Adnan Ali v The Information Commissioner [2024] UKFTT 371 (GRC)

[2024] UKFTT 00371 (GRC)Case Reference: EA/2023/0276
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 3 October 2023Date 8 May 2024
Information Rights
Heard remotely
Before
TRIBUNAL JUDGE C GOODMANTRIBUNAL MEMBER M SAUNDERSTRIBUNAL MEMBER S WOLF
Between
adnan aliAppellantTHE INFORMATION COMMISSIONERRespondentThe Appellant represented himself. for The Respondent did not appear.Decision: The appeal is Allowed. Decision Notice IC-205547-W5DO is not in accordance with the law. The following Decision Notice is substituted by the Tribunal.Substituted Decision Notice:
[1]The Tribunal finds that, in relation to a request for information made by the Appellant to University College London (“the University”) pursuant to the Freedom of Information Act 2000 on 12 September 2022, the University must disclose to the Appellant within 42 days of the date of issue of this Decision the first 12 pages of an Investigation Report dated 5 September 2022, subject to the redactions set out in the Closed Annex attached to this Decision.[2]The redacted text and the appendices to the Investigation Report are exempt from disclosure pursuant to sections 36(2)(b) and section 40 of the Freedom of Information Act 2000.[3]The Closed Annex is to be disclosed only to the Respondent and to the University. REASONS

Background

[1]The Appellant was employed by University College London (“the University”). He raised a number of concerns with the University that an individual had been appointed to three posts between 2019 and 2021 without a proper recruitment process and in breach of the University’s policies and procedures. The Appellant raised concerns first with his union, then with the University’s HR department, and finally, in February 2022, under the University’s Public Interest Disclosure (“PIDA” or “whistleblowing”) policy.[2]The University appointed an external law firm to investigate the Appellant’s concerns. The investigator interviewed a number of individuals, including the Appellant, and inspected a number of documents and emails. The interviews were conducted on the basis that the interviewees’ evidence would be kept confidential.[3]The investigator produced a 12 page investigation report on 5 September 2022 with more than 800 pages of appendices (“the Report”). The appendices included transcripts of the interviews conducted by the investigator and correspondence between relevant individuals.[4]On 9 September 2022, the University’s Vice President (Operations) emailed the Appellant setting out a summary of the Report and the action to be taken as a result.

The Request

[5]On 12 September 2022, the Appellant asked: “Could you please send me the copy of the full report received from the investigator.” (“the Request”)[6]The University treated the Request as a request for information under the Freedom of Information Act 2000 (“FOIA”). It responded on 10 October 2022, refusing to provide the requested information in reliance on section 36(2)(b)(ii) and 36(2)(c) FOIA. The University’s President and Provost, Dr Michael Spence, approved the application of these sections as “qualified person” on 23 September 2022 on the basis that the specified inhibition would be likely to occur if the requested information was disclosed.[7]Further correspondence was entered into but there was no formal internal review.

The Decision Notice

[8]The Appellant complained to the Commissioner.[9]On 24 March 2023, the Commissioner issued Decision Notice IC-205547-W5DO (“the Decision Notice”).[10]The Commissioner decided that the University was entitled to rely on section 36(2)(b)(ii) to withhold the Report because:a. section 36(2)(b)(ii) was engaged because the qualified person’s opinion that disclosure would be likely to inhibit the free and frank exchange of views for the purposes of deliberation was reasonable; andb. the public interest lay in maintaining the exemption: i. in relation to the appendices, the public interest balance was clearly in favour of maintaining the exemption. The Commissioner noted that these contained interview transcripts with “frank and candid assessments” by interviewees and was satisfied that disclosure would “deter individuals from cooperating, freely and frankly, with any similar investigations in the future, particularly since the interviewees were informed that their involvement would remain confidential” [paragraph 27]; and ii. in relation to the first 12 pages of the Report, the public interest was more finely balanced. The Commissioner ultimately concluded that, given the Appellant had received a summary of the Report and details of the action to be taken by the University, further disclosure would not further public understanding, noting that the matter had been transferred to the University’s audit committee shortly before the Request and was therefore still “live”.[11]The Commissioner concluded that section 36(2)(c) was not engaged because no grounds were suggested to the qualified person about prejudice to the effective conduct of public affairs other than to the free and frank exchange of views. The University did not rely on section 36(2)(c) in the proceedings.[12]No further steps were required by the Commissioner.

The Appeal and Pleadings

[13]The Appellant appealed to the Tribunal. In his notice of appeal, the Appellant complained that the summary of the Report which he had been sent by the University was brief and “did not provide any detail on how the investigator come [sic] to their conclusion”, in particular in relation to the use of the Provost’s discretionary funds for the first appointment. The Appellant alleged that this was an “unethical practice of appointment through nepotism” with public funds being used without following due process. He submitted that as the person whose PIDA report had led to the investigation, he had a right to see the report containing the outcome of that investigation.[14]In relation to the balance of public interest, the Appellant submitted that transparency would build trust and confidence in the University. The fact that the University had appointed an external investigator showed that they accepted the importance of the issue, and it was contradictory then to refuse to publish the investigator’s findings.[15]In its Response to the appeal, the Commissioner relied on the Decision Notice and maintained its position as set out in the Decision Notice.[16]The University did not apply to be joined as a party but made written submissions. In relation to the engagement of section 36(2)(b)(ii) FOIA, the University submitted that the qualified person’s opinion was reasonable and repeated the arguments accepted by the qualified person, namely:a. “The investigation was commissioned to scrutinise concerns raised by the Appellant. It was vital for this purpose that those colleagues asked to participate did so with openness and candour. If the individuals had thought there was a risk of their comments being in the public domain, this would likely not have been the case.b. Such openness and candour were also the premise on which the investigator was able to conduct her investigations and ensure that the concerns raised were properly tested.c. The investigator’s findings were considered by the University’s Audit Committee. It is also important that there is a “safe space” to deliberate the outcomes of the report.d. Disclosure might also undermine the University’s ability to effectively mitigate and manage the outcomes and recommendations.”[17]In relation to the balance of public interest, the University agreed with and adopted the reasoning of the Commissioner, in particular:a. the investigation was still ‘live’ at the time of the Request and still being considered by the Audit Committee. The integrity and efficacy of the process of deliberating the conclusions of the Report would have been undermined by disclosure;b. disclosure would undermine the assurances of confidentiality given to the participants and hinder not only the present investigation but future investigations;c. the information already supplied to the Appellant satisfied the general public interest in transparency and accountability without requiring the “full evidence bundle” to be placed in the public domain; andd. the greater public interest lay in having the investigation carried out and lessons learned “without external interference”.[18]The University submitted in the alternative, that the exemption in section 40 FOIA would apply to personal data in the appendices to the Report. [The University subsequent withdrew a submission that section 41 (confidentiality) would apply to the interview transcripts.][19]A copy of the full Report was provided to the Tribunal. A Registrar made Directions on 4 August 2023 that the Report be held pursuant to Rule 14(6) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 on the basis that it would not be disclosed to anyone except the Commissioner and the University.

The Hearing

[20]A remote hearing was held by video on 3 October 2023. The Commissioner did not attend. The Appellant attended and made submissions. The Tribunal took into account that the Appellant was unrepresented and made efforts to explain the process and issues to him and to facilitate his participation in the hearing.[21]The Appellant confirmed at the hearing that he was seeking disclosure only of the first 12 pages of the Report and not the appendices. He agreed with the University that the confidentiality of interviewees should be respected.[22]Following the hearing and in accordance with Directions issued by the Tribunal on 27 October 2023, the Commissioner and the University provided further submissions in relation to section 40 FOIA. A further Rule 14 Order was issued on 6 February 2024 in respect of a closed Annex attached to the University’s further submissions. The open submissions were issued to the Appellant on 6 February 2024 and he provided a brief response. The Law Freedom of Information Act 2000

The Law

[23]Section 1(1) FOIA gives individuals a right to information from a public authority unless it is “exempt information”.[24]Section 2(2) FOIA provides that:
“In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that— (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.” (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”

Section 36(2) FOIA

[25]Section 36(2) provides: “Information to which this section applies is exempt information, if in the reasonable opinion of a qualified person, disclosure of the information under this Act – … (b) would or would be likely to, inhibit – … (ii) the free and frank exchange of views for the purposes of deliberation...”. … (ii) the free and frank exchange of views for the purposes of deliberation...”.[26]The opinion of the “qualified person” must be “both reasonable in substance and reasonably arrived at” Guardian Newspapers Ltd and Brooke v IC, IT, 8 January 2007 (EA/2006/0011; 0013), at [64]. The Upper Tribunal noted in Information Commissioner v Malnick and another [2018] UKUT 72 (AAC), that qualified persons: “…are all people who hold senior roles in their public authorities and so are well placed to make that judgment, which requires knowledge of the workings of the authority, the possible consequences of disclosure and the ways in which prejudice may occur. It follows that, although the opinion of the QP is not conclusive as to prejudice (save, by virtue of section 36(7), in relation to the Houses of Parliament), it is to be afforded a measure of respect” [29].[27]The exemption in section 36(2) FOIA is not absolute and is therefore subject to the public interest test in section 2(2)(b).[28]The public interest in maintaining the exemption must be assessed in all the circumstances of the case and weighed against the public interest in disclosure. It must relate specifically to the relevant exemption. The starting point is to assume a public interest in disclosure. The Tribunal must identify the actual harm or prejudice caused by disclosure and weigh that against the benefits of disclosure.[29]The public interest must be assessed at the time when the public authority makes its initial decision on a request for information in accordance with the statutory time for compliance (Montague v Information Commissioner and the Department of International Trade [2022] UKUT 104 (AAC)).

Section 40 FOIA

[30]Section 40 FOIA provides:(1) “Any information to which a request for information relates is… exempt if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is… exempt information if— (a) it constitutes personal data… and (b) the first, second or third condition below is satisfied.

(a) would contravene any of the data protection principles…”

[31]The first data protection principle under Article 5(1)(a) of the UK’s retained version of the General Data Protection Regulation (“UK GDPR”) is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”.[32]Article 6(1) UK GDPR provides that processing shall be lawful only if and to the extent that one of the lawful bases for processing applies. Article 6(1)(f) provides the following lawful basis for processing: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”.[33]Section 40(2) FOIA is an absolute exemption in relation to the first condition under section 40(3A) FOIA: the public interest balancing test under section 2(2)(b) FOIA therefore does not apply.[34]Section 40(7) FOIA provides that “personal data” has the same meaning in FOIA as in section 3 of the Data Protection Act 2018 (“DPA”), namely:
“(2) “Personal data” means any information relating to an identified or identifiable living individual… (3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to— (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.” (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”
[35]In NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192, Upper Tribunal Judge Jacobs considered whether a patient could be identified from a list of dispensaries which had dispensed a particular medication. Judge Jacob described the issue before him as: “whether any person was identifiable from the [withheld data] when taken together with other information by someone who was motivated to identify one or more of the persons within the data using all the means reasonably likely to be used.” [paragraph 3][36]Judge Jacobs observed in paragraph 21 of NHS Business Services Authority that this was not a test of “remoteness or significance or likelihood” but “whether it is possible to identify a specific individual solely by relying on the data available”.

Powers of Tribunal

[37]The powers of the Tribunal in determining this appeal are set out in section 58 FOIA, as follows: “(1) If on an appeal under section 57 the Tribunal considers -(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.” (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,[38]The Tribunal stands in the shoes of the Commissioner and takes a fresh decision on the evidence before us. The Tribunal does not undertake a review of the way in which the Commissioner’s decision was made.

Discussion

[39]The reasons for the Tribunal’s decision are set out in full below.[40]The Tribunal decided that a redacted version of the first 12 pages of the Report should be disclosed to the Appellant. We have set out in a Closed Annex the redactions to be made. The Closed Annex is to be made available only to the Commissioner and the University because it contains information which is to be redacted and not disclosed to the Appellant.[41]In reaching its decision, the Tribunal took into account all the evidence before it, the written submissions of both parties and the University, and the oral submissions of the Appellant. The Tribunal had before it an open bundle of 124 pages, a closed bundle consisting of the withheld Report, and the parties’ additional submissions in relation to sections 40 and 41 FOIA (see paragraph 22 above).[42]The Tribunal applied the law as set out in paragraphs 23 to 38 above.

Is section 36(2)(b)(ii) engaged?

[43]The Tribunal found that the opinion of the qualified person, that section 36(2)(b)(ii) was engaged, was reasonable, noting the guidance of the Upper Tribunal in Malnick. It was reasonable for Dr Spence to conclude that disclosure of the full Report would be likely to inhibit the willingness of staff to participate in the investigation and the ability of University members to discuss freely and fully its conclusions and the serious concerns raised by the Appellant. We noted that Dr Spence was not the Provost of the University at the time of the first two appointments which were the subject of the investigation.

The balance of public interest in relation to section 36(2)(b)(ii)

(b) (ii)

[44]The Tribunal went on to consider whether the public interest in maintaining the exemption in section 36(2)(b)(ii) FOIA outweighed the public interest in disclosing the Report.[45]The Tribunal accepted that the balance of public interest was in favour of maintaining the exemption in section 36(2)(b)(ii) in relation to the appendices to the Report. The appendices contain detailed interview transcripts and evidence from the University staff who participated in the investigation. The interviews were conducted on the basis that the interviewees’ evidence would be kept confidential. The public interest in respecting those assurances of confidentiality, and in University staff participating in the investigation and future investigations with openness and candour, outweighed the public interest in disclosure of their detailed evidence. The Tribunal accepted that if the individuals had not received assurances of confidentiality, they would not have participated so freely, and that this would have hampered the investigation. The Appellant confirmed at the hearing that he was appealing only in relation to the main body of the Report and not the appendices.[46]The main body of the Report - the first 12 pages – contained 6 sections: Section 1: Introduction Section 2: Context for and Scope of the Investigation Section 3: Investigation Timeline Section 4: Methodology/Interviews and documentation undertaken Section 5: Summary of the findings Section 6: Conclusions / Recommendations / Observations[47]In relation to the main body of the Report, the Tribunal again decided that the public interest in maintaining the confidentiality of the individuals who had participated in the investigation outweighed the public interest in disclosing their names and evidence. The names of individuals who had been interviewed (or not interviewed) and the dates of interviews should therefore be redacted from Section 4 on Methodology. Section 5 should also not be disclosed – other than the first sentence and column headings - because it contained a summary of the evidence provided by participants and the findings reached by the investigator based on that evidence. The Tribunal concluded that the individuals would be identifiable from Section 5 even if their names and specific references to their evidence were redacted, and on balance, the public interest in maintaining their confidentiality outweighed the public interest in disclosure of specific findings.[48]However, none of the participants nor their evidence could be identified from Sections 1, 2, 3 or 6 of the first 12 pages of the Report, other than the Appellant and the individual whose appointments were the subject of the investigation. We have addressed the redaction of personal data of the Appellant and that individual in the context of section 40 FOIA in paragraphs 58 to 63 below.[49]The public interest in disclosure of redacted versions of Sections 1, 2, 3 and 6 which set out the context, scope, methodology, conclusions and recommendations of the investigation, is substantial, in particular because the investigator concluded that the University’s procedures or due process had not been followed in respect of the first and second appointment.[50]All parties acknowledged the general public interest in transparency and accountability of public bodies. The University and the Commissioner highlighted the public interest in understanding how the University dealt with sensitive issues and allegations of inappropriate behaviour, including under its PIDA policy. The University acknowledged that the allegations made by the Appellant were “serious”.[51]In addition, the Tribunal found that there is a strong public interest in the use of public funds. The Appellant submitted, and the University accepted, that funding for the first appointment would have been a significant sum.[52]In relation to the public interest in maintaining the exemption, the Tribunal took into account the University’s submissions that the issue was still “live” at the time of the Request and under consideration by the University’s Audit Committee, and that disclosure at that time would have prejudiced the ability of the Audit Committee to deliberate the outcome of the Report. These submissions go to the heart of the section 36(2)(b)(ii) exemption, which is to enable deliberation and exchange of views. As noted in paragraph 29 above, the public interest must be assessed at the time when the University made its initial decision about responding to the Request, and timing was a determining factor for the Commissioner.[53]However, the Tribunal did not accept that the issue was still “live” when the University responded to the Request. The email sent by the University’s Vice President (Operations) to the Appellant reported that the matter had “now been fully investigated” and informed him of “what action is to be taken as a result”. The Vice President did not indicate that any further action was planned and no reference was made to referral to, or further deliberation by, the Audit Committee. The Appellant was thanked for his co-operation and patience. The impression given was that the matter was closed. In this context, the Tribunal found little prejudice to the deliberations of the Audit Committee would arise from disclosure of the first 12 pages of the Report.[54]The University further submitted that the public interest in transparency and accountability had been adequately satisfied by the summary provided to the Appellant. However, the Tribunal concluded that the findings of the Report had been reported to the Appellant in a selective manner. Findings which were favourable to the University were presented in full, while unfavourable findings were omitted or re-phrased. We noted in particular that:a. The University reported to the Appellant that the investigator had found that the first appointment “was not subject to” the University’s Recruitment and Selection Procedure because it was funded by the Provost’s discretionary funds. This was not an accurate reflection of the Report’s finding, which was that the Procedure “was not followed” in respect of this appointment and that it did not fall under any of the exceptions to the Procedure.b. In relation to the second appointment, the University implied in its summary to the Appellant that changes to secondment guidance had been agreed informally before the appointment, although not “formally in place at the time”. In fact, the Report made no distinction between formal and informal agreement, noting only that a temporary variation was “subsequently” agreed with the unions, “post-dating” the second appointment.c. In relation to the second appointment, the Report’s finding that “whilst the secondment was in the spirit of UCL Together in terms of flexibility and movement of staff, it did not strictly fall within its parameters” was repeated verbatim to the Appellant, but the concluding words - “and therefore due process was not followed” – were omitted.[55]As a result, the Tribunal did not find, as submitted by the University and accepted by the Commissioner, that the summary supplied to the Appellant was sufficient to satisfy the general public interest in transparency and accountability. Indeed, the Tribunal found that the summary raised further concerns about a lack of transparency and accountability at the University and a resistance to what the University termed “external interference” in its submissions. This added weight to the public interest in disclosing the conclusions of the Report.[56]The Tribunal also did not accept as submitted by the University that disclosure would undermine the University’s ability to “effectively mitigate and manage the outcomes and recommendations” of the Report. We found that, as submitted by the Appellant, disclosure was more likely to build trust and confidence in the University and enable it to be held to account in the way in which it adopted and implemented the recommendations of the Report.[57]Taking all this together, the Tribunal found that the public interest in transparency about appointments made by the University, compliance with its own recruitment and selection procedures, its process for responding to and investigating allegations of inappropriate behaviour under its PIDA policy, use of public funds, and in holding the University to account in accepting and acting upon the conclusions of the investigation, outweighed the public interest in withholding the Report in order to protect a free and frank exchange of views. This was on the basis that only the first 12 pages were disclosed with redactions to Sections 4 and 5 as set out in paragraph 47 above (and pursuant to section 40 FOIA as set out below).

Section 40 FOIA

[58]The Tribunal decided, after considering the further submissions of the parties in this regard (see paragraph 22 above), that further redactions should be made to the first 12 pages of the Report before disclosure in light of section 40 FOIA (personal data). Those redactions are set out in full in the Closed Annex to this Decision. The Tribunal took into account the redactions proposed by the University in a Closed Annex to its further submissions.[59]References to the Appellant must be redacted pursuant to section 40(1) because they constitute personal data of which the Appellant is the data subject and are therefore exempt. Section 40(1) is an absolute exemption; the public interest balancing test does not apply.[60]In relation to section 40(2), the Tribunal decided that personal data of the individual whose appointments were the focus of the investigation must be redacted. In addition to their name, other personal data from which they could be identified must be redacted, such as the specific dates and details of their appointments and the reasons for those appointments.[61]Disclosure of this personal data would contravene the Article 5(1)(a) principle that personal data must be processed fairly and lawfully. The Tribunal concluded that disclosure would not be lawful because the individual’s interests and fundamental rights and freedoms overrode the legitimate interest in disclosure – and therefore the first condition in section 40(3A). While the appointments were likely to be in the public domain, the specific circumstances of and reasons for them, which include personal circumstances sensitive to the Appellant, were not. There are legitimate interests in transparency and accountability in relation to the University’s appointment and PIDA processes and the use of public funds, as noted at paragraphs 49 to 51 and 57 above. However, disclosure of the individual’s personal data was not necessary for the purposes of those legitimate interests. The legitimate interests rest in the findings of the investigator about the University’s failure to follow due process and is satisfied by the disclosure of those sections of the Report without the identification of the individual concerned.[62]Section 40(2) FOIA is an absolute exemption in relation to the first condition under section 40(3A): the public interest balancing test does not apply.[63]The Tribunal decided that it was not necessary to redact the number of appointments, the general nature of the appointments nor the broad timeframe. The University did not make any specific submissions in this regard nor draw our attention to other available information which might facilitate identification by a “motivated intruder”. The University did not approach the individual concerned about redactions. The Tribunal concluded, applying the guidance of Upper Tribunal Judge Jacobs in NHS Business Services Authority (see paragraphs 35 and 36 above) and considering in particular the large number of appointments made by the University each year, that it would not be possible for the individual concerned to be identified from the remaining unredacted information.[64]The University did not submit that the name of the Vice President (Operations) who commissioned the Report should be redacted, which the Tribunal found appropriate, given the seniority of her role. The Tribunal accepted that the names of junior employees should be redacted.

Conclusion

[65]For the reasons set out above, the Tribunal concluded that the first 12 pages of the Report should be disclosed to the Appellant in response to the Request pursuant to section 1(1) FOIA, subject to the redactions set out in the Closed Annex to this Decision. The Rule 14 Orders which apply to the Report are lifted in respect of the unredacted information only.[66]The appeal is allowed.