Andrew Sheldon v The Information Commissioner & Anor [2024] UKFTT 231 (GRC)

[2024] UKFTT 00231 (GRC)Case Reference: EA/2023/0183
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 19 December 2023Date 20 March 2024
Information Rights
Heard by: remote video hearing (cloud video platform)
Before
TRIBUNAL JUDGE STEPHEN ROPERTRIBUNAL MEMBER PAUL TAYLORTRIBUNAL MEMBER RAZ EDWARDS
Between
ANDREW SHELDONAppellantTHE INFORMATION COMMISSIONERRespondentCASTLE POINT BOROUGH COUNCILRespondentin person for Appellant for First Respondent: did not appear and was not represented for Second Respondent: Matthew Lewin of CounselDecision: The appeal is DismissedREASONS

Preliminary matters

[1]In this decision, we use the following terms to denote the meanings shown: Appellant: Andrew Sheldon. Balancing Test: The last question of the Legitimate Interests Test, as referred to in paragraph 53. Commissioner: The Information Commissioner. Council: Castle Point Borough Council. Decision Notice: The Decision Notice of the Commissioner dated 10 March 2023, reference IC-206661-L1Y2, relating to the Request. DPA: The Data Protection Act 2018. Duty to Inform: The duty of a public authority to confirm whether or not it holds information which is requested, pursuant to section 1(1)(a) of FOIA (set out in paragraph 36). First Data Protection Principle: The first data protection principle under Article 5(1)(a) of the UK GDPR (as referred to in paragraph 45.b). FOIA: The Freedom of Information Act 2000. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f) of the UK GDPR, as set out in paragraph 46. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 52. LGA: The Local Government Act 1972. Public Interest Test: The test as to whether, in all the circumstances of the case, the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the public authority holds the information, pursuant to section 2(1)(b) of FOIA (set out in paragraph 39). Request: The request for information made by the Appellant dated 22 September 2022, as referred to in paragraph 8. Requested Information: The information which was requested by way of the Request. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.[2]Unless the context otherwise requires (or as otherwise expressly stated), references in this decision to numbered paragraphs are to paragraphs of this decision so numbered.[3]Nothing we say in this decision should be taken as an indication as to whether or not any of the Requested Information is held by the Council.

Introduction

[4]This is an appeal against the Decision Notice, which (in summary) held that section 40(5B)(a)(i) of FOIA applied in respect of the Request and accordingly the Council was entitled to neither confirm nor deny whether it held the Requested Information. The Commissioner did not require the Council to take any steps.

Mode of Hearing

[5]The proceedings were held by the cloud video platform. The Tribunal panel and the parties (with the exception of the Commissioner) joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.[6]The Appellant attended in person. The Council was represented by Matthew Lewinof Counsel. The Commissioner did not attend the hearing and was not represented (having previously indicated that he would be content with the appeal to be determined on the papers).

Background to the Appeal

[7]The background to the appeal is as follows.

The Request

[8]On 22 September 2022, the Appellant wrote to the Council, requesting information in the following terms:
“Please may you provide me with: The Agendas of any and all meetings of Castle Point Borough Council committees, Castle Point Borough Council sub-committees, or meetings of any other formal decision-making body made up of Castle Point borough councillors, that took place at the Castle Point Borough Council Offices in Kiln Road, between the dates of 15th August 2022 and 30th August 2022. The Minutes of any and all meetings of Castle Point Borough Council committees, Castle Point Borough Council sub-committees, or meetings of any other formal decision-making body made up of Castle Point borough councillors, that took place at the Castle Point Borough Council Offices in Kiln Road, between the dates of 15th August 2022 and 30th August 2022. The subject titles of any and all reports presented to any and all meetings of Castle Point Borough Council committees, Castle Point Borough Council sub-committees, or meetings of any other formal decision-making body made up of Castle Point borough councillors, that took place at the Castle Point Borough Council Offices in Kiln Road, between the dates of 15th August 2022 and 30th August 2022.”
.

The Council’s reply and subsequent review

[9]The Council responded on 19 October 2022, citing section 40(5B)(a)(i) of FOIA to refuse to confirm or deny whether the Requested Information was held.[10]Following an internal review, the Council contacted the Appellant on 7 December 2022 upholding its position.[11]On 12 December 2022, the Appellant contacted the Commissioner complaining about the Council’s response to the Request.

The Decision Notice

[12]The Commissioner stated in the Decision Notice that the following two criteria must be met if the Council would be entitled to rely on section 40(5B) of FOIA to refuse to confirm or deny whether it held the Requested Information:a. confirming or denying whether the Requested Information was held would constitute the disclosure of a third party’s personal data; andb. providing this confirmation or denial would contravene one of the data protection principles.[13]In the Decision Notice, the Commissioner set out his views on the application of those two criteria. Having regard to the Requested Information, the Commissioner considered that if the Council was to hypothetically deny holding it then this would disclose that no disciplinary action had been taken against Council staff and that this would disclose personal data of a third person.[14]The Commissioner concluded that the Council was entitled to rely on section 40(5B)(a)(i) of FOIA, on the basis that confirmation or denial would confirm whether or not disciplinary procedures had been instigated against Council staff. The appeal The grounds of appeal

The appeal

[15]The relevant material points raised in the Appellant’s grounds of appeal were (in summary) as follows:a. much of the Requested Information could be disclosed without disclosing any personal information;b. the Requested Information is information which the Council is required by law (the LGA and associated legislation) to have published and made available for a specified period in any event;c. it was therefore lawful to make disclosure of personal data in accordance with Article 6(1)(c) of the UK GDPR;d. not only was it lawful to make disclosure, but the Council was in breach of its statutory obligations elsewhere by not supplying the relevant information.[16]The Appellant’s grounds of appeal also stated that the decision notices cited by the Commissioner (in paragraph 35 of the Decision Notice) did not provide support for his conclusion in the Decision Notice.

The Commissioner’s response

[17]In his response to the appeal, the Commissioner generally relied on the reasons given in the Decision Notice in support of his view that the appeal should be dismissed.[18]The Commissioner also provided some further background information in his response to the appeal, to the effect that the Appellant was the former leader of the Council and that, by virtue of that position he was aware of information that may not otherwise be publicly available.[19]The material additional points made by the Commissioner were (in summary) as follows:a. the above background context was an important consideration, as was the fact that the Request only sought any agendas, minutes, and subject titles of reports for a narrow time period (15 August 2022 to 30 August 2022);b. whilst the Request did not refer to disciplinary action, owing to the Appellant’s knowledge of other matters relevant to this issue, a hypothetical denial that information within the scope of the request was held would disclose that disciplinary action had not been instigated, thereby disclosing personal data;c. disciplinary action was not only any final outcome with regard to matters such as reprimands, but also the act of pursuing a disciplinary process which in itself would reveal personal data relating to an individual (namely, that they had been the subject of such a process, even if they were not then reprimanded);d. within that context, it was permissible to take into account the knowledge of the Appellant in considering the “motivated intruder” test See paragraph 5 8 for relevant case law regarding the ‘motivated intruder’ test. in respect of anonymisation and in order to determine whether or not personal data would be disclosed;e. whether or not the Council ought to disclose information under the LGA or other legislation, or had breached any statutory obligations in not doing so, was not a matter for the Commissioner or the Tribunal to address; andf. in any event, certain minutes and reports can be withheld under the LGA (a point which was accepted by the Appellant).

The Council’s response

[20]In its response to the appeal, the Council gave more details on the background relating to the Appellant, stating that he was an elected member of the Council between 2010 and 2022 and that he was the leader of the Council from May 2021 but lost his seat at the local elections in May 2022.[21]The Council’s position was, in essence, that the Decision Notice was correct for the reasons set out in it.[22]The Council acknowledged that the Request, if it was read in isolation and without regard to any wider context, did not explicitly seek disclosure of information about disciplinary proceedings relating to officers of the Council. However, it considered that the “motivated intruder” test applied (from the perspective of a “determined person with a particular reason to want to identify the individual”) and accordingly that it was necessary to consider that person’s background or prior knowledge.[23]The Council submitted that the Appellant, by virtue of his position as the former leader of the Council, has a great deal of background and prior knowledge which he could use to work out whether or not disciplinary proceedings had been instigated against specific, identifiable officers of the Council. The Council’s position was therefore that the Commissioner was correct to conclude that compliance with the Duty to Inform would result in the disclosure of personal data.[24]The Council also submitted that the Commissioner was correct in deciding that only the Legitimate Interests Basis provided a relevant lawful basis for disclosure and that the remaining lawful bases in Article 6(1) of the UK GDPR were not applicable. In respect of the Balancing Test, the Council’s view was that the Commissioner was correct in concluding that the balance came down in favour of protecting the legitimate interests and fundamental rights and freedoms of the data subjects, even though the Commissioner did not expressly deal with the arguments raised by the Appellant as to the effect of the statutory code in Part VA of the LGA This is the part of the LGA entitled “Access to Meetings and Documents of Certain Authorities, Committees and Sub-Committees” and deals (amongst other things) with rights of access to, including obligations of local authorities to publish, certain information. in his consideration of the Balancing Test.[25]Elaborating on its submissions in respect of the Balancing Test, the Council argued that:a. the starting point was that the data subjects would have a strong (and reasonable) expectation of privacy in relation to the question of whether they had been subject to disciplinary proceedings, whether they were senior or junior members of staff;b. there could be no question that compliance with the Duty to Inform would reveal whether or not identifiable Council officers had been subject to disciplinary action;c. therefore unrestricted disclosure to the world at large would therefore constitute “a very serious and damaging invasion of privacy”; andd. that expectation of privacy clearly outweighed any expectation that the officers may have vis-à-vis the publication of any meeting agenda where a Council committee is considering disciplinary action against them. Whilst it was accepted that, where a disciplinary matter is to be considered at a Council committee meeting, pursuant to the LGA the relevant officers in question would be taken to expect that the meeting agenda would be made available for public inspection, that expectation would be subject to certain safeguards relating to their identity not being known publicly - and those safeguards were not present in this case.[26]The Council also submitted that the Council’s compliance with duties under the LGA was outside of the remit of both the Commissioner and the Tribunal, and accordingly that the Appellant’s reliance on the statutory code in Part VA of the LGA was overstated and would not affect the overall outcome of the Balancing Test.

The Appellant’s reply to the Commissioner’s response

[27]In his reply to the Commissioner’s response, the Appellant:a. clarified that his position was that some parts of reports and minutes comprising the Requested Information may not need to be published under the LGA;b. disputed that confirming or denying whether or not the Requested Information was held would result in the release of personal information, citing various examples of agendas and public minutes of meetings of other local authorities on items relating to confidential staffing matters that were conducted according to the LGA which did not contain any identifiable information about the staff involved; andc. contended that the Commissioner had not properly assessed various matters (including, in particular, the Council’s duties to publish certain information under the LGA) and consequently could not have properly reached a conclusion as to whether or not release of the Requested Information, or any confirmation or denial as to whether or not the Requested Information was held, was a breach of the data protection principles without having done so.[28]In essence, the Appellant considered that:a. it could not be wrong to release information under FOIA if the information was required to be disclosed under the LGA;b. the Council would be prevented from complying with its obligations under the LGA regarding the establishment of statutory committees for disciplinary procedures and the publication of associated agendas if the Commissioner was correct that the publication would breach data protection legislation.[29]The Appellant re-asserted that:a. confirming or denying whether or not the Council held any meetings falling within the scope of the Request would not lead to the release of any personal information; andb. it was fair (and not a breach of any data protection principles) to release the Requested Information, given that the Council was required by law to release the information.

The Appellant’s reply to the Council’s response

[30]In his reply to the Council’s response, the Appellant accepted that the Legitimate Interests Basis would apply but stated that it must be in the legitimate interests of the Council to release the Requested Information, given that the Council was required by law to release it under the LGA.[31]The Appellant submitted that factors which must be considered in the Balancing Test included:a. the Council’s publication scheme adopted under section 19 of FOIA requires it to publish all information put before councillors, unless it is exempt (and the Appellant had not requested any exempt information, as agendas are never exempt from publication);b. there was significant public interest in knowing whether the Council was complying with its publication scheme and other laws;c. if any personal information was released as part of the Requested Information, it was no more than the Council was required by law to release on an unrestricted basis in any event;d. there was therefore no reasonable argument that the interests or the fundamental rights of the data subjects override or eliminate the interests of the Council, given what the law already requires of the Council;e. other local authorities had published agendas, including records of meetings discussing staffing and disciplinary matters (as referred to in the Appellant’s reply to the Commissioner’s response).[32]The Appellant disputed that releasing the Requested Information, or complying with the Duty to Inform, would reveal whether any one individual had been subject to disciplinary proceedings. The Appellant asserted that, even if it did, it would only be releasing information which the Council was required to publish in accordance with its publication scheme and the LGA.[33]With respect to the safeguards referred to by the Council regarding the privacy of individuals (see paragraph 25.d), the Appellant contended that there was no difference between publication or inspection under the Council's publication scheme or under the LGA and release under FOIA. The Appellant submitted that it would produce an “absurd result” if release under FOIA was a breach of the UK GDPR in circumstances when release of the same information under the publication scheme or LGA is not.

The Tribunal’s powers and role

[34]The powers of the Tribunal in determining the appeal are set out in section 58 of FOIA, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[35]In summary, therefore, the Tribunal’s remit for the purposes of the appeal is to consider whether the Decision Notice was in accordance with the law, or whether any applicable exercise of discretion by the Commissioner in respect of the Decision Notice should have been exercised differently. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. The law The relevant statutory framework General principles

The law

[36]Section 1(1) of FOIA provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[37]In essence, under section 1(1) of FOIA, a person who has requested information from a public authority (such as the Council) is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, these entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) of FOIA provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[38]It is therefore important to note that section 1(1) of FOIA does not provide an unconditional right of access to any information which a public authority does hold, nor an unconditional right even to be told if the information is held by the public authority. The rights contained in that section are subject to certain other provisions of FOIA, the relevant aspects of which we address below.

Exemptions

[39]Section 2(1) of FOIA addresses potential exclusions to the Duty to Inform. That section provides: “Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—(a) the provision confers absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.”.[40]Accordingly, where any exemption in Part II of FOIA applies then it negates the duty of a public authority to confirm or deny whether or not it holds information which is requested. This means the public authority is permitted to neither confirm nor deny that it holds the requested information.[41]Pursuant to the provisions of section 2(1) of FOIA, some of the exemptions to the Duty to Inform set out in Part II of FOIA are absolute and some are subject to the application of a public interest test. Where an applicable exemption is not absolute and the public interest test applies, this means that a public authority may neither confirm nor deny whether or not it holds requested information under that exemption if the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether it holds the information (this being the ‘Public Interest Test’ referred to in this decision).[42]Section 2(3) of FOIA explicitly lists which exemptions in Part II of FOIA are absolute. Pursuant to that section, no other exemptions are absolute. For the purposes of this appeal, the relevant exemption is contained in section 40(5B) of FOIA and that section is not included in that list.[43]Therefore the relevant exemption referred to in the Decision Notice (section 40(5B)(a)(i) of FOIA) is subject to the Public Interest Test.

Section 40 of FOIA

[44]So far as is relevant for the purposes of this appeal, section 40(5B) of FOIA provides: “The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles…”.[45]Section 40(7) of FOIA sets out applicable definitions for the purposes of section 40, by reference to other legislation. For the purposes of this appeal, the relevant points are as follows:a. the “data protection principles” are those set out in Article 5(1) of the UK GDPR and section 34(1) of the DPA;b. the first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”;c. section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”;d. an “identifiable living individual” is defined in section 3(3) of the DPA as “a living individual who can be identified, directly or indirectly…”;e. a “data subject” is defined in section 3(5) of the DPA and means “the identified or identifiable living individual to whom personal data relates”; andf. the “processing” of information relating to a data subjectincludes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and therefore includes disclosure under FOIA.[46]With regard to the First Data Protection Principle, for any processing of personal data to be lawful, it must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…” (Article 6(1)(f) of the UK GDPR).[47]Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA, meaning that the Legitimate Interests Basis can be taken into account in determining whether the First Data Protection Principle would be contravened by the disclosure of information by a public authority under FOIA.[48]Certain recitals to the UK GDPR, set out below, are also relevant.[49]The first recital to the UK GDPR provides: “The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.”.[50]The second recital to the UK GDPR states: “The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”.[51]Recital 26 to the UK GDPR includes the following:
“The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.”
. Relevant case law Personal data and the Legitimate Interests Basis

Relevant case law

[52]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[53]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last question of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[54]The approach set out above in the South Lanarkshire case was subsequently reiterated in the Upper Tribunal in the case of Goldsmith International Business School v Information Commissioner and Home Office [2014] UKAT 563 . In the Goldsmith case, Upper Tribunal Judge Wikeley also provided further helpful guidance relevant to this appeal, setting out various propositions derived from the relevant case law. We refer to those propositions in more detail in our discussions below.[55]We should perhaps make it clear that the relevant test in this context, the Legitimate Interests Test, is different to the relevant public interest test arising under FOIA. As explained by Upper Tribunal Judge Kate Markus QC (now KC) in the case of Information Commissioner v Halpin [2019] UKUT 29, paragraph 29 :
“At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”
. FOIA creates a general right to information subject to the exemptions in section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”.” “…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”.”

The public interest test

[56]In the case of O’Hanlon v Information Commissioner [2019] UKUT 34 (AAC), paragraph 15. , it was held that the public interest test under FOIA (for the purposes of this appeal, the ‘Public Interest Test’) required the following three-step approach: “The first step is to identify the values, policies and so on that give the public interests their significance. The second step is to decide which public interest is the more significant. In some cases, it may involve a judgment between the competing interests. In other cases, the circumstances of the case may(a) reduce or eliminate the value or policy in one of the interests or(b) enhance that value or policy in the other. The third step is for the tribunal to set out its analysis and explain why it struck the balance as it did. This explanation should not be difficult if the tribunal has undertaken the analysis in the first two steps properly. It may even be self-evident.”.[57]The public interest test under FOIA is applied as at the time when the public authority refused disclosure of requested information; it cannot be re­assessed later, in the event of an appeal to the First-tier Tribunal, by reference to any public interest which has subsequently arisen (see, for example, the case of Maurizi v Information Commissioner and another [2019] UKUT 262 (AAC), paragraphs 181-184 ).

Indirect identification of individuals – the ‘motivated intruder’ test

[58]The Upper Tribunal case of The Information Commissioner v Miller [2018] UKUT 229 (AAC) considered the case law on the question of whether an individual is capable of being identified indirectly. In that case, dealing with the question of whether personal data was ‘anonymised’, Upper Tribunal Judge Kate Markus QC (as she was then) helpfully summarised the relevant authorities as follows Paragraphs 10 to 13 of that case. :
“The correct approach to the application of section 1(1)(b) This was referring to section 1(1)(b) of the Data Protection Act 1998, which was in force prior to the DPA, and which set out the definition of ‘personal data’ for the purposes of the 1998 Act. to disclosure of anonymised data was addressed by the House of Lords in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550. That decision was discussed by the Administrative Court in R (Department of Health) v Information Commissioner [2011] EWHC1430 (Admin). Cranston J explained that the House of Lords had decided that, even though the data controller holds the key to identification of individuals to which the data relates, whether it is personal information when disclosed depends on “whether any living individuals can be identified by the public following disclosure of the information” (paragraph 52). In Information Commissioner v Magherafelt District Council [2013] AACR 14 the Upper Tribunal said that the decision in Department of Health meant that the proper approach to whether anonymised information is personal data within section 1(1)(b), for the purposes of a disclosure request, is to consider whether an individual or individuals could be identified from it and other information which is in the possession of, or likely to come into the possession of a person other than the data controller after disclosure. In the Department of Health case Cranston J said at paragraph 66 that the assessment of the likelihood of identification included “assessing a range of every day factors, such as the likelihood that particular groups, such as campaigners, and the press, will seek out information of identity and the types of other information, already in the public domain, which could inform the search.”
As for the likelihood of identification, Recital 26 of the preamble to the Directive This was referring to the EU GDPR (the General Data Protection Regulation (EU) 2016/679) and is applicable also to the UK GDPR (see paragraph 5 1). provides that “account should be taken of all the means likely reasonably to be used”. In Magherafelt the Upper Tribunal acknowledged the “motivated intruder” test advanced by the Information Commissioner:
“37 …A ‘motivated intruder’ was ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’. The question was then one of assessment by a public authority as to ‘… whether, taking account of the nature of the information, there would be likely to be a motivated intruder within the public at large who would be able to identify the individuals to whom the disclosed information relates.’ While not expressly adopting that test, the approach of the Upper Tribunal in that case was consistent with it. A similar approach was taken by the Court of Session (Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at paragraph 24: “…it is not just the means reasonably likely to be used by the ordinary man on the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist…”.” “assessing a range of every day factors, such as the likelihood that particular groups, such as campaigners, and the press, will seek out information of identity and the types of other information, already in the public domain, which could inform the search.” “37 …A ‘motivated intruder’ was ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’. The question was then one of assessment by a public authority as to ‘… whether, taking account of the nature of the information, there would be likely to be a motivated intruder within the public at large who would be able to identify the individuals to whom the disclosed information relates.’ “…it is not just the means reasonably likely to be used by the ordinary man on the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist…”.”

The hearing and evidence

[59]The Tribunal read and took account of an open bundle of evidence and pleadings. We also read and took account of a closed bundle and some final written submissions from the Appellant. The Tribunal also received, during the hearing, a separate bundle of authorities from the Council together with an article from a law firm regarding statutory officer disciplinary investigations.[60]We heard oral submissions from the Appellant and from Mr Lewin on behalf of the Council. The submissions from the Appellant and Mr Lewin generally addressed and elaborated on the points raised in the grounds of appeal and the response to the appeal, respectively.[61]A separate closed session (without the Appellant in attendance) was also briefly held, where certain submissions were made by Mr Lewin on behalf of the Council. A gist of the separate closed session was subsequently prepared by the Council and provided to the Tribunal and the other parties. Discussion and findings; application of the law Outline of relevant issues

Discussion and findings; application of the law

[62]In accordance with the remit of the Tribunal to which we have referred, the fundamental issue which we needed to determine in the appeal was whether the Commissioner was correct to conclude, in the Decision Notice, that the Council could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny whether it held the Requested Information.[63]This means we needed to determine:a. whether confirming or denying that the Requested Information was held would constitute the disclosure of someone’s personal data;b. if so, whether confirming or denying that the Requested Information was held would contravene any of the data protection principles;c. if so, whether (in all the circumstances) the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether or not the Council holds the Requested Information. Would confirming or denying that the Requested Information was held constitute the disclosure of someone’s personal data?[64]In considering whether personal data is involved, we remind ourselves (with regard to the relevant definitions referred to in paragraph 45) that ‘personal data’ means “any information relating to an identified or identifiable living individual” and that an ‘identifiable living individual’ means “a living individual who can be identified, directly or indirectly…”.[65]The fact that personal data includes information relating to someone who can be identified “indirectly” is a pertinent point in the appeal. The Commissioner and the Council have both referred to the ‘motivated intruder’ test. As we have noted, the applicable principles of that test have been confirmed in case law. Those principles essentially relate to the possibility that a person (the ‘motivated intruder’) would be able to identify individuals to whom any disclosed information relates, including a determined person who will use additional means to try to identify the individual. As referred to in recital 26 to the UK GDPR:a. the means reasonably likely to be used by that person to identify the individual (directly or indirectly) are to be taken into account, including the “singling out” of the individual by that person; andb. to ascertain whether means are reasonably likely to be used, “account should be taken of all objective factors, such as the costs of and the amount of time required for identification”.[66]Summarising the above, where a person could, using means which are reasonably likely to be used (taking into account all objective factors), identify an individual to whom any information relates, then that information will constitute personal data.[67]Hypothesising that the Requested Information is held by the Council and that there are individuals which are the subject of it, we find that the Appellant would be able to identify those individuals. This is because of his particular knowledge as a former leader of the Council and the proximity of his holding of that position and the dates applicable to the Requested Information (the Requested Information covering a two-week period in August 2022, with the Appellant being a leader of the Council until May 2022). In that regard, there is no need to consider further means (with regard to the ‘motivated intruder’ test) which the Appellant could use to identify the individuals. In other words, we find that the ‘motivated intruder’ test is easily satisfied in the current circumstances, taking into account the Appellant’s previous role and the associated knowledge that he has.[68]We accept that the Request did not expressly refer to information about disciplinary proceedings relating to officers of the Council. However, we find that the Appellant would have relevant background knowledge as to the timings of when such disciplinary proceeding were likely to have taken place and when they were likely to be subsequently reported to relevant committees. This would mean he could ascertain whether or not disciplinary proceedings had been instigated against individual officers of the Council.[69]Given our finding that the Appellant would be able to identify the relevant individuals from the Requested Information, it follows that we must find that the Requested Information comprised personal data (as per the definition of ‘personal data’).[70]We also find that the act of pursuing a disciplinary process would itself have the potential to reveal personal data, regardless of the outcome of that process (namely, whether or not any identifiable individual was ultimately disciplined or exonerated). It follows that if no disciplinary process was instigated then this would also be capable of revealing personal data (in the sense of showing that no disciplinary action was taken against an identifiable individual). Consequently (and taking into account that any applicable individuals would be identifiable because of the Appellant’s knowledge), we find that confirming or denying that the Requested Information was held would disclose personal data.[71]Therefore we find that the application of section 40(5B) is not precluded in respect of the Request and that that section is therefore capable of being engaged. Would confirming or denying that the Requested Information was held contravene any of the data protection principles?[72]We do not consider it necessary to explore each of the data protection principles. In the context of the appeal and the Requested Information, we consider that the most relevant data protection principle is the First Data Protection Principle, relating to (amongst other things) personal data being processed lawfully.

Lawful Basis of Processing

[73]In assessing whether the processing of the personal data in question would be lawful, we also consider that the most applicable lawful basis for processing (in the context of the appeal and the Requested Information) is the Legitimate Interests Basis. This is because the relevant data subjects have not consented to the processing of their personal data in connection with the Request and it is obvious that no other lawful basis would apply. Legitimate Interests Basis[74]It may be helpful to reiterate the Legitimate Interests Basis. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
. Translating that language to the context of this appeal: a. the disclosure of the Requested Information under FOIA would be ‘processing’; b. the Appellant is the ‘third party’; and c. the ‘data subject’ would be a member of the Council staff (given our findings in paragraphs 69 and 70).[75]Accordingly, in the case of a request for information under FOIA, where the information which is requested contains the personal data of a data subject then that personal data would be processed when it is disclosed in response to the request. As we have noted, in respect of the First Data Protection Principle, this means that the information can only be disclosed if to do so would be lawful, fair and transparent.[76]The above principles also apply when a public authority, in response to a request for information under FOIA, confirms or denies that it holds the information which is requested. This is because it can be possible for inferences to be drawn from an acknowledgement of the fact that information is held or not held and consequently that could constitute a disclosure of personal data. Accordingly, a public authority (as we have noted) can in some circumstances refuse to confirm or deny that it holds information, as an exclusion of the Duty to Inform. The aim of such a response (a ‘neither confirm nor deny’ response) is to leave entirely open the position about whether the public authority holds the information which has been requested, so that no inferences can be drawn either way.

Legitimate Interests Test

[77]As the applicable lawful basis of processing of the relevant personal data is the Legitimate Interests Basis, the Legitimate Interests Test must therefore apply.[78]Given the legal framework which we have outlined earlier, we consider that it is helpful to address the propositions from the Goldsmith case which we briefly noted above regarding the Legitimate Interests Test. As mentioned, in that case Upper Tribunal Judge Wikeley listed From paragraph 35 onwards of that case. various propositions derived from case law as to the correct approach to be adopted. We set out seven of those propositions below (some of which we paraphrase or otherwise summarise) and we address each in turn with regard to the facts of this appeal. For completeness, we should mention that Judge Wikeley also referred to an eighth Proposition in the Goldsmith case, but this related to tests which were applied in relevant case law and which does not alter the other seven propositions we refer to.[79]Applying the propositions is not a sequential process, in that some later numbered propositions need to be considered and determined before returning to earlier numbered propositions. Moreover, some earlier numbered propositions may be superfluous after applying later numbered propositions.[80]Proposition 1: The three questions set out in the South Lanarkshire case (as we have addressed above – namely, the Legitimate Interests Test) must be applied. Consequently:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? In this case, it would be the Appellant’s interests which are applicable, as the third party which is the requester of the relevant information. The Appellant referred to the Council’s statutory duties in his correspondence with the Council (when requesting an internal review following the Council’s response to the Request) and later in his correspondence with the Commissioner regarding the subsequent complaint. The Appellant also stated (in his reply to the Council’s response to the appeal) that there was a public interest in identifying whether the Council was complying with its publication scheme adopted under section 19 of FOIA and its obligations under the LGA. We find that the aim of the Appellant in seeking the Requested Information was to identify whether there was such compliance. We also find that such aim is a legitimate one and accordingly that there was a legitimate interest being pursued by the Appellant by way of the Request. We note that the Commissioner considered, in paragraph 22 of the Decision Notice, that there was a legitimate interest in understanding whether disciplinary action had been taken in relation to Council staff. However, whilst we accept that that could be a legitimate interest, we find that there was insufficient evidence to justify the Commissioner holding the view that this was the legitimate interest being pursued by the Appellant.b. Is the processing involved necessary for the purposes of those interests? In order to address this, we need to turn to Propositions 3 to 5 (inclusive), which we do below.c. Are those interests overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data? Given Proposition 2, we do not address this question at this stage, but comment on this later.[81]Proposition 2: The test of “necessity” under the second of those questions must be met before the third question can be considered. Again, this requires us to turn to Propositions 3 to 5 (inclusive).[82]Propositions 3 to 5 (inclusive) all relate to the concept of ‘necessity’ and so we group them together before commenting on them:a. Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity.b. Proposition 4: It follows that the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality (albeit this may not add much to the ordinary English meaning of ‘necessity’).c. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.[83]With regard to those three propositions, we note that Lady Hale, in the South Lanarkshire case, stated that the word “necessary” must be considered in relation to the processing to which it relates.[84]We also note that, in the Halpin case, Upper Tribunal Judge Kate Markus QC (now KC) stated that: Paragraph 31 of that case. “the Goldsmith guidance…makes it clear that the question whether there are alternative measures (proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it…”. In the more recent case of Kol v Information Commissioner and Reigate and Banstead BoroughCouncil [2022] UKUT 74, paragraph 22. , Upper Tribunal

Judge Edward Jacobs stated:

“If there is another way of satisfying [the requestor’s] legitimate interests without disclosing the information, then disclosure is not necessary”
. This principle would apply to confirming whether or not the information is held, as well as the disclosure of the information.[85]It is helpful to remind ourselves of the relevant wording from Lady Hale’s judgment in the South Lanarkshire Paragraph 27 of that case. case, in respect of which Upper Tribunal Judge Edward Jacobs was commenting and which is the authoritative decision on the meaning of ‘necessary’ for current purposes: “It is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15, [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”.[86]We consider that these principles (together with others from additional cases cited in the Goldsmith case) are encapsulated in the three propositions (namely, Propositions 3, 4 and 5). In our view, therefore (and taking into account the above comments of Upper Tribunal Judge Kate Markus QC in the Halpin case), we need to consider all three of those propositions in assessing whether or not the potential processing of the third-party personal data (namely, disclosure by way of confirming or denying if the Requested Information is held) was necessary for the purposes of the legitimate interest being pursued by the Appellant by way of the Request.[87]As noted, the legitimate interest being pursued by the Appellant was identifying whether the Council was complying with its statutory obligations. On the facts of this case, we find that it is not necessary (within the meaning outlined in all three of those propositions) for there to be confirmation or denial as to whether the Requested Information is held in order to achieve that legitimate interest. This is because, in our view, that legitimate interest is fulfilled by the existence of other means for identifying and pursuing whether the Council has complied with its relevant statutory obligations (such as judicial review proceedings, the Local Government & Social Care Ombudsman scheme and even the Council’s own complaints procedures). During the hearing, we asked the Appellant about potential recourse to the Local Government & Social Care Ombudsman and the Appellant commented that he had not pursued that but just used FOIA instead. It is outside of the powers of the Tribunal to ascertain or opine on whether or not those alternatives are sufficient or flawed in any way, but the existence of these alternatives is germane to our assessment of ‘necessity’, having regard to the relevant legal principles and tests we have outlined.[88]As we have explained, the remit of the Tribunal is to determine whether or not the Decision Notice was in accordance with the law (and not to assess or determine whether there was any wrongdoing by the Council or the merits of any means by which any alleged wrongdoing could be identified or pursued). In this regard, we remind ourselves that when a third party’s personal data is potentially involved in respect of any request for information under FOIA:a. the starting point (in accordance with the legislation and case law we have referred to) is the principle of the protection of privacy with respect to the processing of personal data; andb. disclosure of personal data (in this case, by way of confirming or denying if the Requested Information is held) must be necessary, within the meaning outlined in the three propositions we have referred to, for the purposes of the legitimate interests being pursued with regard to such request for information.[89]In addition, as set out in Proposition 5 (and taken from the judgment of Lady Hale in the South Lanarkshire case):
“a measure would not be necessary if the legitimate aim could be achieved by something less”
. The fact that there is something less which can achieve the Appellant’s legitimate aim is a relevant point in this appeal. Again, it is not for the Tribunal to determine the merits of, or other matters pertaining to, the ‘lesser means’ by which the Appellant’s legitimate interest may be met, but rather for us to take into account in our decision making (as part of our assessment of ‘necessity’, as we have outlined) whether or not there are other means by which that legitimate interest could be achieved.[90]Consequently, we find that the Commissioner was wrong to conclude (in paragraph 24 of the Decision Notice) that it would be necessary to confirm or deny whether the Requested Information is held to meet the Appellant’s legitimate interest.[91]At this juncture, we should return to Proposition 2. As we have noted, this requires the test of “necessity” under the second of the questions in Proposition 1 to be met before the third of those questions can be considered. Given our finding that the processing involved is not necessary for purposes of the legitimate interest being pursued by the Appellant (that is, our answer to the second question is negative) then, in accordance with Proposition 2, we do not need to consider the third of the questions in Proposition 1 (the Balancing Test). In other words, as we have reached the conclusion that, for the purposes of section 40(5B)(a)(i) of FOIA, the disclosure of personal data (by way of ‘confirmation or denial’) is not necessary and therefore the Legitimate Interests Basis is not satisfied, we do not need to go on to consider the Balancing Test between the legitimate interest of the Appellant and the rights and freedoms of third party data subjects.[92]Proposition 6: Where there are no issues regarding an individual’s privacy rights, the question posed under Proposition 1 can be resolved at stage (ii) of the three-part test referred to (that is, the question can be resolved at the ‘necessity’ stage of the Legitimate Interests Test). Clearly, the appeal involves issues regarding the privacy rights of individuals (namely, potential third-party data subjects) and therefore Proposition 6 is not applicable.[93]Proposition 7: Where there are issues regarding an individual’s privacy rights, the question posed under Proposition 1 can only be resolved after considering stage (iii) of the three-part test referred to - namely, the Balancing Test. For the reasons given, this appeal involves issues regarding the privacy rights of individuals (potential third-party data subjects). However, as we have stated, given the application of Proposition 2 and our findings on ‘necessity’, we do not need to consider the third of the questions in Proposition 1 (the Balancing Test). Accordingly, Proposition 7 becomes redundant in the context of this appeal.

Relevance of the Local Government Act 1972

[94]Various arguments have been put forward by the parties in respect of the application of certain provisions of the LGA which pertain to the Council’s duty to publish certain information. As we have noted, the Appellant argued that the Requested Information should have been disclosed pursuant to the LGA. We do not think that it is necessary to undertake a detailed analysis of the relevant provisions of the LGA. We do note, however, that whilst the LGA requires certain information to be published See, for example, section 100B of the LGA. , it also makes provision for certain exemptions to those requirements (a point which was common ground between the parties), which include where the relevant information relates to an individual or is likely to reveal the identity of an individual. Part 1 of Schedule 12A to the LGA. Those exemptions are also subject to some qualifications, including a ‘public interest’ test, Paragraph 10 of Part 2 of Schedule 12A to the LGA. but for current purposes the relevant point is that there are some exemptions to the publication requirements under the LGA where personal data is involved. We therefore find that the relevant data subjects would not necessarily expect that there would be disclosure of their personal data merely because they are officers of the Council or the subject of applicable meetings. Put another way, we find that the data subjects would have an expectation of privacy in certain circumstances, notwithstanding their role or status within the Council.[95]Whether or not the Requested Information is held by the Council, we find that the Council has not published any Requested Information pursuant to the LGA. Even if (hypothetically) the Council holds the Requested Information, whether or not it was right not to publish it (or, in other words, whether or not the LGA was complied with by the Council) is not an issue which we could determine, having regard to our powers as set out in paragraph 34 (and summarised in paragraph 35). The fact is that there has been no such publication, which is an additional factor supporting our view that there is a certain expectation of privacy on the part of the relevant data subjects. Did (in all the circumstances of case) the public interest in maintaining the exclusion of the Duty to Inform outweigh the public interest in disclosing whether or not the Council holds the Requested Information?[96]As we have noted, section 40(5B) of FOIA is not an absolute exclusion and accordingly the Public Interest Test must be applied. For completeness, we would note that the Council, in its initial response to the Request dated 19 October 2022, erroneously stated that section 40(5B) of FOIA was an absolute exclusion. Following its internal review, the Council’s further response dated 7 December 2022 did not expressly correct that position but it did briefly refer to a public interest test (albeit in the context of disclosure of information, rather than the Duty to Inform). Clearly some errors were therefore made by the Council in that regard, but it is the Decision Notice which is of relevance for the purposes of this appeal.[97]The Decision Notice, having concluded that section 40(5B)(a)(i) of FOIA was engaged, Paragraph 34 of the Decision Notice. did not go on to identify the need for the application of the Public Interest Test. Consequently, the Commissioner did not then apply the Public Interest Test in order to validly determine that the Council could rely on section 40(5B)(a)(i) FOIA to neither confirm nor deny that it holds the Requested Information.[98]We recognise that the Commissioner did consider public interest aspects in his assessment of the Legitimate Interests Test and the Balancing Test (although we have found that the Balancing Test was not necessary, for the reasons set out in paragraph 91, linked to our finding in paragraph 87). However, that is not the same as applying the Public Interest Test.[99]Mr Lewin referred us to the Commissioner’s guidance entitled “Neither confirm nor deny in relation to personal data” (v 2.1, 24 November 2020). We note that this guidance no longer appears to be available on the Commissioner’s website. Relevant parts of that guidance provide as follows: Page 16 of that guidance(page 145 of the Authorities Bundle provided by Mr Lewin on behalf of the Council). “The exemptions from the duty to confirm or deny in section 40(5B) are not specifically listed as being absolute. This does not necessarily mean that they are therefore all qualified exemptions. The exemptions from the duty to confirm or deny in section 40(5B) correspond to the exemptions from the duty to disclose information in other subsections of section 40. Our view is that they are absolute where the corresponding subsection of section 40 is an absolute exemption, and qualified where the corresponding subsection is a qualified exemption.”.[100]We see no legal basis for that view. We cannot reconcile the Commissioner’s position in that guidance with the provisions of section 2(3) of FOIA, which explicitly states “the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption” (emphasis added). In our view, section 40(5B)(a)(i) of FOIA is subject to the Public Interest Test, as noted in paragraphs 42 and 43.[101]During the hearing, we asked the Appellant and Mr Lewin for their submissions on the Public Interest Test. The Appellant’s view was that the public interest in disclosing whether the Council holds the Requested Information outweighed the public interest in maintaining the exclusion of the Duty to Inform. The Appellant stated that the Council was a public body and there was a public interest in there being scrutiny of its performance, including with regard to its statutory disclosure obligations, as well as scrutiny of its councillors. The Appellant further submitted that the LGA emphasises the public interest in assessing documents held by the Council. In essence, the Appellant considered that there was an overwhelming public interest in transparency.[102]The Council’s position was that the public interest favoured maintaining the exclusion of the Duty to Inform. Mr Lewin submitted that the factors relied on by the Council regarding the Public Interest Test were the same as those argued in respect of the Legitimate Interests Test and that the outcome would be no different; ultimately, the privacy rights of the data subjects prevailed in either test.[103]We recognise and accept that there is a public interest in transparency regarding the relevant activities of the Council and in there being scrutiny of the councillors and the Council’s compliance with applicable laws. However, we find (considering all of the circumstances) that the public interest in maintaining an individual’s rights to privacy, based on the legal principles we have referred to, outweighs those public interests. We view the principle of the protection of privacy with respect to the processing of personal data to be paramount.[104]Linked to the preceding point, disclosure of information under FOIA is, effectively, disclosure to the public (in other words, to the ‘world at large’). It cannot be restricted to the Appellant as the person making the Request. It is for this reason that appropriate consideration and weight had to be afforded, in the application of the Public Interest Test, to the protection of individual’s privacy rights – namely, because disclosure of information under FOIA is disclosure to the general public.[105]For the above reasons, we therefore find that the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the Council holds the Requested Information.

Other issues raised by the Appellant

[106]For completeness, we now briefly address relevant remaining issues raised by the Appellant. Operation of the

Legitimate Interests Basis

[107]In his grounds of appeal, the Appellant expressed surprise that the Commissioner had considered that the Legitimate Interests Basis was the most likely lawful basis for processing of personal data. The Appellant asserted that the Legitimate Interests Basis “is specifically not available to public authorities in the performance of their public task”. However, we have noted in paragraph 47, whilst Article 6(1) of the UK GDPR does include an exception to the Legitimate Interests Basis (stating that it does not apply to processing carried out by public authorities in the performance of their tasks), section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA.

Application of other lawful bases of processing

[108]The Appellant also stated in his grounds of appeal that the Commissioner had not considered Article 6(1)(c) The grounds of appeal actually referred to Article “6(1)I” but the Appellant was clearly referring to Article 6(1)(c). of the UK GDPR (processing is necessary for compliance with a legal obligation to which the controller is subject) or Article 6(1)(e) Again, the grounds of appeal erroneously stated “6(1)I(e)” but clearly were referring to Article 6(1)(e). of the UK GDPR (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).[109]Taking each of those in turn:a. Article 6(1)(c) of the UK GDPR would not be applicable, as there is not necessarily a legal obligation under FOIA to disclose the personal data because of the exemptions contained in FOIA (or, in other words, operating on the basis that disclosure of personal data would be obligatory under FOIA would mean disregarding the express provisions of FOIA which negate any such obligation);b. Article 6(1)(e) of the UK GDPR would also not be applicable, because the disclosure of the personal data under FOIA would not constitute disclosure which is necessary for the performance of a task carried out in the public interest (and again it would, in any event, mean disregarding the applicable provisions of FOIA pursuant to which disclosure is not obligatory).

Other decision notices

[110]As noted in paragraph 16, the Appellant contended in his grounds of appeal that the other decision notices cited by the Commissioner In paragraph 35 of the Decision Notice. did not provide support for his conclusion in the Decision Notice.[111]As referred to in paragraph 34 (and summarised in paragraph 35), our remit is to consider the Decision Notice. Whilst the Decision Notice did refer to other decision notices previously issued by the Commissioner, those other decision notices are not relevant for the purposes of the appeal. Whether or not the other decision notices supported the Commissioner’s decision in the Decision Notice is not an issue we needed to decide. We have considered the Decision Notice without reference to other decision notices but only with regard to the matters relevant to the Decision Notice itself and to the issues raised in the appeal.

Final conclusions

[112]For all of the above reasons, we conclude that section 40(5B)(a)(i) of FOIA is engaged and that the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the Council holds the Requested Information. Accordingly, we find that the Decision Notice was correct in determining that the Council could rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it held the Requested Information. It follows that we agree with the findings of the Commissioner in the Decision Notice in that regard.[113]However, we find that the Commissioner was wrong to conclude (in paragraph 24 of the Decision Notice) that it would be necessary to confirm or deny whether the Requested Information is held to meet the Appellant’s legitimate interest. This relates to our finding (as noted in paragraph 80.a) that the Commissioner wrongly considered that the legitimate interest being pursued by the Appellant was in respect of understanding whether disciplinary action had been taken in relation to Council staff. We also find that the Decision Notice was flawed in not applying the Public Interest Test, having concluded that section 40(5B)(a)(i) of FOIA was engaged.[114]Our findings in the preceding paragraph do not, however, affect our decision regarding the ultimate conclusion reached in the Decision Notice, given that our decision results in the same outcome – namely, that that the Council can rely on section 40(5B)(a)(i) of FOIA to neither confirm nor deny that it holds the Requested Information. As we are therefore dismissing the appeal, we conclude (having regard to the provisions of section 58 of FOIA) that there is no basis for us to substitute the Decision Notice notwithstanding those findings.[115]We therefore dismiss the appeal.