Shajad Hussain v The Information Commissioner [2024] UKFTT 451 (GRC)

[2024] UKFTT 00451 (GRC)Case Reference: EA/2024/0001
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 22 April 2024Date 4 June 2024
Information Rights
Heard in GRC Remote Hearing Rooms, Leicester
Before
TRIBUNAL JUDGE A. MARKS CBETRIBUNAL MEMBER DR. P. MANNTRIBUNAL MEMBER S. WOLF
Between
MR SHAJAD HUSSAINAppellantTHE INFORMATION COMMISSIONERRespondentThe Appellant: represented himself with assistance from Dr Reuben KirkhamThe Respondent: was not present nor represented at the hearingDecision: The appeal is dismissed.Supplementary rulings:1.The appellant’s request to audio-record the proceedings himself was refused at the hearing.2.The appellant’s subsequent request for a copy of HMCTS’s audio-recording of the hearing is refused.REASONS

Introduction

[1]This is an appeal against the Information Commissioner’s decision notice IC-262345-T8Y9 dated 28 November 2023 (‘DN’).[2]The Appellant (‘Mr Hussain’) requested from the City of Bradford Metropolitan District Council (‘the Council’)the name, registration number and date last employed by the Council of Social Workers no longer employed by the Council.[3]The Council confirmed that it held the information but refused to disclose it, relying on the exemption in the Freedom of Information Act 2000 (‘FOIA’) section 40(2) (third party personal information).[4]The Commissioner decided that the Council was entitled to rely on s.40(2) FOIA.

The request, internal review and response

[5]Mr Hussain’s request of the Council on 19 September 2023 read:
“I would like the name, registration SWID number and date last employed at Bradford Council, of all Social Workers NOT included in the recently published list by Social Work England of even date regarding 1,062 individuals you presently employ as registered Social Workers in Bradford. I am only interested in those Social Workers who are no longer working with Bradford Council but were once employed by you.”
[6]On 29 September 2023, the Council refused to disclose the information citing sections 40(2) and (3A) FOIA.[7]On the same day, Mr Hussain asked the Council to carry out an internal review of its decision to withhold the information.[8]On 5 October 2023, the Council responded. It maintained its original decision.

Complaint to the Commissioner

[9]On 5 October 2023, Mr Hussain complained to the Commissioner about the Council’s handling of his request.[10]In his complaint, Mr Hussain challenged the Council’s claim that the requested information is personal information, arguing that this was incorrect and that the Council’s reliance on s.40 FOIA is excessive.

The Decision Notice (‘DN’)

[11]On 28 November 2023, the Commissioner issued his DN which in summary concluded that:(a) The information requested both relates to and could identify social workers who used to be employed by the Council so falls within the definition of personal data in s.3(2) DPA.(b) Since disclosure of personal data in response to a FOIA request amounts to ‘processing’ of that data, it can only be disclosed in accordance with data protection principles if to do so would be lawful, fair and transparent.(c) In considering whether disclosure of personal data would be lawful, it is necessary to consider where there is a legitimate interest in disclosing the information; whether disclosure of the information is necessary; and whether these interests override the rights and freedoms of the individuals whose personal information it is.(d) The Commissioner accepts that there is a legitimate interest in ensuring that any social workers who used to be employed by the Council were registered and qualified. The Commissioner also accepts that disclosure of the withheld information is necessary, to some extent, to meet this legitimate interest.(e) However, the Commissioner considers that the social workers who used to be employed by the Council would have a strong and reasonable expectation that their name, registration number and information relating to their employment such as the date that their employment ended, would remain confidential to them and the Council given that they are no longer employed by the Council.(f) The Commissioner therefore determined that there is insufficient legitimate interest to outweigh the fundamental rights and freedoms of the social workers who used to be employed by the Council. He therefore considers there is no legal basis for the Council to disclose the withheld information, and to do so would be in breach of data protection principle (a).(g) The Commissioner therefore decided that the Council is entitled to rely on s.40(2) FOIA to refuse to provide the withheld information.

Appeal to the Tribunal

[12]On 26 December 2023, Mr Hussain sent a Notice of Appeal to the Tribunal challenging the DN.[13]Mr Hussain’s Grounds of Appeal were, in summary:(a) Ground 1 - challenging the Commissioner’s definition of personal data.(b) Ground 2 - Mr Hussain has been openly recording social workers he has been interacting with, and publishing such recordings online after making the local authority fully aware of what he was doing. Social workers cannot have an expectation of privacy whilst they carry out a public function such as social work.[14]Mr Hussain asks the Tribunal to overturn the original decision to withhold the information. The Law Sections 1 FOIA: general right of access to information held by public authorities

The Law

[15]Anyone requesting information from a public authority has the right to be informed whether the public authority holds information and, if so, to have that information communicated to him.[16]However, those rights are subject to exemptions as set out in Part II of FOIA. The relevant exemption for the purposes of this case is s.40(2) FOIA.

Section 40 FOIA: Personal data

[17]S. 40(2) FOIA renders information exempt from disclosure to the extent it includes personal data of a third party, and its disclosure would contravene any of the data protection principles (‘DP principles’) relating to the processing of personal data as set out in Article 5 of the UK General Data Protection Regulation (‘UK GDPR’).[18]The first question is whether the information is ‘personal data’ as defined by s.3(2) DPA, namely: ‘…any information relating to an identified or identifiable living individual’.[19]Information relates to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.[20]If the information is personal data, the second question is whether its disclosure would breach any of the DP principles.[21]The most relevant DP principle in this case is Article 5(1)(a) UK GDPR which provides that personal data shall be processed ‘lawfully, fairly and in a transparent manner in relation to the data subject’.[22]‘Processing’ of personal data includes its disclosure in response to a FOIA request: thus information can only be disclosed under FOIA if to do so would be lawful, fair and transparent.[23]Article 6(1) UK GDPR provides that where a public authority is holding personal information as part of its general processing, such processing will be ‘lawful’ if and to the extent that at least one of six conditions applies. These conditions include (most relevantly for the present case):
‘(f) The processing is necessary for the purposes of legitimate interests pursued by…a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...’
[24]In considering whether Article 6(1) UK GDPR applies in the context of a FOIA request, there is therefore a three-part test:(a) Legitimate interest: is a legitimate interest being pursued by the FOIA request?(b) Necessity: is disclosure of the information necessary to meet that legitimate interest?(c) Balancing test: do the legitimate interest and necessity override the interests or fundamental rights and freedoms of the person whose data is requested to be disclosed?

The role of the Tribunal

[25]The powers of the Tribunal in determining appeals against the Commissioner’s decisions for the purposes of FOIA are as follows: s.57 Appeal against notices… (a). Where a decision notice has been served, the complainant or the public authority may appeal to the Tribunal against the notice… s.58 Determination of appeals (1). If on an appeal under section 57 the Tribunal considers -(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, 28. the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal. (2). On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

Evidence

[26]Before the hearing, the parties had submitted written evidence. This comprised an Open Bundle of 43 pages (including an Index).[27]At the hearing, the Commissioner neither appeared nor was represented.[28]However Mr Hussain attended the hearing and made submissions summarised below as did Dr Kirkham on Mr Hussain’s behalf. These too are summarised below. Neither Mr Hussain nor Dr Kirkham produced any evidence additional to that in the Open Bundle.

Summary of written submissions on behalf of the Commissioner

[29]In his written submissions, the Commissioner invited the Tribunal to dismiss the appeal for the following reasons. In summary:(a) When considering the first part of the three-part test summarised in paragraph 24 above, a wide range of interests can be legitimate. They can be the requester’s own interests or those of third parties, and commercial interests as well as wider societal benefits including broad principles of accountability and transparency as well as case-specific interests. However, if the requester is pursuing a purely private concern unrelated to any broader public interest, unrestricted disclosure to the general public would be unlikely to be proportionate.(b) Secondly, ‘necessity’ for the second limb of the test means more than desirable but less than absolute necessity, hence ‘reasonable’ necessity. It involves consideration of alternative measures which may make disclosure of the requested information unnecessary. Disclosure under FOIA must be the least intrusive means of achieving the legitimate aim in question.(c) Then, having established a legitimate interest and having met the necessity test, that legitimate interest must be balanced against the data subject’s interests or fundamental rights and freedoms, bearing in mind the impact of disclosure. If, for example, the data subject would not reasonably expect that the information would be disclosed to the public under FOIA in response to an information request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override a legitimate interest in disclosure.(d) Finally, even if can be demonstrated that disclosure of the requested information would be lawful, it is still necessary to show that disclosure would be fair and transparent under principle (a).(e) Taking each of Mr Hussain’s grounds of appeal in turn: (i) Ground 1 – given the definition of ‘personal data’ in s.3(2) DPA, the Commissioner says that the names and other details requested about social workers no longer employed by the Council is clearly information which identifies living individuals. The Commissioner was correct to determine that the information requested in this case is personal data and the Council was entitled to withhold it as such. (ii) Ground 2 – the fact that Mr Hussain has put into the public domain information about social workers he has interacted with does not make any difference to its characterisation as personal data. Social workers no longer employed by the Council would have a strong and reasonable expectation that the information requested – their personal data – would not be disclosed into the public domain. While Mr Hussain appears to be correct that social workers remain listed on the public register even after they cease practising, the register does not disclose previous employment.(f) On balance, weighing all the relevant factors, the Commissioner was entitled to find that s.40(2) FOIA was correctly applied by the Council.(g) As Mr Hussain has not made any argument of substance nor identified any error of law in the DN, the Tribunal should dismiss the appeal.

Summary of submissions by Mr Hussain

[30]At the oral hearing, Mr Hussain explained that he is dyslexic and would be assisted in making his submissions by Dr Kirkham. In summary, the following points were made:(a) FOIA places a statutory obligation on public authorities to disclose information. However, the Commissioner is undermining the purpose of FOIA by relying on the DPA which is designed to protect citizens’ data. There is a clear logical fallacy here.(b) Mr Hussain has himself provided to the Council the names of the social workers he is interested in. Social Work England (‘SWE’), the social workers’ regulatory body, disclosed the social workers’ names and registration numbers on request so why can’t the Council? Most of the information requested is already available – but in failing to provide social workers’ dates of leaving the Council’s employment, there is a risk of creating a conflict of interest.(c) The DPA deals with living natural people, not corporations. When someone is employed by a public body, they lose their natural person status because they become part of the corporate body. In return for employment by a public body and being paid from public funds, public sector employees lose a level of privacy as representatives of the state. The Commissioner has therefore failed to recognise the difference between the service provider and the service user, and therefore failed to differentiate between the state and the citizen. For the Commissioner to argue that the DPA applies is wrong because it confers anonymity on the employee.(d) As a regular user of social workers himself, Mr Hussain gives up his personal information and should know who the social workers are as they are part of a corporate structure.(e) Local authorities can take people into care if they have insufficient mental capacity through Court of Protection proceedings. Social workers conduct assessments of individuals’ mental capacity. There is a conflict of interest if a social worker employed by a particular local authority conducts such an assessment: likewise there is a conflict of interest if the assessing social worker previously worked for that local authority – and is entitled to a pension from that local authority.(f) The Commissioner should recognise that the date of a social worker leaving the employment of a local authority – and even when they take their holidays – impacts service users who have a relationship with that authority, as part of the state, and have to make arrangements accordingly.(g) The requester’s legitimate interest in this case is very strong. The principle of open justice requires that someone cannot give evidence when there is a conflict of interest. The Council, on the other hand, has not raised any legitimate interest nor any prejudice other than a broad argument of ‘legitimate expectation’ on the part of the data subjects which is untethered from the facts.(h) Since it is possible to obtain from SWE’s website the names, registered of social workers and the town where they work, it would be possible to find the information requested by checking SWE’s website every day to check for changes. Essentially, the information is already in the public domain.(i) Social workers deal with lots of vulnerable people requiring protection yet social workers can, according to the DN, ‘hide’ their previous employment which was once out in the public domain on SWE’s website. It is merely the obsolescence of such website information rather than principle that means the information is no longer in the public domain.(j) Many social workers list on websites such as LinkedIn their place of employment so this is clearly not sensitive nor secret information. The same is true of many other professionals.(k) The information requested is necessary to pursue a legitimate interest yet no counter-case for withholding the information has been advanced.(l) The DN is defective because it contains only generalised submissions and does not engage with the arguments raised in the case.(m) The Tribunal should not be making decisions about the ‘right to be forgotten’ because it is CV information of individuals who are public officials, in public roles whose actions and decisions have an impact on the public. The Commissioner’s DN is creating a back door for social workers not being accountable, which they should remain even years after the events in question.(n) Recording of social workers at work and publicising these recordings on the internet is a way of achieving transparency, and to highlight as well as counter the incompetence, negative mindset and ‘hiding away’ of local authority social workers. Members of the public, as citizens, have the right to highlight social workers’ actions.(o) Were the information to be disclosed, personal data could be bowdlerised by subtle edits so the identity of a living person cannot be ascertained with certainty.(p) If - as the panel indicated - the Tribunal has not been supplied with a ‘closed’ bundle containing the requested information confidentially under GRC Tribunal Rule 14, something has gone wrong with the process. It might explain why the Commissioner decided as he did. Discussion The facts

Discussion

[31]The panel first considered the relevant facts of this case. Based on all the evidence the panel has seen and heard, the panel has made the following findings of fact based on ‘the balance of probabilities’ (that is, what is more likely than not):(a) No information was provided by the Council in response to Mr Hussain’s request.(b) Certain information falling within the scope of Mr Hussain’s request – such as the name, registered number and town of employment – of social workers is available on SWE’s website. However, that website does not disclose details of social workers’ previous employment such as the location of any previous employer or the date on which the social worker left that employer’s employment.(c) The request sought information about all social workers formerly employed by the Council, not merely the two named in subsequent correspondence nor limited by reference to any dates. Error of law or wrongful exercise of discretionin balancing the public interest Is there an error of law in the Commissioner’s Decision Notice?

Error of law or wrongful exercise of discretionin balancing the public interest

[32]Having made the above findings of fact, the remaining issues for the panel in this case are(a) whether the Commissioner made any error of law in the DN and(b) whether the Commissioner ought to have exercised his discretion differently.[33]Mr Hussain argues that the Commissioner made an error of law in finding that the information he seeks is ‘personal data’.[34]The panel does not accept Mr Hussain’s submissions on this issue for the following reasons:(a) There is no ‘undermining’ of FOIA nor logical fallacy in finding the requested information comprises personal data because FOIA expressly provides - in s.40(2) - an exemption from disclosure under FOIA of third party’s personal data, subject to certain conditions such as those outlined in paragraphs 20-24 above.(b) The fact that certain of the information is available elsewhere makes no difference to the analysis of the legal position under FOIA. For example, the fact that an individual’s name, address and telephone number are widely available in the telephone directory; or that their name, address and month (or even date) of birth is available on the Companies House website, does not mean that a public authority asked for this information under FOIA would be entitled to disclose it.(c) There is no provision in either DPA or FOIA nor any case law or other legal principle of which the panel is aware that treats public sector employees differently from any other people in terms of protection of their personal data under DPA or FOIA.(d) Though citizens - and public servants such as social workers - provide personal information to a wide range of public authorities (such as local authorities and the NHS), they too are protected by DPA and FOIA as regards disclosure of that information to third parties.(e) The potential conflict of interest in a social worker currently or previously employed by a local authority making a mental capacity assessment and/or giving evidence in Court of Protection proceedings brought by that local authority does not render their personal data disclosable under FOIA. There is an alternative, more proportionate and less intrusive way of dealing with potential conflicts of interest in such situations than disclosing personal data about all formerly employed social workers to the world at large under FOIA. We return to this issue in paragraph 41 below.(f) The fact that a social worker leaving their employment – or going on holiday – impacts those clients and families within the community with whom they are or were working again does not render their personal data disclosable under FOIA. No legal principle or authority for such a proposition was drawn to the panel’s attention nor is the panel aware of any.(g) Even if the information sought can be obtained by persistent scrutiny of the SWE website, that does not make personal data disclosable under FOIA. If anything, if the information requested is accessible to the applicant by other means, that may well engage the absolute exemption in s.21 FOIA.(h) Personal information does not have to be ‘sensitive’ or ‘secret’ to enjoy the protection of DPA and the absolute exemption under s.40(2) FOIA.(i) In applying FOIA in this case, the panel is not making decisions about the ‘right to be forgotten’. It is simply applying the law set out in FOIA and DPA to the information requested to ascertain whether it is personal data and, if so, whether it falls within the exemption in s.40(2) FOIA. Nor is the panel making any decision about the accountability of social workers for their actions: complaints and redress relating to social workers’ actions and omissions do not fall within the scope of this Tribunal’s jurisdiction and should be directed elsewhere.(j) The fact that social workers have been covertly (or even overtly) recorded at work and such recordings posted on the internet does not alter the legal analysis of their personal data for the purposes of FOIA.(k) The absence of any ‘closed’ information or ‘closed’ bundle in this case is in the panel’s view both irrelevant and unsurprising since the actual content of the information would have no impact on the decision of whether or not it is ‘personal data’.[35]The panel is satisfied that the requested information does constitute personal data. This is because the dates of social workers leaving their employment by the Council - especially when coupled with their names and registration numbers – is information clearly linked to each individual social worker, being a person who is both living and identifiable.[36]The panel is therefore satisfied that the Commissioner made no error of law in his DN.

Did the Commissioner wrongfully exercise his discretion?

[37]On the second question of whether disclosure of the requested information would contravene any DP principles, the panel agrees with the Commissioner that the most relevant DP principle in this case is Article 5(1)(a) summarised in paragraph 21 above.[38]The panel also broadly accepts the Commissioner’s analysis in paragraphs 16 to 19 of the DN about lawful processing of personal data under Article 6(1)(f) of the UK GDPR.[39]However, the panel does not wholly agree with the Commissioner’s comments in paragraph 17 of the DN. In this case, Mr Hussain is not seeking the requested information to check that social workers who used to be employed by the Council were registered and qualified. Even if he were, on his own evidence he was able to do this by checking SWE’s website. The panel does not therefore accept the Commissioner’s conclusion in that regard.[40]In the panel’s view, Mr Hussain’s stated legitimate interest in obtaining the requested information is to reduce the risk of a conflict of interest were a social worker formerly employed by the Council to be involved in assessing the mental capacity of an individual for the purposes of Court of Protection proceedings – and presumably otherwise participating in such proceedings.[41]While the panel considers that this is a strong legitimate interest – and engages the principle of open justice as submitted – the panel does not accept that disclosure of the requested information is necessary to meet that legitimate interest. The panel considers an alternative, far more proportionate and less intrusive means of obtaining the requested information is to ask the Council in the context of any Court of Protection proceedings whether any social worker engaged to assess the individual’s mental capacity has ever worked for the Council. The panel concludes that it would be wholly disproportionate, unnecessary and intrusive for the requested information - in relation to all social workers previously employed by the Council - to be disclosed under FOIA in response to the request.[42]For similar reasons, the panel does not accept the submission that – while social workers obviously do deal with vulnerable people requiring protection – social workers are enabled to ‘hide’ behind their former employers relying on s.40(2) to refuse to decline personal information about their previous employment. While the panel considers that accountability of social workers is a legitimate interest, it considers that a more proportionate and appropriate way of holding individual social workers accountable for their actions and omissions is to complain about any shortcomings to SWE as their regulator or to the Council as their (former) employer for investigation and redress. Again, therefore, the panel concludes that it would be wholly disproportionate, unnecessary and intrusive for the requested information - about all social workers formerly employed by the Council - to be disclosed under FOIA in pursuit of this claimed legitimate interest.[43]In the panel’s view, the disclosure of information about all former social workers’ leaving dates from the Council’s employment is disproportionate (since the likelihood of any one of them being involved in the assessment of a client’s mental capacity is remote) and unnecessary (since any potential conflict of interest can be identified in the course of Court of Protection proceedings). In this case it is difficult to understand the rationale for seeking the leaving dates of two named social workers since it is already obvious, for conflicts purposes, that they had previous dealings with the requester who already has both their names and SWE registration numbers.[44]Considering the reasonable expectations of social workers currently or previously employed by the Council, we agree with the Commissioner that they would have had no such expectations that personal data about them, including their date of leaving the Council’s employment, would be disclosed to the world at large under FOIA.[45]In short, in applying the three-part test to disclosure of the personal data requested in this case, the panel is satisfied that such disclosure is not necessary for the legitimate interest pursued - and that even if it were, the outcome of the balancing test is that the data subjects’ interests or fundamental rights and freedoms override the legitimate interests of Mr Hussain as the requester of disclosure of their personal data.

Conclusion

[46]For the reasons set out above, the panel finds that the Commissioner’s DN was not wrong in law in finding that the requested information comprises personal data under DPA nor was he wrong in finding that disclosure would breach the DP principle set out in Article 5(1)(a) UK GDPR.[47]The panel also finds that the Commissioner was entitled to exercise his discretion in the way he did, namely in favour of the data subjects’ overriding interests or fundamental rights and freedoms in protection of their personal data under Article 6(1)(f) UK GDPR.[48]Accordingly, the appeal is dismissed.[49]Supplemental rulings by the Tribunal Judge are set out in the Appendix below.