Moade Shubita v The Information Commissioner [2024] UKFTT 426 (GRC)

[2024] UKFTT 00426 (GRC)Case Reference: EA-2023-0421
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 7 May 2024Date 30 May 2024
Information Rights
Heard: By CVP
Before
TRIBUNAL Judge SOPHIE BUckleyTRIBUNAL MEMBER RAZ EdwardsTRIBUNAL MEMBER dave sivers
Between
MOADE SHUBITAAppellantThe Information commissionerRespondentIn person for AppellantDid not appear for RespondentDecision: The appeal is dismissed.REASONS

Introduction

[1]This is an appeal against the Commissioner’s decision notice IC-243584-C4F2 of 30 August 2023 which held, on the balance of probabilities, that the Board of Governors of Leeds Becket University (the University) held no further information within the scope of the request. The Commissioner also held that the University was entitled to withhold some information under section 40(2) (personal information) of the Freedom of Information Act 2000.

Background to the appeal

[2]This appeal relates to a role as Interim Head of the Graduate School/Associate Registrar at the University which was advertised in May 2022. The advert stated:
‘We welcome applications from all individuals and particularly from black and minority ethnic candidates as members of these groups are currently under-represented at this level of post’
. The appellant applied for the post and was unsuccessful.[3]The appellant states in the grounds of appeal that “It came to the Appellant’s attention that the other two candidates who applied to the same post were white females, while the Appellant is an ethnic minority”. Requests, Decision Notice and appeal The Request

Requests, Decision Notice and appeal

[4]This appeal concerns a request made to the University on 22 March 2023. The only part of the request that remains in issue is part 1 of the request:
“First: there is an opening for the Interim Head of the Graduate School/Associate Registrar of the Graduate School at grade 10 with reference (REQ0000971); I need to know the number of applicants, race, and gender along with any anonymised information about the applicants and related paperwork. Second, for the same post (REQ0000971), there was an external assessor from the University of Warwick. The HR assigned him a task to review an application; I need to know if the university paid the external assessor money and to see the public element of any paperwork related to this assignment; the external assessor’s name is [redacted name]. The external assessor reviewed how many applications? Third, Besides the university website, there was an external agent for the same post named Talentedu who helps in disseminating and managing applicants; How much did the University pay Talentedu as an external agent or the contact person? Was there any contract and related paperwork?”

The response

[5]In its response on 21 April 2023 the University provided some information in relation to parts 2 and 3 of the request. In relation to part 1 it refused to provide the race and gender of the applicants under section 40(2) FOIA. The University upheld its position on internal review in relation to parts 1 and 2 of the request. It upheld the internal review in relation to part 3 and provided further information on 19 June 2023.[6]In the course of the Commissioner’s subsequent investigation the University confirmed that: 6.1. It did not hold information on the race and gender of the applicants. 6.2. It had already provided the appellant with the number of applicants. 6.3. It held further information within part 1, namely CV and cover letter information. It withheld this information under section 40(2).

The Decision Notice

[7]In a decision notice dated 13 February 2023 the Commissioner decided that the scope of his investigation was: 7.1. Whether the University was entitled to withhold the CVs and cover letters under section 40(1) and 7.2. Whether the University held information on the race and gender of the applicants.[8]The Commissioner concluded that the University had not recorded the race or gender of the applicants for the post. He concluded, on the balance of probabilities that this information was not held. Because the University did not confirm this to the appellant until four months after the request was made, the Commissioner recorded a breach of section 1(1)(a) FOIA.[9]The Commissioner was satisfied that the CVs and covering letters related to and identified the individuals involved. His view as that, even with the names redacted, the information as likely to contain information that could be used to identify the individuals involved. He concluded that the information was personal data within section 3(2) DPA.[10]The Commissioner accepted that the appellant had a legitimate interest in understanding application processes in general and a legitimate interest in the requested information.[11]The Commissioner does not set out his conclusion as to whether or not disclosure was necessary for the purpose of the legitimate interests, but notes the University’s argument that disclosure was not necessary given the other information available to the appellant.[12]The Commissioner concluded that individuals applying for a job would not reasonably expect their applications to be disclosed and that, however necessary the requested information is considered to be by the appellant, the fundamental rights and freedoms of the applicants override the appellant’s desire to scrutinise the application process.[13]For those reasons the Commissioner concluded that the University was entitled to rely on section 40(2) to withhold the information.

Notice of Appeal

[14]The Grounds of Appeal are, in essence, that the Commissioner was wrong to conclude that the University did not hold race and gender information about the other applicants.[15]The appellant also raises concerns about: 15.1. The fact that even though the University was found to be in breach of section 1(1)(a) FOIA the Commissioner found that the University correctly ‘applied the rules’ in withholding the information about race and gender. 15.2. The University’s responses have been contradictory. 15.3. The information will support the appellant’s case in the employment tribunal.

The Commissioner’s response

[16]The main points of the Commissioner’s response are as follows.[17]The Commissioner submitted that the University has clearly explained that the information held is the CV and covering letter of applicants and this does not contain information on race or gender.[18]Even if the University’s position that it does not hold this information could appear to contradict the ‘job opening’, this does not establish that race or gender information is held.[19]The Commissioner reiterated his findings at paragraph 24 of the DN:
“The suggestion that race and gender might be implied from other personal details provided or from meetings is immaterial as gender or race cannot reliably be determined in this way. There is no requirement to create information in response to a request if it is not held at the time it is received. No information has been provided by the applicants regarding race and gender.”
[20]For the reasons provided in the DN, the Commissioner submitted that there is insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. In particular, the Commissioner remained of the view that there are more appropriate routes to resolve the Appellant’s concerns, as opposed to disclosure of CVs and covering letters submitted by other applicants into the public domain:
“The Commissioner acknowledges that the complainant has cast doubt on the recruitment process (see paragraph 22) and how it was applied. However, the more appropriate route for concerns about a recruitment is the university’s complaint process or other relevant means of addressing a grievance about the conduct of a process. It is beyond the Commissioner’s remit to consider whether a recruitment exercise was conducted appropriately or not.”

The appellant’s reply

[21]The appellant submitted that the core issue is the fact that the University had confirmed that they held the information but refused to disclose it. Further the appellant noted that the opening for the job advert invites ethnic minorities to apply. In the light of this it is argued that the University must hold information about race and gender.

Legal framework

[22]Section 1(1) FOIA provides:
“Any person making a request for information to a public authority is entitled – (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case to have that information communicated to him.”
[23]The scope of a request is determined objectively, in the light of all the surrounding circumstances.[24]The question of whether information was held at the time of the request is determined on the balance of probabilities.[25]The relevant parts of section 40 of FOIA provide:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) It constitutes personal data which does not fall within subsection (1), and (b) either the first, second or the third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act - (a) would contravene any of the data protection principles... …[26]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA): (2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of X.[27]The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[28]The only potentially relevant basis here is article 6(1)(f):
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”
[29]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows: 1. Is the data controller or a third party pursuing a legitimate interest or interests? 2. Is the processing involved necessary for the purposes of those interests? 3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[30]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: “27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “[31]Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The role of the tribunal

[32]The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[33]The issues for the tribunal to determine are: 33.1. On the balance of probabilities did the University hold recorded information on the other applicants’ race and gender? 33.2. Are the CVs and cover letters personal data? 33.3. Is the data controller or a third party pursuing a legitimate interest or interests? 33.4. Is the processing involved necessary for the purposes of those interests? 33.5. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

Evidence

[34]The tribunal read an open bundle. We also read and took account of: 34.1. A supplementary bundle provided by the appellant entitled MS Bundle (26 pages). 34.2. The covering email to that bundle dated 4 March 2024 34.3. A letter from the University to the appellant dated 10 April 2024 relied on by the appellant.

Oral submissions by the appellant

[35]We took into account oral submissions made by the appellant.[36]In his submissions the appellant confirmed that he challenged the Commissioner’s conclusions both in relation to whether information was held and in relation to the application of section 40(2).[37]The appellant confirmed that although in his notice appeal he had stated that ‘it came to [his] attention that the other two candidates who applied for the same post were white females’, this was only informally mentioned ‘in passing’ and he wanted a formal record of the other candidate’s race and gender.[38]The appellant drew the tribunal’s attention to a letter from the University dated 10 April 2024 which confirmed that the University held the appellant’s special category personal data namely his gender, ethnicity, religion and sexual orientation and that this data had been provided to an external assessor at Warwick University as part of the job application process. The appellant submitted that in this letter the University admit that they hold the information for one of the applicants and he questions why that is not held for the other applicants.[39]The appellant was asked by the Judge about how University had come to hold his special category data, and whether he had been asked for that data as part of the application process. The appellant confirmed that he had chosen to include that information in his application because in the advert for the post the University had said that they welcomed applications particularly from black and minority ethnic candidates. On this basis he said that he expected that anyone who applied should or would share such information by default. He said that there was no specific applicant form to complete, instead applicants were required to upload their own documents (a cover letter and a CV).[40]The appellant also raised his concerns about the University’s failure to disclose an email/the deletion of an email containing a scoring sheet in relation to the appellant himself that he had requested in a subject access request.

Discussion and conclusions

[41]First, it is important to note that we are unable to consider the handling by the University of the appellant’s data subject access request. We cannot therefore make any findings in relation to the concerns that the appellant raises about the deletion or non-disclosure of an email containing a scoring sheet relating to him.[42]Second, the appellant raises concerns about the fact that the Commissioner has, on the one hand, found a breach of section 1 FOIA and on the other hand, has accepted that the University did not hold the requested information and has ordered no steps. Whilst we understand that the University’s change of position is frustrating for the appellant, there is no inconsistency in the Commissioner’s decision.[43]The Commissioner has recorded that there is a breach of section 1, because the University’s initial response wrongly stated that the information was held and that it was subject to an exemption. By the time of the decision notice, this had been corrected, so it was appropriate not to order any steps to be taken. In our view there is no error in this approach.

Did the University hold the gender and ethnicity of the other candidates as recorded information?

[44]FOIA gives a right to recorded information. Information that is simply held in the mind of an employee is not recorded information. If a public authority holds the ‘building blocks’ of raw data from which the requested information can be easily derived, then it does not matter that it is not held in the particular form requested.[45]In this case, we do not accept that the gender or ethnicity of the other candidates can be derived from the CVs or application forms or indeed any record of the online discussion with the other candidates unless they have explicitly stated their gender or ethnicity in their application, like the appellant did, or in the online discussion.[46]We do not accept that ethnicity or gender can be derived from, for example, someone’s name, title or appearance. Whilst a title or a name or someone’s appearance can be indicative of a particular gender or ethnicity, it is not necessarily so, and therefore we do not accept that these would amount to a record of that person’s gender or ethnicity.[47]Although the job advert stated that it welcomed applications particularly from black or ethnic minority candidates, individual applicants were not asked or required to specify their gender or ethnicity. There was no form to fill in with boxes for gender or ethnicity. The fact that the appellant chose to provide this information does not mean that other applicants did so. The fact that the University holds this data in relation to the appellant, because he chose to include it in his application, does not indicate that they hold it in relation to the other applicants.[48]The University has stated, belatedly, that it does not hold recorded information on the other applicants’ gender or race. It states in a letter to the Commissioner dated 22 August 2023 that:
‘Applicants for the role were required to submit a cover letter and CV and on examination of these documents neither candidate revealed their race or gender, nor was this information disclosed to the University during an online discussion with the applicants.’
[49]It is extremely unfortunate that the University did not check whether or not it held the requested information when the request was made. It should not have confirmed that it held the information without knowing whether or not that was the case. It should not have relied on an exemption to withhold information before checking it if held that information. It is unacceptable to inform a requestor 5 months later that the information is not held after all.[50]However, we are not prepared to infer from this inconsistency that the information set out in the letter of 22 August 2023 is untrue. It is more likely, in our view, to be a case of incompetence than a case of the University deliberately trying to mislead the tribunal.[51]We accept, on the balance of probabilities, that the other applicants did not reveal their race or ethnicity in the cover letters, CVs or in the online discussion. On that basis we find, on the balance of probabilities, that the University does not hold recorded information on the race or ethnicity of the other applicants.

CVs and cover letters – section 40(2)

[52]We accept that the CVs and cover letters of the other applicants are personal data. Even if the applicants’ names were redacted, a CV and a cover letter are likely to contain personal information that would allow at least some members of the public to identify the individual concerned. The information in a CV and cover letter clearly relates to that individual. For those reasons we conclude that the requested information is personal data.[53]We accept that the appellant is pursuing legitimate interests. First, he wishes to know the gender and ethnicity of the other candidates. Second, he is concerned that the application process was not conducted fairly.[54]We do not accept that it is reasonably necessary to disclose the CVs and cover letters of the other applicants to the world for the purposes of those interests. First, they do not contain a record of the gender and ethnicity of the candidates and therefore they do not serve the first legitimate interest. Second, there are ways of challenging the conduct of the application process by the University that do not need the disclosure of the CVs and cover letters.[55]For example, the appellant does not need the CVs and cover letters in order to pursue a claim in the employment tribunal. Employment tribunals have their own powers to order disclosure of relevant documents, and the respondent in those proceedings will have to disclose any documents which support or adversely affect the appellant’s case in the employment tribunal.[56]In addition, the appellant can challenge the University’s approach to his application without seeing the CVs and cover letters of the other applicants. We note that in the notice of appeal the appellant states ‘Upon following up the matter and via internal processes, the outcome found a breach of applying the policy’. The appellant does not need to see the cover letters and CVs to make a complaint to the University or raise a grievance about the processes followed.[57]For those reasons we conclude that disclosure under FOIA is not necessary for the purposes of the legitimate interests and we do not need to go on to consider if those interests are overridden by the interests or fundamental rights and freedoms of the data subjects. We agree with the Commissioner that the University was entitled to withhold this information under section 40(2) FOIA.[58]For all those reasons the appeal is dismissed. Signed Sophie Buckley Date: 22 May 2024 Judge of the First-tier Tribunal