phone number was shown as pending allocation, these records showed this mobile phone number being used for mobile data 16 times between 10 – 27 September 2019. (vi) These records also demonstrated that the associated phone number did not send or receive any SMS text messages during the relevant period. (vii) The monthly EE phone records showed that associated phone number was re- allocated to a different individual in HMT in December 2020. By that point, any SMS, WhatsApp or other messages stored on the phone itself would also have been wiped, as discussed above. (vii) It is not known what the mobile data for the phone number was used for despite the request to remove an international bar. Mobile data used 16 times over a 17-day period in September 2019 may have been used, for example, to check email, access an internet browser or use a web-based applications. (ix)Prior to the preparation of this statement, HMT’s position was informed by the mobile phone records from the IT supplier and EE concerning the mobile phone number associated with Amyas Morse that was identified in late 2022. Those reports indicated that no SMS messages were sent/received during the Relevant Period. Had this been the case, the monthly phone reports from EE would have shown results during the Relevant Period associated with the associated phone number Further, the records only indicated that the associated phone number was used for mobile data between 10 – 27 September 2019, and requested that the international bar on the phone be lifted on 18 October 2019. (x) However, it was very recently discovered during the preparation of this witness statement that there is one email sent from an iPhone by Amyas Morse. This was discovered in additional IT administrator searches of emails sent to/from Amyas Morse’s email account due to the inbox being placed under a legal hold. The consequence of this discovery meant that this mailbox could be searched for the words “Sent from my iPhone” and Amyas Morse’s email dated 18 October 2019 was identified. (xi) On the basis of information now available, we now consider that Amyas Morse did collect an iPhone at some point during the Relevant Period and requested that the international bar was removed on it on 18 October 2019. (xii) All data stored on the phone itself would have been deleted in accordance with the standard procedure for wiping HMT issued IT equipment and re-allocating it for use by another TRIS user. Therefore, insofar as any text messages within the scope of the request were ever generated and stored on the phone, HMT does not hold that information. The only remaining data falling within the scope of the request is what remains in the email box of Amyas Morse’s LCR email. (xiii) Unfortunately, save for the single email sent by Amyas Morse containing the “Sent from my iPhone” email signature, it is not possible to carry out any further technical searches to determine whether a given email was sent from the email account on a phone or on a laptop. It is also not possible to identify whether the received emails were first accessed on a phone, laptop or web browser.[41]Any person making a request for information to a public authority is entitled to be a) informed in writing by the public authority whether it holds information of the description specified in the request, and b) if that is the case, to have that information communicated to him.[42]Where there is a dispute between the information located by a public authority, and the information a complainant believes should be held, the Commissioner and the Tribunal follow the well-established principle in applying the civil standard of the balance of probabilities.

The Oral Hearing on 7 February 2024:

[43]The Appellant was represented by Lee Thompson, who as her proxy had mastered his brief and was clearly personally engaged and fully informed in all aspects of the appeal. The thrust of his cross examination and submissions echoed the substance of the grounds of appeal, and the extensive and detailed written arguments and submissions of the Appellant from the outset. He very thoroughly (in excess of a two hour period) took Mr Stephens and Mr Haydon through the shortfalls and failures on the part of HMT in the retrieval and storage of information and emphasised the failure of the HMT to follow policy guidelines he maintains apply on the retrieval and storage of information from the electronic equipment supplied by HMT to Amyas Morse and his team on the LCR, and in particular the iPhone, the subject of the request for information herein.[44]The Tribunal held a Closed session to investigate further the alleged shortcomings of the HMT as asserted on behalf of the Appellant and the gist of that Closed hearing is as follows; “Counsel for the Second Respondent addressed the Tribunal on the emails and attachments which were contained in Amyas Morse’s email account in order to make good two points:a. The emails sent or received by Amyas Morse did not have any further indicator to suggest they were sent from a mobile device.b. The emails in the inbox were highly unlikely to be the type of business-critical document which would be recorded on Info Store. Counsel for the Second Respondent addressed the Tribunal on whether the emails and attachments which were contained in the closed bundle fell within the scope of the FOIA request. If the Tribunal agreed with HMT, i.e. that the documents were not in scope of the FOIA request, then a ‘no further steps’ order should be made. If the Tribunal disagreed with HMT, then HMT would require the appropriate time to review these documents to identify whether any exemptions applied. Counsel made submissions on the true scope of the request, and why the contents of the email inbox fell outside the scope of the request. These submissions were appended to the gist as “Counsel’s Submissions”. The Tribunal then asked about the use of the phone prior to 18 October 2019. Mr Stephens gave evidence that: (i) The first positive evidence that Lord Morse used the iPhone was the email of 22 October 2019 which indicated “sent from iPhone”. However, Mr Stephens flagged to the Tribunal that the signature could be edited. (ii)The email of 18 October 2019, concerning international barring and the data cap, also provided Lord Morse with log in details which suggests that this is the first date Lord Morse had access to the phone. (iii)While there were records of the iPhone’s data being used prior to 12 September 2019, when Lord Morse was scheduled to pick up the phone, this was likely to be the IT engineer setting up the phone. This would involve, for instance, setting up the device management software, Microsoft Intune. (iv)While there were records of the iPhone’s data being used prior to 18 October 2019, it is possible that a person with delegated authority to manage Lord Morse’s account collected and was using the phone. (v)It is not uncommon for senior figures to have a secretary who has delegated access and will use the email account to arrange meetings and carry out other administrative tasks on that figure’s behalf. The Tribunal then asked witnesses questions about the content of the closed bundle of documents. Mr Stephens explained that the emails and attachments had been submitted without HMT review, so it may be the case that a few documents were also in the public domain. “ a. The emails sent or received by Amyas Morse did not have any further indicator to suggest they were sent from a mobile device. b. The emails in the inbox were highly unlikely to be the type of business-critical document which would be recorded on Info Store. (i) The first positive evidence that Lord Morse used the iPhone was the email of 22 October 2019 which indicated “sent from iPhone”. However, Mr Stephens flagged to the Tribunal that the signature could be edited. (ii)The email of 18 October 2019, concerning international barring and the data cap, also provided Lord Morse with log in details which suggests that this is the first date Lord Morse had access to the phone. (iii)While there were records of the iPhone’s data being used prior to 12 September 2019, when Lord Morse was scheduled to pick up the phone, this was likely to be the IT engineer setting up the phone. This would involve, for instance, setting up the device management software, Microsoft Intune. (iv)While there were records of the iPhone’s data being used prior to 18 October 2019, it is possible that a person with delegated authority to manage Lord Morse’s account collected and was using the phone. (v)It is not uncommon for senior figures to have a secretary who has delegated access and will use the email account to arrange meetings and carry out other administrative tasks on that figure’s behalf.

The Appellants Final submissions:

[45]It is confirmed in this case that HM Treasury holds information as per s.1(4) FOIA, and that a requester is entitled, under s.1(1), to “the information in question held at the time when the request is received” - which in this case, was 7th June 2021. It has also been confirmed today that everything – in, not just Lord Morse’s account, but also all members of the Loan Charge Review team, as well as every single member of HM Treasury’s staff – was placed on ‘legal hold’ in early 2020, meaning this information was held at the time the request was made, despite its (unsubstantiated) claims to the contrary for well over two years. As set out in O’Grady v IC (EA/2019/0318/P) (26 March 2020) and as admitted by HM Treasury in its reply to the Commissioner’s investigation, it is known that no other body than HM Treasury has responsibility for, or ownership of this data.[46]The request sought this held information, of any type and in any format, from the device now known to have been collected, and used, by Amyas Morse, from the date of collection to the date it was returned to the Treasury. No evidence has been presented at the hearing which confirms the date this iPhone was returned. The mandatory policies in place at HM Treasury for the use and management of government-owned IT equipment and devices had not been followed, nor was any allocation of this iPhone documented, or recorded by the authority.[47]These internal policy documents reinforce the fact that any user of such a device is responsible for ensuring that it is used and handled in accordance with the established rules and protocols. When information relating to policy – which, as Mrs Tatam quite rightly stated today, is exactly what constituted Amyas Morse’s singular remit during the ‘relevant period’, in his appointed task of reviewing government policy – is created, or produced, or shared, or discussed – then it is the responsibility of that user to ensure that this policy information is migrated – routinely – to HM Treasury’s corporate repository known as Info Store. Notwithstanding Amyas Morse’s now-disproven claims as to his own collection and use of this iPhone, the established rules make clear that the Information Asset Owner at HM Treasury has the ultimate responsibility for ensuring that all policy information is identified and migrated to Info Store. We have been informed at the hearing that an Information Asset Owner must have existed, but that neither witness from HM Treasury had any idea who that individual might be. What is known is that the internal policy covering these responsibilities is mandatory and “failure to comply with it could result in disciplinary action being taken which may, in certain circumstances, lead to dismissal and/or criminal proceedings.”[48]Counsel has claimed that HM Treasury does not hold any other information from the iPhone itself, including messages of any kind – such information having apparently been deleted “in accordance with data retention policies” – yet, according to both witnesses at the hearing, it is confirmed that nobody in HM Treasury has conducted any searches on Info Store for any data which might be there, or – perhaps even more significantly - that the Information Asset Owner was responsible for ensuring was there, so the statement by Counsel is both premature, and unproven.[49]Bromley v IC (EA/2006/072) (31 August 2007) confirms that a public authority must carry out reasonable searches to identify all the relevant information that is held. This will include what the authority’s record management policy says about the type of information sought. Info Store is HM Treasury’s information repository, within which all information relating to policy should be migrated, and held, as per its legal obligations and with regard to all aspects of the government business it undertakes. It is clear and obvious that any search being conducted to locate, or retrieve information relating to this request, should have included immediate searches on Info Store. This was not performed, at any time throughout the period of this request, as was affirmed at the hearing by both witnesses and Counsel.[50]On the matter of a ‘legal hold’ being applied to all accounts in HM Treasury, as well as that of Amyas Morse and those officials forming the LCR team in ‘early’ 2020, we were informed at the hearing that nobody in either the policy team, or the Information Rights team, had any knowledge of this status. It should be clear to the Tribunal that both teams, but in particular the Information Rights team, given its legal obligations and responsibilities under the terms of the Freedom of Information Act, must have been made aware that recorded information with a status of ‘legal hold’ was available to be searched when in receipt of requests, in order to properly fulfil HM Treasury’s function as a public authority subject to FOIA.[51]The number of this iPhone (redacted) allocated to and collected by Amyas Morse must have been communicated to his review team, and any other intended contact(s) either before, or around the commencement of his work. I consider that evidence of those communications should be established, and disclosure ordered of any recorded information which proves not only the known existence of this device within HM Treasury, but also HMRC.[52]On the evidence presented by Counsel for HMT and those witnesses from HMT at the hearing, it is not accepted that the authority has complied with this request, nor that it has carried out appropriate searches to establish what it holds in total, and where that information is located. The DN is wrong, on the facts of the case – that has already been established. This, in turn, allows the Tribunal to carry out its own investigations into the findings of fact. Those facts will include –: a) HMT’s arguments as to scope in this appeal rely solely on one email, containing a ‘default’ signature which it has been accepted, and agreed, by those appearing on behalf of the Second Respondent today, could have been added, deleted, or altered whenever the sender saw fit to do so. It provides no evidence, not even on the ‘balance of probabilities’, that all other emails composed by Amyas Morse were not sent from this device. It is inconclusive, indeterminate and relies on nothing but pure speculation – and could not possibly be used to form any definitive conclusions about Amyas Morse’s use of this device, especially in light of his blank refusal to admit it was ever even in his possession. b) The evidence presented by HMT includes a report provided by EE (and then edited by HMT), in relation to GPRS data usage on this device. As has been established, this is again entirely inconclusive, demonstrating only that Amyas Morse (between 12 September 2019 and 27 September 2019) used this iPhone to access something using this method, rather than wi-fi. c) It was confirmed and accepted by witnesses at the hearing that the use of wi-fi to access web browsers, make calls and send/receive emails using this device is not recorded by the network provider (EE) and would have enabled Amyas Morse to connect to any available wireless network (in this country, and also when he travelled abroad with this equipment) and that none of this would have been visible to HMT. There is a much greater likelihood of this device using wi-fi in preference to any other type of connection – GPRS is intermittent, with any available signals prone to dropping in and out of range and is considered as a ‘best efforts’ service when wi-fi is not available. The conspicuous absence of any GPRS data being presented in evidence to the Tribunal for October, November and December supports, informs and validates the probability and likelihood that the only method of access used on this device across those months was via wi-fi, and that this was both active, and frequent.[53]The above facts lead to a number of reasonable, balanced and measured conclusions. Every email held in Amyas Morse’s account is much more likely to have first been drafted (and sent) or read (following receipt) on his iPhone than on any other device, while connected to wi-fi. It is standard, common practice for users of mobile devices to access information in this manner and would be considered normal behaviour in any modern working environment. It is also much more likely that another device (such as a laptop) would be used for compiling documents, preparing presentations, or analysing information on spreadsheets – email (and any other form of messaging) is unquestionably more immediate, more portable and more accessible, when using an iPhone or other (similar) Android device via a wi-fi connection.[54]On the basis that these arguments are accepted by the Tribunal, then the entire content of Amyas Morse’s account (which it has been confirmed contains both emails and attachments) should be determined as falling within the scope of this request, and that disclosure of this information should be deemed both valid, and necessary under the terms of FOIA. I would also add that there is a strong and widening public interest in the disclosure of this information, given the controversial nature of the subject, the weight of political opposition to the policy, and the tens of thousands of people so adversely affected by Amyas Morse’s decisions.[55]It follows that not just the entire content of Amyas Morse’s account (still on ‘legal hold’) should be disclosed, but that any other information held by HMT in Info Store should be identified, and also disclosed. It has been established at the hearing that no searches of Info Store were conducted by officials on receipt of this request, despite that corporate file system being the primary repository for all policy information held by HMT. No viable, or reasonable explanation has been offered as to why this ‘oversight’ occurred, or why the Information Asset Owner of the policy information on Amyas Morse’s iPhone had not been readily identified, or held accountable for the fact that his device was ‘wiped’ without following the authoritative procedures set out in its own internal policy rules; and not before providing formal confirmation that all policy-related information on his device had been migrated to Info Store, in order to meet the stringent requirements and legal obligations clearly in place for all government business.[56]It was suggested by Counsel that a possible explanation for all these internal policy failures was the status of Amyas Morse, as a third-party and not permanently employed by HMT, insofar as this could be claimed an ‘unusual circumstance’. I would aver that this ‘unusual circumstance’ should have demanded an even greater scrutiny, and a more intensely focused effort on ensuring that every policy requirement was fully met, and documented, in order to properly allocate, and monitor, and record the government-owned assets to which this third party had been granted access and use. To somehow claim that this excuses the abject failures which have taken place within plain sight of HMT’s senior officials is not just a security risk as the policy clearly states, but a quite damning indictment of its apparent inabilities to properly manage, monitor and secure, government-owned devices. It is unacceptable on every possible level.[57]It was attested by Mr Stephens at the hearing that the automatic synchronisation (backup) of data to iCloud is deliberately disabled on iPhones issued by HMT to authorised users. As such, and if this is to be corroborated by documented evidence, then that leaves all information on these devices totally reliant on the selective and deliberate actions of each individual user, where loss (through technical fault) or deletion (by mistake) of information could not then be retrieved. We are led to believe that the policy requirements governing this technology will dictate that a routine migration of policy (or other) data will be carried out to ensure that is all recorded within Info Store, but the lack of any automated backup function is not something thatis normal, or standard, in any IT environment where the duty to protect, and preserve information, is paramount – as it quite clearly is in government.[58]The witness evidence presented at the hearing confirmed that the ‘legal hold’ on all accounts within HMT (including Amyas Morse’s) was implemented in early 2020. It was also confirmed that this data was not automatically, or routinely filed into Info Store in the way that other information (such as documents, conversations, WhatsApp exchanges, other messages etc.) held on these devices must be migrated if it is (autonomously) determined by the user that it should be, as dictated by internal, published policy. It is reasonable to conclude that the final (draft) copy of Amyas Morse’s report would have been considered such (policy) information and would have been (routinely) filed in Info Store. This draft is the subject of a separate appeal, by another requester, which is still under consideration due to the fact that HMT have yet to comply with the Tribunal’s direction. It is also reasonable to conclude that this draft (and any other version) of his report would have been communicated by email to the intended recipients within HMT and HMRC, prior to their own ‘preview’ and ‘correction’. Given the fact that this information has been identified, and located, it is again reasonable to conclude that someone (although unlikely to be Amyas Morse), at some point, has migrated this information on his behalf to Info Store. As the Information Asset Owner of this (policy) information is apparently ‘unknown’, it is possible that this individual could have been responsible for this act, and that he/she would have ensured that this transfer to Info Store was appropriately completed, in compliance with policy. It would also be reasonable to conclude that all other policy information on his device was also transferred, to be held in accordance with HMT’s legal obligations.[59]It is therefore important to establish who that Information Asset Owner was, how frequently (and how comprehensively) they migrated policy information to Info Store, and why, in the period between receipt of my request and the hearing of this appeal, no search has still taken place to identify what is held.[60]As Appellant has previously covered information held for the purposes of FOIA by a third-party and has disputed the position taken by Counsel as to that information retained by HMT’s network provider. It is data produced, and owned by HMT, and is ‘held’ in accordance with section 3(2)(b) FOIA which provides that, in circumstances where another person holds information on behalf of a public authority, the information is considered to be held by the authority for the purposes of FOIA. It is this sub-section that is of relevance to information held in non-corporate communications channels. This was laid out clearly at item (6) of my submission to the Information Commissioner, dated 5 July 2022 (index number 31 of the Open Bundle).[61]On all the evidence previously submitted to the Tribunal, alongside that oral testimony at oral hearing, I respectfully ask that the panel also consider these final submissions, and, by allowing this appeal, to order full disclosure of the content of Amyas Morse’s account, to include (but not be limited to) all emails and attachments; also, to order that further, comprehensive and evidenced searches are carried out on Info Store to establish information held in that location, and to disclose anything that was migrated from his allocated device; further, to establish what data is held in archive by HMT’s network provider, and to order retrieval and disclosure as defined in section 3(2)(b) FOIA.

Counsel’s Submissions on behalf of HMT:

[62]The focus of this appeal is on the Decision Notice (“DN”). It is common ground that the DN is wrong, and this appeal must be allowed. But the real question is whether HMT has now complied with the Request or whether there is further information falling within the Request. There are two aspects to answering that question: a) Do the emails discovered in Amyas Morse’s email account fall within the scope of the Request; and b) Is there any other information from the iPhone – i.e. messages of any type or format – which continue to be held by HMT. These two issues are discussed by Counsel as follows;. a). Emails:[63]HMT’s position is that the emails and attachments contained within the closed bundle (and originating from Amyas Morse’s email account on ‘legal hold’) fall outside the scope of the Request.[64]The starting point is the terms of the Request. The Request is clearly aimed at capturing messages (of any format) sent or received from the Treasury smart phone supplied to Amyas Morse i.e. the iPhone. Each category of emails is addressed in turn.[65]As for Sent emails, there were 25 in total. Only one email contained a “sent from my iPhone signature”. This was clearly a message sent from the iPhone and has been disclosed. The remainder of the Sent emails were not, on a balance of probabilities, sent from the iPhone – and therefore fall outside the scope of the Request. The corroborating evidence for HMT’s position is as follows:a. It is reasonable to assume that the default signature was not changed.b. The mobile data (EE records) was not used at all from the time Lord Morse’s iPhone IT was sorted out – i.e. 18 October 2019. There was no data usage in October, November and December. Even accounting for the predominant use of WIFI, which we cannot be sure of, the very nature of a mobile phone suggests that there would be some minimal data usage while “on the move”. The fact that no data was used rather suggests that the iPhone was not used as Lord Morse’s primary device and that it was more likely than not that emails were sent from a non-iPhone device. c.The sparing (if any) usage is also consistent with Amyas Morse’s recollection of iPhone use.[66]As for Received emails, there is no technical or other search to determine where such emails were first read. But based on(i) the limited, if any, mobile data and cellular services usage; and(ii) Amyas Morse’s recollection, it appears more likely than not that Amyas Morse did not use his iPhone as his primary device and that accordingly, he read/accessed his emails on a different device. These emails too would therefore fall outside the scope of the Request on a balance of probabilities. b). Other messages i.e. SMS or WhatsApp:[67]This information is simply not held. The various avenues explored at the hearing of this appeal and in evidence are summarised below.[68]First, the information could be stored locally on the device. This information is simply not held. Information from devices is wiped out without any further retrieval/saving by IT. The expectation is that individuals/team leaders would ensure that business critical information (i.e. policies, decisions) would be saved on to the information records system, Info Store. But the device itself was clearly wiped, if not in December 2019, then plainly by December 2020 when it was re-allocated to a different official. Further, no legal authority is required to wipe a mobile device; this is routine, as per policy.[69]It should be stated that just become some aspects of HMT’s policies were not followed (e.g. filling out of leaver form), that does not mean that all policies were disregarded. These were separate processes. The wiping of a device is a routine step, to ensure that mobile devices can be re-used within the department. Further, to the extent that certain policies were not followed, this was likely symptomatic of the unusual circumstances of an independent reviewer working on HMT’s systems.[70]Further, the routine monitoring or IT logs etc. relating to the iPhone would not be saved for more than 12 months. Therefore, by the time of the request, any such data (if it existed) would have already been deleted.[71]Second, could there be a back-up? This does not exist. Mr Stephens explained how iCloud and similar systems are disabled on HMT devices. The only possible “back-up” would be if policy or decisions were manually stored on Info Store as required by policy. As for the question of “business critical” explored with counsel, the Tribunal is instead respectfully referred to two policy documents which provide a clearer overview of what type of material must be recorded:(1) Records Retention and Deletion Policy (p.546); and(2) Record Keeping Policy (p.579).[72]However, as Mr Stephens also explained, matters that were then recorded on Info Store did not necessarily correspond to or reference their source i.e. a note might be made in Word of something that originated in a conversation. There is no definite means of tracing the source of all or any documents to (in this case) Amyas Morse’s iPhone. (For the avoidance of doubt, HMT has not undertaken a review of the emails in the legal hold email account. It cannot therefore confirm if there were emails within the account that would have merited storing on Info Store.)[73]Third, does EE hold records on behalf of HMT? The short answer is no. EE does not hold data regarding private messaging services such as WhatsApp messages because these are end-to-end encrypted. EE’s privacy policy suggests that contents of SMS messages are deleted within 7 days, but in any event no SMS were sent or received by the iPhone. Most importantly, however, EE holds any information on its own behalf. In accordance with general principles, information over which a public authority has no right of control, amendment or deletion is not considered to be information which an authority holds.

Conclusion:

[74]The Tribunal accept on the material evidence and submissions before us (including the entire mailbox in the Closed Bundle at HSC1 HMT), that the contents of the mailbox assigned to Amyas Morse during the LCR is subject to a Legal hold and the 511 items in the said mailbox remain accessible. However, we do not accept that the contents of this mailbox, (apart from the one email containing the words “Sent from my iPhone “which has been disclosed) fall within the scope of the FOI request and therefore the current appeal. We accept from the material evidence before us that beyond identifying emails with the signature: “Sent from my iPhone”, there is no deeper technical search that can be conducted to determine whether any of the items were sent or received from the iPhone assigned to Amyas Morse, or another device. Accordingly, given there is only a single piece of evidence, relating to one day in mid-October, that this phone was carried, accessed or used after the end of September, we accept on the balance of probabilities that the remainder of the emails were more likely sent or received on a non-mobile device. On examination of samples, we are persuaded that the emails and attachments contained within the Closed bundle fall outside the scope of the Request. The test on the balance of probabilities means that the Appellant would have to persuade us that it is more likely than not that there is further information held by HMT that is within scope of the request which has not been disclosed. We are not persuaded that this is the case. We cannot speculate otherwise, as the Appellant invites us to do on the basis of any of the material or relevant submissions presented to us and set out at paragraphs 45 to 61 above. On the contrary we are compelled to accept and adopt the material and pertinent submissions made on behalf of the second respondent at paragraphs 62 to 73 above and accordingly we find that on the balance of probabilities HMP do not hold any further information that is within the scope of this request.[75]We make some further brief observations in support of this finding. a) The LCR in process was an independent review led by Amyas Morse with clearly identified independent personnel (some seconded from but impartial and independent of HMT). b) This was an independent review of Government Policy, not part of Government policy itself. The purpose of the Review was to prepare advice and opinion on Government policy in an independent manner to make recommendations of possible changes to Government Policy. (our emphasis). c) The Tribunal have little or no material evidence about how the LCR collated or stored their information, but on the balance of probabilities it is unlikely at the time to have been stored on the HMT corporate information store. It is likely therefore that such information and drafts as contained within the email account assigned to Amyas Morse during the LCR (contained in the Closed Bundle) would have been stored exclusively by the Review team and HMT were not privy to, or responsible for this information at the time of the Review, although it was subsequently put on ‘legal hold’ by HMT and recently discovered. d) The available records fail to demonstrate definitively who in fact used the iPhone supplied by HMT but even on accepting the possibility it was Amyas Morse who used the iPhone, we have evidence that only one of the 25 sent emails were sent by this device. While the Tribunal regard it as disproportionate to read all the other material now identified we have looked at a random but sufficient selection of samples and find that whilst they are within the work of the Review Team, for the reasons set out above it is not possible to determine which device they were received on. Drafts etc. could have been put on the device by staff of the LCR who all were engaged in an independent capacity and authorised to do so. The records do not suggest it was more likely that Amyas Morse used the iPhone more than once and it is even possible that he did not send that message personally. All in all, we simply do not have the evidence to assert that on the balance of probabilities information within the scope of the request is held by HMT. e) Any new requests or additional queries raised in the course of the appeal (including but not exclusive to issues raised about the Metadata case/s) that were not before the Commissioner are not relevant to our function which, in this case is to carry out a full merits review of the DN itself. f) The Tribunal have little or no material evidence about how the LCR collated or stored their information, but it was stored by the Review team and was clearly separate from HMT personnel input. g) It is not within the power of the Tribunal to exercise any control over the manner in which a public authority or the Information Commissioner carry out their functions. We are not empowered for example to investigate or deal with s77 breaches. Furthermore, just because a member of the public expects a public authority to carry out its functions in a certain manner, it does not mean that public authorities must always do so, and neither the Commissioner nor the Tribunal are in a position to dictate how they carry out their functions. Appellants often misunderstand the limitations of FOIA.[76]The Second Respondent has properly acknowledged severe delays and some inconsistencies with significant errors in their initial responses to this request and have apologised to the parties and the Tribunal for this. It is most unfortunate to say the least and has caused frustration, embarrassment, delay and unnecessary costs. We share the Commissioners’ criticisms. The Tribunal wish to thank the Appellant, her Proxy and Counsel for the second Respondent, together with the witnesses who gave the important evidence they could provide to the Tribunal, - all for their diligent endeavours to resolve what is undoubtedly a matter of substantial importance and of significance to the public interest engaged.[77]On considering the extensive material and relevant evidence and submissions as set out above the Tribunal find of the sent emails, there were 25 in total. Only one email contained a “sent from my iPhone signature”. This was a message sent from the iPhone and has now been disclosed. The remainder of the Sent emails, we find were not on the balance of probabilities sent from the iPhone – and therefore fall outside the scope of the Request.[78]In the absence of more tangible evidence the Tribunal cannot engage in speculation or be satisfied that on the balance there is further information held. We therefore make the substituted decision below. SUBSTITUTED DECISION[79]a) The appeal is Allowed in relation to one email containing a “sent from my iPhone" signature. This was clearly a message sent from the iPhone that is the subject of the FOIA request in this appealed Decision Notice and has been disclosed since the Appeal was adjourned on 5 July 2023. b) The remainder of the retrieved sent emails were not, on the balance of probabilities, sent from the iPhone subject of the FOIA request – and therefore fall outside the scope of the Request. Accordingly, the Tribunal require no further steps to be taken by the Second Respondent. c) As for Received emails, there is no technical or other search to determine where such emails were first read. But based on(i) the limited, if any, mobile data and cellular services usage by Amyas Morse whilst leading the Independent Loan Charge Review; and(ii) Amyas Morse’s recollections, it appears more likely than not that Amyas Morse did not use his iPhone as his primary device and that accordingly, he read/accessed his emails on a different device(s). on a balance of probabilities these emails too would therefore fall outside the scope of the Request. d) In relation to other messages (i.e. SMS or WhatsApp. Etc.): On the evidence before us, we find that this information is simply not held, and was not held at the date of the request. e) The Second Respondent is not required to take any further steps. Brian Kennedy KC 14 February 2024.

Cited in 1 later judgment