Cambridgeshire County Council v The Information Commissioner & Anor [2024] UKFTT 269 (GRC)

[2024] UKFTT 00269 (GRC)Case Reference: EA-2023-0361
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 11 March 2024Date 4 April 2024
Information Rights
Heard: On the papers
Before
TRIBUNAL Judge BUckleyTRIBUNAL MEMBER ANNE chaferTRIBUNAL MEMBER PAUL TAYLOR
Between
CAMBRIDGESHIRE COUNTY COUNCILAppellantThe Information commissionerRespondentSIMON EDEN-GREENRespondentDecision:1.The appeal is dismissed.2.Cambridgeshire County Council must comply with the steps ordered by the Commissioner in the decision notice within 42 days of the date this decision is sent to the parties.REASONS

Introduction

[1]The parties and the tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of the Chamber’s Procedure Rules.[2]This is an appeal against the Commissioner’s decision notice IC-232401-Q4H5 of 6 July 2023 which held that Cambridgeshire County Council (‘the Council’) was not entitled to rely on section 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold the majority of the requested information. The Commissioner required the Council to provide the complainant with the names and information relating to those who are in a public facing role e.g., any Councillors or names of Councils and the Clerks (any information that belongs to private residents, or those not in a public facing role, that these individuals have provided as part of their response should remain redacted).

Factual background to the appeal

[3]This matter arises out of a consultation held by the Council in 2021 in relation to a number of active travel schemes around Cambridgeshire, referred to as the Cambridgeshire Active Travel Schemes Consultation (the Consultation). The Consultation included a formal consultation survey and feedback gathered through emails. Some responses were received on behalf of groups or organisations.[4]The consultation survey included the following statement, referred to in this decision as ‘the data protection statement’. “You do not have to give us any personal information. We will not publish any personal details you do give us unless specifically indicated, but we may publish your response, and include it in public reports, with personal details removed. Personal data will be held securely, in accordance with data protection legislation. We will only store it for 12 months after the consultation results have been analysed and the consultation report published.” Requests, decision notice and appeal The request

Requests, decision notice and appeal

[5]This appeal concerns the following request made on 25 October 2022 by Mr Eden-Green:
“A Summary Report of this consultation dated January 2022 has been published at https://www.cambridgeshire.gov.uk/asset-... and page numbers referred to below relate to that report. Please provide the following information to help inform comments on subsequent actions taken by the Council. 1. Is a full report available and if so where can it be viewed? 2. The Summary Report states on page 6 that: “Responses were also received on behalf of a number of different groups or organisations. All of the responses from these groups have been made available to board members in full and will be published alongside the results of the public consultation survey”; and under Stakeholder Responses on page 83 that: “All of the responses from these groups will be published alongside the results of the public consultation survey”
. Please advise where these responses can be viewed or make them available in response to this enquiry. 3. How were these and other stakeholders consulted? Was this by (a) proactive contact such as a written or verbal alert targeted to individual stakeholders, in which case please provide a list of those stakeholders who were consulted; or (b) simply by reliance on public awareness of published announcements? 4. Lists of stakeholders on page 18 and pages 82-83 include some 27 persons submitting responses declared to be on behalf of electoral constituents or public bodies. In the public interest of transparency and accountability, please provide the names of these officers, details of their responses to questions, and comments submitted for each of the schemes in the survey. 5. What were the criteria for stating in key findings (pages 7-10) that residents “weren’t clear on their support or opposition” to individual schemes given that, in at least one of these cases, the percentage of residents who expressed a clear preference exceeded the percentage who neither supported or opposed them? 6. Please provide reference(s) to the minutes and associated documents of those Council committee meeting(s) at which these Active Travel Schemes were considered and approved.”[6]In this decision the tribunal refers to the numbered parts of the request as ‘part 1’, ‘part 2’ etc. This appeal relates only to part 4 of the request.

The response

[7]On 21 November 2022 the Council responded to the request. It provided the information requested in parts 1, 3, 5 and 6. It withheld the information requested in parts 2 and 4, relying on section 22 (information intended for future publication). The Council upheld its position in relation to part 2 on internal review. A revised response to part 4 was issued on 21 February 2023 relying on section 40 in relation to the names of council staff, residents, individuals who were not elected members and those who had not consented to their details being shared. It upheld its position in relation to part 4 on internal review.[8]Mr. Eden-Green complained to the Commissioner about the Council’s response to part 4 of the request on 11 May 2023.

The Decision Notice

[9]The Commissioner concluded that the withheld information, i.e. the names of those submitting responses to the consultation on behalf of electoral constituents or public bodies, was personal data within section 3(2) of the Data Protection Act 2018 (DPA).[10]The Commissioner concluded that the most relevant data protection principle was principle (a) i.e. that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.[11]The Commissioner considered that the lawful basis that was most applicable was 6(1)(f).[12]The Commissioner was satisfied that there was a legitimate interest in the requested information, because release of the information would demonstrate, for instance, elected members’ views either on their own or on behalf of residents of a specific area.[13]The Commissioner was satisfied that disclosure was not necessary in relation to the information received by the Council on behalf of private residents, but this was not the case in relation to the information received from publicly facing individuals.[14]The Commissioner noted that the Council had explained that a data protection statement was included in the consultation wording, which stated, ‘You do not have to give us any personal information. We will not publish any personal details you do give us unless specifically indicated, but we may publish your response, and include it in public reports, with personal details removed…’[15]The Commissioner concluded that such a statement would be there to reassure members of the public that their personal information would not be released. He was not satisfied that this would relate to those individuals in a public facing role, such as Councillors and the Clerks of Councils.[16]The Commissioner determined that the information in relation to those in public facing roles (such as the Councillors), should have their names released as there was insufficient evidence to demonstrate that this information should remain redacted.[17]The Commissioner noted that the individuals were adding information to a public consultation, mostly on behalf of the area they represent. He concluded that the legitimate interest of openness and transparency merited the information being released. The Commissioner stated that the public have a right to know how their elected representatives conduct their roles and what views they may submit for a public consultation. He found that people in an elected position will also have an expectation of greater scrutiny than a normal member of the public.[18]The Commissioner concluded that there was a valid basis for processing and so disclosure of the information relating to public facing individuals would be lawful. He determined that the Council was not correct to apply section 40(2) to this part of the request.

Notice of Appeal

[19]In summary, the grounds of appeal are: Ground One The Commissioner did not consider whether processing of the personal information via disclosure under FOIA would be fair and transparent under the first data protection principle. Ground Two Release of the personal information would not be fair and transparent.[20]As this is a full merits review, ground one will be subsumed in our consideration of the appeal in any event.

Response of Mr. Eden-Green

[21]Mr. Eden-Green urges the tribunal to consider the confidentiality statement in the context in which it was made.[22]Mr. Eden-Green notes that the Council acknowledges there is a legitimate interest in the disclosure of the views and comments of elected members in response to the consultation and that disclosure of the identifiable personal references to elected members such as names and roles would be necessary to fulfil that legitimate interest. On that basis Mr. Eden-Green submits that all parties agree that there is no legitimate basis for the Council to include elected or public-facing officers within the scope of such a broad confidentiality statement, and hence that the Council were mistaken to create an expectation of confidentiality.[23]Mr. Eden-Green submits that any perceived loss of fairness of transparency is outweighed by the following: 23.1. Elected representatives and public facing officials stand for appointment in the knowledge and expectation that views and opinions they express in pursuance of public office must be open, transparent and accountable to the public. So they should not have accepted any expectation of confidentiality in this or similar cases. 23.2. If elected representatives make submissions to a democratic process in the expectation that they would not be held accountable to their constituents, or are encouraged to do so, arguably it is all the more important for the public to know what views or opinions have been expressed on their behalf.[24]Mr. Eden-Green notes that the Council continues to include the same confidentiality statement in consultations. He submits that the Council will continue to have a basis for claiming similar grounds of non-disclosure if the appeal is upheld and asks the tribunal to make a clear direction on the lawfulness of making a blanket confidentiality statement without exception for persons acting as stakeholders in public office.

The Commissioner’s response

[25]The Commissioner has provided an open and a closed response. It is necessary to withhold the closed response from Mr. Eden-Green because it refers in detail to the content of the closed bundle and to disclose it would defeat the purposes of the appeal.[26]The Commissioner submits that the person drafting the decision notice did consider fairness and transparency but accepts that it is not explicitly recorded in the decision notice.[27]The Commissioner submits that while the consent of a data subject to the disclosure of their personal data is a lawful basis on which to disclose that personal data, a refusal to provide consent does not of itself preclude disclosure albeit that it might be relevant to the legitimate interests, fundamental rights and/or fairness.[28]In relation to the data protection statement the Commissioner repeats his position in the decision notice. The Commissioner’s position is that it would be fair and transparent to disclose the names of those in elected/public facing roles.

Evidence

[29]We read an open and a closed bundle.[30]The closed bundle contains the closed response of the Commissioner and a redacted version of the comments provided in response to the consultation. We also requested from the Commissioner and were provided with a closed unredacted version of pages B69 to B83 of the open bundle. It is identical to those open pages except it shows the requested names. It is therefore necessary to withhold this from Mr. Eden-Green.[31]It is necessary to withhold the above closed information from Mr. Eden-Green because it consists of the withheld information and to do otherwise would defeat the purpose of the proceedings. Legal framework Personal data

Legal framework

[32]The relevant parts of section 40 of FOIA provide:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) It constitutes personal data which does not fall within subsection (1), and (b) either the first, second or the third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act - (a) would contravene any of the data protection principles... …[33]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA): (2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of X.[34]The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[35]The only potentially relevant basis here is article 6(1)(f):
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”
[36]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows: 1. Is the data controller or a third party pursuing a legitimate interest or interests? 2. Is the processing involved necessary for the purposes of those interests? 3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[37]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: “27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “

The role of the tribunal

[38]The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[39]The issues for the tribunal to determine are: 39.1. Would disclosure be lawful: 39.1.1. Is the data controller or a third party pursuing a legitimate interest or interests? 39.1.2. Is the processing involved necessary for the purposes of those interests? 39.1.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject? 39.2. Would disclosure be fair and transparent? Discussion and conclusions Scope of the request

Discussion and conclusions

[40]The remaining withheld information in issue in this appeal is the name or identifying title of responders responding as stakeholders whose names are currently redacted from the stakeholder feedback spreadsheet and/or the public consultation responses spreadsheet.[41]It is not in dispute that the information is personal data. Processing lawfully Legitimate interests and necessity

Processing lawfully

[42]We note that the Council has acknowledged that there was a legitimate interest in the disclosure of the views and comments of elected members in response to the consultation and that disclosure of the identifiable personal references to elected members such as names and roles would be necessary to fulfil the legitimate interest.[43]We find that that there is a legitimate interest in knowing how elected officials or other publicly facing individuals have responded to such a consultation on behalf of those they represent. We also accept that there is a legitimate interest in knowing which representative has submitted those comments and views.[44]In our view it is necessary for both those legitimate interests to disclose the names and identifying roles of those individuals responding as stakeholders. We do not accept that the legitimate aim could be satisfied by any less intrusive means.[45]It is not in issue in this appeal but we accept in any event that it is not necessary to disclose the names or roles of those responding as private individuals. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[46]All those individuals whose names or identifying titles form part of the withheld information responded to the consultation on behalf of others. They did not respond as private individuals. They are all in public facing roles and some are elected. They are accountable to those that they represent. All those individuals applied for or stood for that position in the knowledge that they would be carrying out public work on behalf of the stakeholders that they represent. It is not a role for those who wish to keep their identity private. Many of those individuals will be identified by name and photograph on websites such as Council websites. They will be or ought reasonably to be aware of FOIA. They will have an expectation that their public actions will be subject to greater scrutiny than would be the case in relation to their private lives.[47]Responding to a public consultation on behalf of a represented group is a public task. It is part of that individual’s public role.[48]In the tribunal’s view where an individual in those circumstances responds to a public consultation on behalf of those they represent, there would be no reasonable expectation that they would not be identified publicly as the person submitting the response. Those individuals would understand, as the Council has acknowledged, that there is a legitimate interest in the disclosure of their views and comments in response to the consultation and that disclosure of identifiable personal references such as names and roles would be necessary to fulfil the legitimate interest.[49]The Council has not explained why it included, and according to the appellant continues to include, the data protection statement in a public consultation document in circumstances where it recognises that it is necessary to disclose the identity of at least elected members for the purposes of legitimate interests.[50]In our view, any reasonable elected official or public facing individual submitting a response on behalf of a stakeholder group would assume that the data protection statement was only intended to apply to those who were submitting responses as private individuals. It is clearly, in the tribunal’s view, not intended to apply to those submitting stakeholder responses and would not be read as such by a reasonable person.[51]For those reasons we conclude that even in the light of the data protection statement there would be no reasonable expectation of privacy in these circumstances and that disclosure would have been within the reasonable expectations of those individuals.[52]Although some of the individuals have not consented to disclosure, we do not accept that there is any evidence on which we could base a finding that there is any potential for harm and distress as a result of the publication of the names or identifying roles of the individuals concerned, considering the roles that they have chosen to undertake and the particular task that they were carrying out at the time.[53]Taking all the above into account, we conclude that the legitimate interests are not overridden by the interests or fundamental rights and freedoms of the individuals in question.

Fairness and transparency

[54]We concluded above that any reasonable elected official or public facing individual submitting a response on behalf of a stakeholder groupwould assume that the data protection statement was only intended to apply to those who were submitting responses as private individuals. In those circumstances we do not accept that the existence of the data protection statement has any impact on fairness or transparency. In our view it would have been clear to any reasonable individual submitting a stakeholder response that the data protection statement did not apply to their names or identifying roles.[55]Consent is not a necessary element of fairness or transparency. In our view, it ought reasonably to be understood by those in the relevant positions that when they are carrying out public tasks in a representative role their personal data might be published. Looked at as a whole, we do not accept that the fact that some individuals have refused to provide consent renders disclosure unfair or not transparent.

Summary of decision

[56]For the above reasons we conclude that the Council was not entitled to withhold the requested information under section 40(2) or section 41 FOIA.

Observations

[57]These observations do not form part or the reasons for our decision.[58]Mr. Eden-Green has asked the tribunal to make ‘a clear direction on the lawfulness of making a blanket confidentiality statement without exception for persons acting as stakeholders in public office’.[59]It is not within our powers to make a general direction on the lawfulness of confidentiality statements.[60]However, given the Council’s acknowledgement of the reasonable necessity of disclosure for the purpose of legitimate interests, at least for elected members, the tribunal observes that it is perhaps surprising if, as Mr. Eden-Green asserts, it continues to include such a broad data protection statement in its public consultations. Signed Sophie Buckley Date: 4 April 2024 Judge of the First-tier Tribunal