Edward Williams v The Information Commissioner & Anor [2024] UKFTT 36 (GRC)

[2024] UKFTT 00036 (GRC)Case Reference: EA/2023/0148
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 11 December 2023Date 17 January 2024
Between
EDWARD WILLIAMSAppellantTHE INFORMATION COMMISSIONERRespondentMINISTRY of JUSTICERespondent
[Information Rights]
Heard: by determination on the papers
Before: Judge Alison McKenna
Tribunal Member Kate Grimley-Evans
Tribunal Member Miriam Scott
DECISION

REASONS

[1]This Decision concerns the Appellant’s appeal against the Information Commissioner’s Decision Notice dated 13 March 2023, in which the Information Commissioner found that the public authority (Ministry of Justice) was entitled to rely on s. 40 (5B) (a) (i) of the Freedom of Information Act 2000 Freedom of Information Act 2000 (legislation.gov.uk) (‘FOIA’) in neither confirming nor denying whether it held the requested information.

Mode of Hearing

[2]The Ministry of Justice was joined to this appeal as the Second Respondent by direction of the Registrar dated 1 June 2023.[3]The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of this Chamber’s Procedure Rules The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (publishing.service.gov.uk) .[4]The Tribunal considered an agreed open bundle of evidence comprising pages 1 to 145. The Tribunal also considered a closed bundle, comprising pages 1 to 34.

Background to the Appeal

[5]This is an unusual case in which the Second Respondent originally confirmed that it held the requested information and claimed an exemption from the duty to disclose it, but subsequently revised its response to neither confirm nor deny whether it held any information within the scope of the request.[6]The explanation for this change of stance is that the request was objectively ambiguous so that the Second Respondent had initially understood it to mean one thing, then realised it meant another and changed its stance.[7]It issued a letter to the Appellant during the course of the First Respondent’s investigation, explaining its changed understanding of the scope of the request and its changed response thereto.[8]We have seen the public authority’s letter to the First Respondent, explaining its revised position, but we have not seen the letter it sent to the Appellant. We understand it to have constituted an amended or revised response to the request under s. 17 FOIA, as it was the response considered in the Decision Notice and is consequently the response which is the subject of this appeal.[9]The information request, made on 23 August 2022, was in the following terms:
“Provide a schedule, in date order, of money damages and legal costs paid by you to females held in women's prison who were victims of assault (including all types of sexual assault) by male prisoners (including trans-women) for the period 2018 to date.” costs paid by you to females held in women's prison who were victims of assault (including all types of sexual assault) by male prisoners (including trans-women) for the period 2018 to date.”

victims of assault (including all types of sexual assault) by male

[10]The Second Respondent’s response, on 12 September 2022, was to confirm that it held the requested information, but to claim that it was exempt from disclosure under s. 40 (2) FOIA. This stance was upheld on internal review, communicated to the Appellant on 10 October 2022.[11]The Appellant complained to the First Respondent on 10 October 2022, who opened an investigation on 19 October 2022.[12]However, on 16 November 2022, the Second Respondent informed the First Respondent and the Appellant that: “…as the result of further review during the ICO investigation, we can confirm that this was incorrect because the information we were basing this on is not in scope. We are therefore amending our FOI response to your original request [MOJ reference number redacted] as set out below. Please accept our apologies for this. … I can neither confirm nor deny if the MOJ holds the information that you have requested. Under section 40(5B)(a)(i) of the FOIA we are not obliged to confirm or deny whether we hold information, if to do so would contravene any of the data protection principles set out in Article 5(1) of the General Data Protection Regulation and section 34(1) of the Data Protection Act 2018”. can confirm that this was incorrect because the information we were basing this on is not in scope. We are therefore amending our FOI response to your original request [MOJ reference number I can neither confirm nor deny if the MOJ holds the information that you have requested. Under section 40(5B)(a)(i) of the FOIA we are not obliged to confirm or deny whether we hold information, if to do so would contravene any of the data protection principles set out in Article 5(1) of the General Data Protection Regulation and section 34(1) of the Data Protection12. The MOJ also provided the Appellant with some information outside of FOIA about a framework developed in 2019 for the management and strengthened risk-assessment of transgender individuals. It said that since the introduction of this framework there had been no recorded incidents of sexual assault committed by transgender women in the women’s prison estate.13. The Appellant requested a second internal review, but the Second Respondent refused to conduct one, as it said it had already undertaken an internal review and advised him of the outcome on 10 October 2022.14. The First Respondent treated the Appellant’s existing complaint under s. 50 FOIA as one against the Second Respondent’s revised response and issued a Decision Notice which considered whether the Second Respondent was entitled to maintain the position articulated in its revised response to the original request.

The Decision Notice

[15]The Decision Notice dated 13 March 2023 Number IC-196538-F9FB. found that, in responding to the revised interpretation of the information request, the Second Respondent had been entitled neither to confirm nor deny whether information was held and required no steps to be taken.[16]The Decision Notice found that, in originally claiming a different exemption, the public authority had been considering information outside the true scope of the request.[17]The Decision Notice concluded that the information requested constituted personal data in that it would allow the identification of those concerned. This was because the number instances of assault involved were fewer than five, and also, as some information was in the public domain following a criminal conviction, disclosure would permit a ‘jigsaw’ identification of those who might have received, or not received, compensation.[18]Nevertheless, the Decision Notice acknowledged that the public authority could disclose this personal data if to do so would be in accordance with the provisions of UK GDPR.[19]In applying Article 6 (1) (f) UK GDPR, the Decision Notice proceeds to apply a three-part test by asking: i) Whether a legitimate interest is being pursued in the request for information; ii) Whether disclosure of the information is necessary to meet the legitimate interest in question; iii) Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.[20]The Decision Notice concludes that there is a legitimate interest being pursued in the request for the information, because it serves the principle of transparency, especially in relation to the public purse. However, it went on to find that this legitimate interest was insufficient to override the personal data rights of those concerned, because they would have no expectation that they would be so identified, and their identification could cause them distress and harm. In the circumstances, it was not necessary to undertake the balancing exercise at part (iii) of the test and the Decision Notice concluded that the Second Respondent was entitled to rely on s. 40 (5B) (a) (i) FOIA in neither confirming nor denying whether it held the requested information.[21]The Decision Notice did not require any steps to be taken. It also did not make any finding in respect of s. 16 FOIA, concerning the Second Respondent’s failure to clarify the Appellant’s ambiguous information request.

The Pleadings

[22]The Appellant’s Notice of Appeal, dated 13 March 2023, was succinct:
“I appeal under s. 57 FOIA…. On 10 October 2022 the PA on IR confirmed its response…. Any further responses by the PA were of no legal relevance. Further or in the alternative, confirming or denying the information was held would not constitute personal data and there is a legitimate interest here. The information, if held, is not criminal offence data.”
[23]The First Respondent’s Response dated 7 June 2023 opposed the appeal and relied on the correctness of the Decision Notice.[24]The Second Respondent’s Response dated 5 July 2023 also opposed the appeal and relied on the correctness of the Decision Notice’s outcome, if not its reasoning. It was submitted that the Decision Notice had erred in concluding that there was a legitimate interest in the information requested, because such a generalised interest in transparency was insufficient and the question should have been applied to the specific information sought. Its submission was as follows: “37.The Appellant has not identified what legitimate interest he says is in play in these circumstances. The MoJ accepts (and accepted before the Commissioner) that there is a general public interest in accountability and transparency in relation to legal payments made by the MoJ in cases of assaults by prisoners on other prisoners held in the prison estate. But it submits that, for the purposes of the DPA/GDPR framework, there is no legitimate interest in publication of details relating to individual cases. The MoJ submits that the Commissioner erred insofar as he concluded otherwise. In particular, he erred insofar as he concluded (DN §26-27) that a general interest in transparency and accountability was sufficient to establish a legitimate interest for the purpose of Article 6(1)(f): see Cox v Information Commissioner [2018] UKUT 119 §42 (“There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”) 38. The relevant question is whether there is a legitimate interest in disclosure of the specific information requested: see Kol v Information Commissioner [2022] UKUT 74 §18 (“[Article 6(1)(f)] refers to processing, which can only mean the processing of the data. In this case, that means disclosing the information requested. The issue is whether it is necessary to disclose that information for the purposes of [the requester’s] legitimate interests. It is the information that is the focus of the enquiry”). In this case the Appellant has an interest as a journalist in finding out whether legal claims have been made in the very small number of individual assault cases falling within scope of his Request. The information would undoubtedly be of interest to the public, but that is not sufficient to establish a legitimate interest – either on the part of the Appellant, or more generally – in the publication of the individual assault victims’ personal data”.[25]The Second Respondent helpfully explained its initial error in this case as follows:
“[15] As explained above, in its initial response in September 2022 and at the internal review stage, the MoJ stated that it held information in scope of the request but refused the request under s. 40 (2) FOIA (disclosure would reveal personal data of third parties and would contravene data protection principles. On further consideration of the request, prompted by the Commissioner’s investigation, officials within MoJ realised that they had misinterpreted the scope of the request. On its proper interpretation, the MoJ decided that it could neither confirm nor deny holding information in scope. The MoJ informed the Commissioner and the Appellant of this change to its response on 16 November 2022.”
[26]The Appellant did not file a Reply.

The Law

[27]The law relevant to this appeal is as follows.[28]S. 1 FOIA provides that: “General right of access to information held by public authorities. (1). Any person making a request for information to a public authority is entitled— (a)to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b)if that is the case, to have that information communicated to him. (6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.[29]S. 16 FOIA provides that:
“Duty to provide advice and assistance. (1)I t shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests for information to it. (2) Any public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice under section 45 is to be taken to comply with the duty imposed by subsection (1) in relation to that case.”
[30]The Information Commissioner’s Office has published Guidance on s. 16 FOIA is as follows: Section 16 – Advice and Assistance | ICO “In what circumstances should we provide advice and assistance? Section 16 aims to ensure that you communicate with an applicant or prospective applicant to find out what information they want and how they can obtain it. Generally, there are three main circumstances in which this duty arises. The first is that you have reason to believe that the applicant has not given their real name. In this case, you should ask the applicant for it. The second circumstance is when the request, read objectively, is ambiguous and requires clarification as to the information sought. In this case, you should contact the applicant to ask for more details to help you identify and locate the information they want. The third circumstance is when the request would exceed the appropriate limit beyond which you would not be required to provide the information. In this instance, you should provide the applicant or prospective applicant with advice and assistance to help them reframe the request in a way that would bring it within the appropriate limit”. 31. The Guidance also cross-refers to the 2018 Code of Practice, which states that:
“2.8 There may also be occasions when a request is not clear enough to adequately describe the information sought by the applicant in such a way that the public authority can conduct a search for it. In these cases, public authorities may ask for more detail to enable them to identify the information sought.” 32. S. 17 FOIA provides as follows: “Refusal of request. (1) A public authority which, in relation to any request for information, is to any extent relying on a claim that any provision of Part II relating to the duty to confirm or deny is relevant to the request or on a claim that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which— (a) states that fact, (b) specifies the exemption in question, and (c) states (if that would not otherwise be apparent) why the exemption applies.” 33. The Upper Tribunal recently reviewed the authorities on s. 17 FOIA in FCDO v IC and Williams, Wickham-Jones and Lownie [2021] UKUT 248 Foreign, Commonwealth and Development Office v Information Commissioner, Williams and Others (Sections 23 and 24): [2021] UKUT 248 (AAC) - GOV.UK (www.gov.uk) . This was the decision of a three-Judge panel, so takes precedence over the decisions of single-Judge panels. The panel included the then-Chamber President, Farby J. It is thus an authority of considerable weight. The panel summed up the case law on s. 17 FOIA as follows: “[46] We agree with the propositions that Mr Knight derived from this trilogy of Upper Tribunal authority and which he developed in his oral submissions. First, section 17 sets out an administrative process (Birkett at [32] and Oxford Phoenix at [42]). Second, section 17 contemplates an informal procedure (Birkett at [33]). Third, a public authority which specifies certain exemptions in its refusal notice under section 17 is not precluded from either dropping those exemptions or adding to them at a later stage (Birkett at [25], [29] and [34]). Fourth, specifying an exemption which in the event is found not to apply is not a breach of section 17 (Malnick at [74]-[75] and Oxford Phoenix at [36]). Fifth, and furthermore, citing an obviously inapplicable exemption is also not a breach of section 17 (Oxford Phoenix at [40]). Sixth, and finally, the ultimate supervisory mechanism for public authorities’ reliance on exemptions is not section 17 itself but rather the decision-making functions of the Information Commissioner and on appeal the First-tier Tribunal (Birkett at [33], Malnick at [75] and Oxford Phoenix at [40]).” 34. S. 40 FOIA provides as follows: “Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2). Any information to which a request for information relates is also exempt information if— (a)it constitutes personal data which does not fall within subsection (1), and (b). The first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a). would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing). (4A) The third condition is that— (a)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.] (5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1). (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i). would (apart from this Act) contravene any of the data protection principles, or (ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing); (c)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a); (d)on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.] (6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . (7)In this section— • “the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; • “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); • “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act). (8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
[35]Articles 5 and 6 of UK GDPR provide (where relevant) as follows:
“Article 5Principles relating to processing of personal data: 1.Personal data shall be: (a)processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); Article 6Lawfulness of processing: 1.Processing shall be lawful only if and to the extent that at least one of the following applies: (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Article 6Lawfulness of processing:

[36]The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:
“If on an appeal under section 57 the Tribunal considers - (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal. On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.”
[37]The burden of proof in satisfying the Tribunal that the Commissioner’s Decision Notice was wrong in law or involved an inappropriate exercise of discretion rests with the Appellant. Where there is a dispute of fact, the relevant standard of proof is the balance of probabilities.

Evidence and Submissions

[38]None of the parties filed skeleton arguments in this appeal.[39]None of the parties filed open evidence in this appeal.[40]We have considered, in our open bundle, the evidence provided by the MoJ to the Information Commissioner during his investigation of the complaint. The Appellant has of course seen this.[41]We considered a closed bundle in this appeal, consisting of unredacted versions of the evidence contained in the open bundle. The Appellant has not seen this, because it is subject to a direction under rule 14 of the Tribunal’s Rules. It has not been necessary for us to refer to the closed bundle in making this Decision, so there is no closed annexe.[42]We ‘gist’ the closed material for the benefit of the Appellant as follows: it consists of correspondence with the Information Commissioner’s Office during the investigation, which explains the change of stance by MOJ.

Conclusion

[43]We find that the Appellant’s information request was objectively ambiguous and required clarification. As the Second Respondent has submitted, the terms in which the information was requested made it difficult to distinguish between a request for a schedule of money damages paidduring the period 2018 to date, and a schedule of money damages paid to those who were victims of assault during the period 2018 to date.[44]We conclude that the Second Respondent failed to comply with s. 16 FOIA, theInformation Commissioner’s Guidance and the Code of Practice in responding to the request based on an initial, and flawed, understanding of the information requested, without clarifying it.[45]We conclude that the Second Respondent was entitled to revise its response after it had realised its mistake. Following the Upper Tribunal’s reasoning in FCDO v Information Commissioner, Williams and Other (see paragraph 33 above), we find that the s. 17 FOIA response is an administrative step and not a substantive one, so a public authority changing its stance after it has complied with the administrative step is not a breach of FOIA. We would have expected the Appellant to be aware of this, having been a party to the Upper Tribunal appeal which most recently established the relevant legal principle. He has not, in any event, sought to distinguish the authority.[46]Although it seems counter-intuitive, the Second Respondent’s change of stance is explained by its initial misunderstanding of the request. We are satisfied by the evidence in both the open and closed bundles before us that, properly understood, the request has within its scope different information from that within scope of the first erroneous interpretation. It could be argued that the 16 November 2022 response is in fact the first response to the request once it was properly understood, but the First Respondent treated it as a revised response to the same request and we do not think this is objectionable. We find it regrettable that the Second Respondent found itself in this position, which is attributable to its own failure to clarify an ambiguous request and thus its breach of s. 16 FOIA.[47]The Decision Notice treated the public authority’s revised response as the operative response for the purposes of the Appellant’s s. 50 FOIA complaint. The Appellant appears to have agreed to this. This appeal is therefore an appeal against the Decision Notice which was issued on 13 March 2023 and not an appeal against the Second Respondent’s change of stance. We discern no error of law in the First Respondent’s Decision Notice in this regard and conclude that the Appellant’s first ground of appeal is misconceived.[48]Turning to the application of s. 40 (5B) (a)(i) FOIA, we conclude that the information requested does constitute personal data, and so we reject the Appellant’s second ground of appeal. We agree that the information requested is not criminal offence data.[49]We also conclude that the Second Respondent is correct to submit that the legitimate interest identified in the Decision Notice was an erroneous conclusion, and that the interest apparently claimed by the Appellant is insufficient to override the victims’ personal data rights.[50]We conclude that there is an error of law in the Decision Notice for this reason. We agree with both Respondents’ submissions that the publication of the data is not necessary and that it is unnecessary to proceed to part (iii) of the three-part test. Despite our finding that the Decision Notice contains an error in relation to part (i) of the three-part test, the substantive outcome thus remains the same.[51]We further conclude that the Decision Notice erred in failing to find that the Second Respondent had breached s. 16 FOIA in failing to clarify an objectively ambiguous request. To this extent, the appeal succeeds in part (although not in relation to grounds advanced by the Appellant).[52]As our conclusions do not alter the substantive outcome, we make no substituted Decision Notice, and we require no steps to be taken. Signed: Judge Alison McKenna Dated: 3 January 2024 © Crown Copyright 2023

Cited in 1 later judgment