Dimitri Shvorob v The Information Commissioner [2024] UKFTT 394 (GRC)

Case Reference: EA-2023-0461[2024] UKFTT 00394 (GRC)
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 15 May 2024Date 21 May 2024
Information Rights
Heard: On the papers
Before
TRIBUNAL Judge SOPHIE BUckleyTRIBUNAL MEMBER PIeter dewaalTRIBUNAL MEMBER susan wolf
Between
DIMITRI SHVOROBAppellantThe Information commissionerRespondentDecision: The appeal is dismissedREASONS

Introduction

[1]The parties and the tribunal agreed that this matter was suitable for determination on the papers.[2]This is an appeal against the Commissioner’s decision notice IC-241715-X0Z9 of 30 October 2023 which held that the London Borough of Bexley (the Council) were entitled to rely on section 40(2) (personal information) of the Freedom of Information Act 2000 (FOIA) to withhold the requested information.

Background to the appeal

[3]Section 31 of the Localism Act 2011 requires councillors to declare any financial interests that they may have that relate to their work. It also prohibits them from participating in discussions or decisions affecting matters in which they have a financial interest. For transparency, these interests are usually made public.[4]Section 32 of the Localism Act provides: 32 Sensitive interests(1) Subsections (2) and (3) apply where— (a) a member or co-opted member of a relevant authority has an interest (whether or not a disclosable pecuniary interest), and (b) the nature of the interest is such that the member or co-opted member, and the authority’s monitoring officer, consider that disclosure of the details of the interest could lead to the member or co-opted member, or a person connected with the member or co-opted member, being subject to violence or intimidation.(2) If the interest is entered in the authority’s register, copies of the register that are made available for inspection, and any published version of the register, must not include details of the interest (but may state that the member or co-opted member has an interest the details of which are withheld under this subsection).[5]In essence section 32 allows a local authority to not publish details of a particular interest if the councillor considers that publishing could lead to them or their families being subject to violence or intimidation. Any such application must be approved by the local authority’s monitoring officer, who must also consider that publication could lead to violence or intimidation.[6]This appeal relates to exemption requests made by councillors under section 32.[7]The appellant is a local blogger with an interest in the Council’s governance. He has concerns about the abuse of the section 32 exemption and ‘rubber stamping’ of section 32 applications by the monitoring officer. Requests, Decision Notice and appeal The Request

Requests, Decision Notice and appeal

[8]This appeal concerns a request made to the Council on 22 March 2023:
“As a follow-up to FOI request 13609782, where the monitoring officer confirmed that in 2022, she reviewed and approved requests for Section 32 exemptions for councillors [names redacted], can you please 1. Share suitably anonymised justifications for the exemption, proposed by the councillors. 2. Advise how many Section 32 applications (if any) were rejected in 2022.”

The response

[9]The Council responded on 27 April 2023. The Council confirmed that it held the information requested in part 1 but withheld it under section 40(2) FOIA. In relation to part 2 of the request the Council said that it did not hold the information because no section 32 applications were rejected in 2022.[10]In the appellant’s request for an internal review dated 30 April 2023, he noted, inter alia, that the request was for anonymised information. The Council upheld its position on internal review.[11]During the course of the Commissioner’s investigation the Council: 11.1. Relied in addition on section 44(1)(a) FOIA (statutory prohibition) 11.2. Confirmed that the requested information was not held in relation to a number of named councillors because there was no written record. 11.3. Confirmed that the justification for the exemption in relation to one named councillor could be disclosed because it was in the public domain.[12]This change in position was confirmed to the appellant in writing.

The Decision Notice

[13]In a decision notice dated 30 October 2023 the Commissioner concluded that the Council was entitled to rely on section 40(2) FOIA.[14]The Commissioner concluded that the withheld information contained details of the perceived threat and of the individuals involved and also contained some information that the Commissioner considered would be special category data about identifiable individuals. He concluded that the information was personal data.[15]In relation to the special category data, the Commissioner concluded that there was no legal basis for disclosure because there was no explicit consent and the data had not been made manifestly public by the data subject/s. This information was therefore exempt under section 40(2).[16]In relation to the information that was not special category data, the Commissioner accepted that the appellant had a legitimate interest in the information because disclosure would shed light on any ‘rubber stamping’ or abuse of section 32 of the Localism Act.[17]The Commissioner was not satisfied that disclosure was reasonably necessary because he concluded that there were less intrusive means of achieving the legitimate aims, namely filing a complaint and asking for the matter to be investigated and, if appropriate, referring to the Ombudsman.[18]The Commissioner held that the majority of the information was special category data and once such data had been removed the remaining information would only provide a partial picture of how the process operated.[19]Further, the Commissioner noted that all councillors, whether they have applied for an exemption or not, are subject to section 31. They are prevented from discussing or voting on matters in which they have a financial interest irrespective of whether the interest is or is not published. The Monitoring Officer is responsible for ensuring that interests are properly declared and that councillors recuse themselves where appropriate. Further each councillor’s entry shows where the exemption has been applied, which for most councillors relates to land they own or lease in the borough.[20]If a person suspected that a particular councillor had taken advantage of an interest not being published and taken part in a decision in which they had a financial interest, that person would be able to raise the matter with the Monitoring Officer and, if necessary, with the Ombudsman. This still allows councillors to be held to account without revealing their personal data to the world at large.[21]Having concluded that disclosure was not reasonably necessary, the Commissioner did not go on to consider whether disclosure would be fair or transparent.[22]As the Commissioner was satisfied that the information was exempt under section 40(2) FOIA, he did not need to consider section 44.

Notice of Appeal

[23]The Grounds of Appeal are, in essence, that the Commissioner was wrong to conclude that the information was exempt under section 40(2). The appellant highlights that the request is for anonymised data and questions the “’sensitive information’ defence”.

The Commissioner’s response

[24]In essence the Commissioner relied on and repeated the reasoning in his decision notice.[25]In addition the Commissioner submitted that anonymisation was not capable of rendering the individuals non-identifiable.

The appellant’s reply and additional submissions

[26]The appellant submitted, in summary, that it was possible to render the data subjects non-identifiable. He also reiterated the public interest in disclosure.[27]The appellant was provided with further information on the contents of the closed bundle in an order dated 9 May 2024. In response to that information the appellant provided further submissions in which he repeated his submission that it would be possible to share the withheld information if it was suitably redacted. He stated that his interest was in whether any ‘case-specific’ reasoning was provided by the councillors.

Legal framework

[28]The relevant parts of section 40 of FOIA provide:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) It constitutes personal data which does not fall within subsection (1), and (b) either the first, second or the third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act - (a) would contravene any of the data protection principles... …[29]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA): (2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of X.[30]The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA [2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.[31]In Durant, Auld LJ, giving the leading judgment said at [28]:
“Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.”
[32]In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:
“It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.”
[33]The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider: “(2) Does the data "relate" to an individual in the sense that it is "about" that individual because of its:(i) "Content" in referring to the identity, characteristics or behaviour of the individual?(ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?(iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)? (3) Are any of the 8 questions provided by the TGN are applicable? These questions are as follows: (i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller? (ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession? (iii) Is the data 'obviously about' a particular individual?(iv) Is the data 'linked to' an individual so that it provides particular information about that individual?(v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?(vi) Does the data have any biographical significance in relation to the individual?(vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?(viii) Does the data impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)? (4) Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?” (i) "Content" in referring to the identity, characteristics or behaviour of the individual? (ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated? (iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)? (i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller? (ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession? (iii) Is the data 'obviously about' a particular individual? (iv) Is the data 'linked to' an individual so that it provides particular information about that individual? (v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual? (vi) Does the data have any biographical significance in relation to the individual? (vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event? (viii) Does the data impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)?[34]‘Identifiable’ means a living individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data (NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192 (AAC)).[35]The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[36]The only potentially relevant basis here is article 6(1)(f):
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”
[37]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows: 1. Is the data controller or a third party pursuing a legitimate interest or interests? 2. Is the processing involved necessary for the purposes of those interests? 3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[38]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner[2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: “27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “[39]Article 9 UKGDPR provides, relevantly, as follows:
“Article 9 Processing of special categories of personal data 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. (emphasis added) 2. Paragraph 1 shall not apply if one of the following applies: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; … (e) processing relates to personal data which are manifestly made public by the data subject; …”
[40]Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The role of the tribunal

[41]The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[42]The issues for the tribunal to determine are: 42.1. Is the requested information (‘anonymised’ justifications) personal information relating to an identifiable living individual? 42.2. Is any of that information special category data? 42.3. In relation to any data that is not special category data: 42.3.1. Is the data controller or a third party pursuing a legitimate interest or interests? 42.3.2. Is the processing involved necessary for the purposes of those interests? 42.3.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

Evidence

[43]The tribunal read an open and a closed bundle.

Discussion and conclusions

[44]The appellant’s request, in effect, is for any recorded information held by the Council, ‘suitably anonymised’, which contains the justifications put forward by ten councillors, who are named in the request, for the publication exemption provided under section 32 of the Localism Act.[45]There is no recorded information containing the justifications put forward by four of the councillors, because they were put forward orally and no written record was made of the discussions. The Council should have given a ‘not held’ response to the request in so far as it related to these councillors. The Council confirmed to the appellant in writing in the course of the Commissioner’s investigation that this information was not held and the appellant raises no issue about this in his grounds of appeal.[46]In relation to one of the remaining councillors the justification is not withheld because it is in the public domain.[47]There remain five councillors by whom justification for the section 32 exemption was put forward in writing. That is the information that has been withheld and is in issue in this appeal.[48]We consider first whether the information, in unredacted form, is personal data in the sense that it relates to an identifiable individual. We then consider if it is possible to anonymise that data so that it no longer relates to an identifiable individual.[49]Each justification consists of an individual set of circumstances that are specific to each councillor. The information, in relation to each councillor, is clearly about that individual. In each case it relates to that individual’s personal life and has biographical significance and has impact on that individual in a personal capacity. In some cases it refers to the characteristics, identity or behaviour of that individual. On that basis we find that the information relates to each individual.[50]It goes without saying that if the information were released without any redactions, each councillor would be identifiable, because the information is contained in an email from that individual councillor containing the councillor’s name.[51]However, the request is for ‘suitably anonymised data’ and therefore we must consider if it is possible to provide the justifications in anonymised form, i.e. so that a councillor cannot be identified.[52]We consider first whether the councillors would be identifiable if just their names and email addresses were redacted. ‘Identifiable’ means an individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data.[53]The individuals that have relied on section 32 are named in the request, and also identified in the Council’s public register of interests. However, it is not sufficient to say that this is a small pool of individuals and that the public might be able to bridge the gap between the information and the data subject by means of speculation.[54]Accordingly the tribunal has considered whether, in relation to each individual councillor, it is possible to identify that particular individual using the information contained in the justification, any information in the public domain and any information that could be obtained by a ‘motivated intruder’. It is also legitimate to take account of information that is likely to be known to particular groups of people, including, for example, those in the councillor’s ward and/or the friends, colleagues and family of the individual councillors.[55]Having considered each specific justification put forward we find that the particular personal nature of each of those justifications, combined with other information that is likely to be known to particular groups of people, would allow some groups of people to identify which one of the five named councillors had put forward that particular justification.[56]We have considered whether it is possible to further redact the justifications to remove any facts which would enable identification. However, the justification put forward,in each case, is the personal facts relating to that individual. Without those very personal facts, there is no justification to disclose.[57]For those reasons we conclude that it is not possible to ‘anonymise’ the data, in the sense that we find that any information within the scope of the request renders the individual identifiable.[58]On that basis we agree with the Commissioner that the requested information is personal data.

Special category data

[59]We do not agree with the Commissioner that the ‘majority’ of the withheld information is special category data.[60]In relation to one of the councillors the justification provided is special category data. The tribunal considers that one of the other justifications may be special category data but it is not possible to determine that from the information provided and we have therefore not considered it under this heading.[61]There is no evidence of consent or that the special category data has been manifestly made public by the councillor in question, and this information is therefore exempt under section 40(2).

Is disclosure reasonably necessary for the purpose of a legitimate interest?

[62]In relation to the remaining councillors, we accept that there is a legitimate interest in disclosure. There is a legitimate interest in shedding light on whether the legislation was being complied with, specifically whether or not the Monitoring Officer has been ‘rubber-stamping’ the reasons put forward by councillors in their justification and whether generic or ‘case-specific’ reasoning had been put forward/accepted.[63]We take a different view from the Commissioner in relation to necessity. In our view, disclosure is reasonably necessary for the above legitimate interest because without sight of the justifications, it is not possible to ascertain whether generic reasons or case-specific reasons had been put forward. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[64]Although we have taken the view that disclosure is reasonably necessary for the purposes of the particular legitimate interests put forward by the appellant, in considering whether these interests are overridden we note that there is already a level of transparency in relation to the application of section 32 of the Localism Act.[65]The fact that section 32 has been applied in relation to a particular councillor is public. The statutory test that has been applied is also public. The exemption from disclosure in section 32 is expressly limited to circumstances where a councillor and the Monitoring Officer consider that the interests in question are sensitive, i.e. that its publication could lead to persons being subject to violence or intimidation. The Monitoring Officer and councillors are not unaccountable when applying that test. A complaint can be made in relation to a councillor’s conduct. If there are concerns about whether a Monitoring Officer is performing their role properly, a complaint can be made to the Council and it may be within the remit of the Local Government and Social Care Ombudsman.[66]Taking into account the personal nature of the justification put forward, and the inherent link between those facts and a risk of violence or intimidation, we find that the data subjects would have had a reasonable expectation that the facts put forward to justify the application of section 32 would not be made public by the Council. Further, in the context of the sensitive nature of the information and asserted risks of violence and intimidation, we find that disclosure would be likely to cause upset and could potentially lead to a risk of harm. In those circumstances we take the view, in relation to each of the five councillors in question, that the legitimate interests in disclosure are overridden by the fundamental rights and freedoms of each data subject.[67]For those reasons we conclude that the information is exempt under section 40(2) FOIA and the appeal is dismissed. Signed Sophie Buckley Date: 21 May 2024 Judge of the First-tier Tribunal Promulgated on: 21 May 2024