Des Moore v The Information Commissioner [2024] UKFTT 389 (GRC)

[2024] UKFTT 00389 (GRC)Case Reference: EA/2024/0012.
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on the papers on 03 May 2024.
Between
DES MOOREAppellantTHE INFORMATION COMMISSIONERRespondentThe Appellant: - a Litigant in person in his written Grounds of Appeal dated 04 January 2024. for in person
Information Rights Tribunal
Decision given on 16 May 2024.
Panel: B. Kennedy KC & Specialist panel members Dr. Aimée Gasston & Stephen Shaw.
The Respondent: Richard Bailey by way of written Response on 21 February 2024.Result: The appeal is allowed in part and otherwise dismissed.Substituted Decision: i) For Part 1 of the request, the Tribunal allow the appeal and hereby issue this substituted decision notice to record that the information falling within the scope of Part 1 is not held; and the public authority need take no action & and ii) For Part 3 of the request, the Tribunal dismiss the appeal.REASONSDate 2024-05-16

Introduction:

[1]The Appellant appeals under section 57 of the Freedom of Information Act 2000 (“FOIA”), against the Decision Notice with reference IC-261295 – W3W7 dated 14 December 2023 (the DN) issued by the Information Commissioner (the Commissioner). In the DN the Commissioner concluded that the Appellant had requested information relating to gross misconduct outcomes from Nottinghamshire Police, the Public Authority (“PA”) herein, and the Commissioner’s DN was that the Police has correctly relied on section 40(2) of FOIA to withhold the information and he did not require further steps to be taken (DN §1-3).[2]As required by rule 23(3) of the 2009 Rules, the Commissioner concedes that the appeal should be allowed in part but otherwise opposes the Appellant’s appeal and thereby invites the Tribunal to dismiss part of it.

Factual Background and the request

[3]The Appellant, who is interested in the outcome of two police misconduct proceedings, made a request to the PA. The two police officers who were the subject of those proceedings are: - i) Inspector Russell Dew (who was reported on 19 December 2011 to have been jailed for 6 years for committing sex offences against a 13-year-old schoolgirl and suspended from the force) and; ii) Con. Lee Bowditch (who was reported on 12 March 2019 to have been given an 8-month suspended prison sentence for child sex offences and that a special case hearing also found him guilty of gross misconduct).[4]On 16 August 2023, the Appellant wrote to the PA and requested information in three Parts - :[5]Part 1. “Please provide a copy of the outcome notice of misconduct proceedings for Inspector [name redacted] who was jailed for sexually abusing a 13-year-old girl: [website redacted].[6]Part 2. “The above article refers to a hearing at which it was decided he would forfeit 60 per cent of his pension. If this is a different hearing to the one I seek information on, please also provide recorded information about this hearing”.[7]Part 3. “Please also send me a copy of the outcome notice of misconduct proceedings for [name redacted] who was found guilty of a number of child-sex offences: [website redacted].”[8]The PA responded on 7 September 2023 as follows-: i). Part 1 of the request was refused, relying upon s.40(2) FOIA; ii). For part 2 of the request, no information was held though informed the Appellant that the information was reasonably accessible to the Appellant (such that s.21 was engaged) and a link to the information held by the Nottinghamshire Police & Crime Commissioner was provided; iii). Part 3 of the request was refused, relying upon s.40(2) FOIA.[9]As the Appellant was dissatisfied with this response, he requested an internal review and following an internal review, the PA wrote to the Appellant on 19 September 2023. It stated that it was maintaining its position.[10]The Appellant contacted the Commissioner on 29 September 2023 to complain about the way their request for information had been handled and in particular regarding the above response to parts 1 and 3 of the request.[11]The Appellant said -:
“My view is that the notices are likely to be held on a website that harvests police misconduct notices – [website redacted] - and is therefore publicly available. Unfortunately, this website charges people to see the notices. I can't afford to pay so am therefore excluded from seeing them.”
[12]The Commissioner noted this comment, but took the view that this website access regime, if indeed it was genuine, was clearly not being provided either by the PA nor via FOIA and accordingly the Commissioner did not need to consider it further. However, the Appellant also stated: “Nottinghamshire Police appear to be arguing that information that was made publicly available by them should not be made available to me under FOIA (I'm not certain that both hearings were held in public)".[13]The Commissioner noted that any previous disclosure of the misconduct outcomes that the PA may have made well have been a requirement of the Police Conduct Regulations 2020, i.e. not under FOIA, although the earlier case will have preceded these Regulations. This is a different legal access regime to FOIA and is not something that the Commissioner had any jurisdiction over; as he is only able to consider disclosure under FOIA. In other words, it was not material to his investigation.

The Legal Framework:

[14]A person requesting information from a public authority has a right to be informed by the public authority in writing whether it holds the information (s.1(1)(a) FOIA), and to have that information communicated to him if the public authority holds it (s.1(1)(b) FOIA).[15]However, these rights are subject to certain exemptions, set out in Part II of FOIA. For the purposes of this appeal, the relevant exemption in Part II is s.40 FOIA.[16]This exemption concerns personal data, which is defined as “any information relating to an identified or identifiable living individual” (section 3(2) Data Protection Act 2018 (“DPA”)), and the ‘processing’ of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) DPA), and therefore includes disclosure under FOIA.[17]Under section 40(2) of FOIA, information is exempt if it is not the personal data of the requestor, and “the first, second or third condition below is satisfied.”[18]The first condition, at subsection (3A)(a), is that “the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles.”[19]The first data protection principle under Article 5(1)(a) UK General Data Protection Regulation (UKGDPR) is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”.[20]Article 6 (1)(f) UKGDPR provides: - “(1) Processing shall be lawful only if and to the extent that at least one of the following applies:
“(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”
[21]Criminal offence data under Art 10 UKGDPR is defined in s.11(2) DPA 2018 include personal data relating to –: “(a) the alleged commission of offences by the data subject, or (b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing”.[22]Section 10(4) DPA provides that section 10(5) makes provision for processing relating to criminal convictions and offences not carried out under the control of official authority. Section 10(5) provides that:- “(5) The processing meets the requirement in Article 10 of the GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1”.[23]Criminal offence data can therefore only be processed if one of the conditions in Schedule 1, Parts 1-3 of the DPA are met. If none of these conditions are met, disclosure would not be lawful and would therefore breach the first data protection principle under Article 5(1)(a) UKGDPR. The first condition in section 40(3A) would be satisfied and the information would then be exempt under section 40(2) FOIA.[24]The requirement to demonstrate substantial public interest in Schedule 1 Part 2 DPA is disapplied for criminal offence data.[25]The police misconduct hearing relevant to part 3 of the request took place on 30 January 2019. Police misconduct proceedings at that time were regulated by the Police (Conduct) Regulations 2012 (‘the regulations’), made by the Home Secretary pursuant to powers under the Police Act 1996, Police Reform Act 2002 and the Policing and Crime Act 2017 (the regulations since been replaced by the Police (Conduct) Regulations 2020 which came into force on 1 February 2020).[26]The Regulations define standards of professional behaviour, and prescribe procedures for the investigation and determination of questions of police misconduct, including the imposition of disciplinary sanctions.[27]So far as is relevant to this appeal, regulation 36 of the Regulations provide that:- (1) The officer concerned shall be informed of – (a) The finding of the person or persons conducting the misconduct proceedings; (5) The appropriate authority shall send a copy of any written notice under this regulation to – (a) the Commission, in any case in which the Commission was entitled to attend to make representations under regulation 29(1); and (b) to the complainant and any interested person, in any case to which regulation 30 applies’.

The Commissioner’s Decision:

[28]The Commissioner concluded that the PA was entitled to withhold the information falling within the scope of parts 1 and 3 of the request in accordance with s.40(2) on the following grounds: - i) The requested information constitutes personal data within the definition under section 3(2) DPA [22]; ii) The requested information constitutes criminal offence data as defined in Art 10 UK GDPR [25]; iii) None of the conditions required for processing the criminal offence data contained in the disputed information are satisfied and as such disclosure of this information would breach principle 5(a) UKGDPR and so this information would be exempt under section 40(2);

The Grounds of Appeal:

[29]The Appellant’s material Grounds of Appeal (“GoA”) in relation to a request under the FOIA are essentially that the Commissioner erred in concluding that the PA were correct to withhold the requested information falling within the scope of parts 1 and 3 of the request relying upon the exemption under section 40(2) of the FOIA.

The Commissioner’s Response:

[30]The Commissioner concedes that the Appeal should be allowed concerning part 1 of the request (where they now concede no information is held, as set out below) but should be dismissed concerning the information falling within the scope of part 3 of the request.

Part 1 of request – outcome report for Inspector Russell Dew:

[31]The Commissioner made further enquiries with Nottinghamshire Police following the appeal, and the Commissioner now understands that in fact Nottinghamshire Police does not hold an outcome notice for Inspector Dew. The Commissioner informs the Tribunal in its Response to the Grounds of Appeal that he understands that Inspector Dew in fact resigned before a misconduct hearing could take place. Nottinghamshire Police has now confirmed to the Commissioner that their response to the request relying upon the exemption under section 40(2) was an error and that the response should have stated that the information is not held. The Commissioner provides with his response and in the bundle a copy of an email from the Nottinghamshire Police confirming this.[32]The established test to determine whether a public authority holds information within the scope of a FOIA request is the balance of probabilities – see the Upper Tribunal’s decision in Preston v Information Commissioner [2022] UKUT 344 (citing with approval the decision of the FTT in Bromley v Information Commissioner & Environment Agency EA/2006/0049 & 0050).[33]In the circumstances the Commissioner invited the Tribunal to allow the appeal in part with respect to the information requested in part 1 of the request and to issue a substituted decision notice to reflect that this information was not held at the time of the request.[34]The Tribunal accept this concession and the bona fides in the clarification and we accept that the only information which is held by the PA which in issue in this appeal is therefore the outcome notice following the misconduct hearing of PC Lee Bowditch falling within the scope of Part 3 of the request (‘the withheld information’).

Part 3 of request – outcome report for PC Lee Bowditch

[35]The Commissioner resists the appeal regarding the information held falling within the scope of part 3 of the request. The Commissioner properly argues the burden is upon the Appellant to demonstrate that the Commissioner’s conclusion on the application of s.40(2) to the information within the scope of part 3 of the request is in error of law and the Commissioner relies on the DN as setting out his findings and the reasons for those findings, and repeats the matters stated therein. The Commissioner makes further observations in respect of the Appellant’s Grounds of Appeal which the Tribunal find worthy of note herein.[36]He notes the Appellant does not appear to dispute that the withheld information constitutes personal data within the definition under section 3(2) DPA 2018.[37]Having had the opportunity of considering the withheld information, the Commissioner remains satisfied that the withheld information concerns personal data relating to “the alleged commission of offences by the data subject”. The Commissioner notes that it is in the public domain that PC Lee Bowditch was later given a suspended prison sentence for the offence which was the subject of the police misconduct proceedings. The information therefore falls within the definition of criminal offence data under section 11(2) DPA 2018 for the purposes of Art 10 UKGDPR.[38]The Appellant does not appear to dispute that the withheld information does constitute criminal offence data though nonetheless argues at [6] of his GoA that: - “The Commissioner focuses on criminal record data and provides the Article 10 UK GDPR definition of the term. He is correct to point out that criminal record data is given special status in the UK GDPR, but he misses the point about the specific status of public misconduct notices: a determination has been made that they should be publicly accessible”.[39]In hisGoA the Appellant argues that the Commissioner: “has failed to appreciate the distinction between public and private misconduct notices”, and refers to instances in which a different police force disclosed an outcome notice following a misconduct hearing in public and a disclosure from another force of a redacted outcome notice following a misconduct hearing held in private.[40]The Tribunal remind the parties that each case must be decided on its merits, and the Commissioner has stated in his Response to the GoA that he understands the PA made a decision to hold the misconduct proceedings in private as the Crown Court Case against PC Lee Bowditch was still ongoing at the time and he did not wish to prejudice those proceedings. The Tribunal accept this was appropriate in all the circumstances and have no reason to query this position and we recognise the merit in the submission that the fact that other police forces may have decided to disclose information contained in misconduct outcome notices in response to requests does not necessarily mean that the response from the PA herein, in response to the request in issue in this appeal, was not in accordance with the law. We further accept that in any event, given that the withheld information constitutes criminal offence data, it would still be necessary for the Appellant to establish that one of the conditions of Schedule 1, Parts 1 to 3 DPA 2018 can be met. Article 10(2) directs us to the relevant provisions within the DPA. One of those, Section 11(2) DPA, clearly states that criminal data includes ‘the alleged commission of offences by the data subject’. That brings the closed material in scope, and we do not need to consider further; we would need a Schedule 1 condition and there is none.[41]The Commissioner maintains that the only Schedule 1 conditions that could be relevant to a disclosure under FOIA are the conditions at Part 3 paragraph 29 (consent from the data subject) or Part 3 paragraph 32 (data made manifestly public by the data subject).[42]The Commissioner has seen no evidence that the data subject has specifically consented to the withheld information being disclosed without restriction to the public which would be the case following a disclosure under FOIA.[43]Further, the Commissioner has seen no evidence to suggest that the data subject has deliberately made the withheld information public. The Commissioner considers that this condition is intended to apply in circumstances where the data subject has made deliberate intention to put information in the public domain. However, such a person would not have the same level of control or choice over what is revealed in court or, in this case a misconduct hearing, even if it is part of their defence, given that it can be their reputation at stake. In any event, on the facts of this case, the misconduct hearing in question was held in private.[44]The Appellant argues at [10] of his GoA that: - “I consider Article 6(1)(f) to be relevant because I have a legitimate interest in the information contained in the two public misconduct notices and I am convinced that the processing of this information would neither harm the interest of the two officers concerned nor infringe on their fundamental rights and freedoms”.[45]The Appellant then sets out the legitimate interest he has in the withheld information and the legitimate interests in the public having sight of the information. However, in the event that the Tribunal accepts that none of the conditions required for processing criminal offence data are satisfied, there is no need for the Tribunal to go on and consider whether there is a lawful basis for disclosure pursuant to Article 6 UKGDPR. The Tribunal concurs.

The Tribunals Powers:

[46]These have been set up out clearly in other decisions of the Tribunal. The Tribunal's general powers in relation to appeals are set out in section 58 of the Act. They are in wide terms. Section 58 provides as follows.(1) If on an appeal under section 57 the Tribunal considers (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved is an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based. The question whether the exemptions under s40(2) apply is a question of law or alternatively of mixed fact and law. The Tribunal may consider the merits of the Commissioner's decision as to whether the exemption applies and may substitute its own view if it considers that the Commissioner's decision was erroneous. The Tribunal is not required to adopt the more limited approach that would be followed by the Administrative Court in carrying out a judicial review of a decision by a public authority. Our task is essentially one of fact finding and interpretation of the Law to apply on our determination of those facts.”

Discussion:

[47]The Tribunal accept and adopt the arguments and submissions made in the Commissioner’s comprehensive Response to the GoA. We accept this is a serious case with strong public interest and understand the Appellant’s concerns. However, that is not relevant to our decision making as there is no gateway to disclosure under the FOIA for the reasons given by the Commissioner. Due to the requirements for processing criminal data under the DPA, we find s40(2) squarely applies. As the Commissioner’s Response to the GoA argues, there is no Schedule 1 condition for processing this sensitive data.[48]For all the above reasons we accept and adopt the generality of the reasoning in the DN, subject to the explanation that has been provided in the Commissioner’s Response to the GoA in relation to Part 1 of the request, the error therein and the reasons for it. For the avoidance of doubt, we then reflect further on the reasoning in Commissioner’s Response to the GoA and we accept and adopt his reasoning on the application of the exception to Part 3 of the request.[49]Accordingly, we make the following Substituted Decision; Substituted Decision: i) For Part 1 of the request, the Tribunal allow the appeal and hereby issue this substituted decision notice to record that the information falling within the scope of Part 1 is not held; and the public authority need take no action & ii) For Part 3 of the request, the Tribunal dismiss the appeal. Brian Kennedy KC Date: 16 May 2024.