James Mooney v The Information Commissioner [2024] UKFTT 508 (GRC)

[2024] UKFTT 00508 (GRC)Case Reference: FT/EA/2024/0042
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on the papers on 29 May 2024.
Between
JAMES MOONEYAppellantTHE INFORMATION COMMISSIONERRespondentAs a Litigant in person. for AppellantSonia Taylor of the ICO in a written Response dated 6 March 2024. for Respondent
[Information Rights]
Decision given on 18 June 2024.
Before Panel:
Brian Kennedy KC with Specialist Members, Paul Taylor and Dave Sivers.
Decision: The appeal is dismissed.REASONSDate 2024-06-18

Introduction:

[1]The Appellant appeals under section 57 of the Freedom of Information Act 2000 (“FOIA”), against the Commissioner’s Decision Notice dated 9 January 2024 with the reference number IC- 248461 – C8Q1 (“the DN”). This concerned his FOIA request to the South Kesteven District Council (‘the Council’) for information relating to a Code of Conduct review panel hearing. The Council disclosed some information and refused the remainder of the request under section 40 (Personal information) of FOIA. The Commissioner upheld the Council’s reliance on the exemption applied.[2]As required by rule 23(3) of the 2009 Rules, the Commissioner states that he opposes the Appellant’s appeal and invites the Tribunal to dismiss it.

Factual Background to this Appeal and Decision Notice:

[3]On 17 April 2023, the Appellant wrote to the Council and requested information in the following terms:
“Under the Freedom of Information Act, I would like to request the following information: - “All documentation held by South Kesteven District Council including notifications, forms, letters, emails, minutes of meeting, date of telephone calls, note of telephone calls, file notes, diary notes, proposals, assessments, reports in respect to the notifications, investigation, conclusions, relating to the Code of Conduct Review Panel Hearing dated 12 December 2022 into the complaints against [councillor’s name redacted]. I would request the information is provided in electronic format.”
[4]The Council said information relating to:
“…proposals, assessments and reports in respect of the notifications, investigation and conclusions relating to the Code of Conduct Review Panel Hearing were exempt under the Local Government Act 1972 at the meeting of the Review Panel and are exempt under Section 40(1) [sic] of the FOIA 2000 in respect of your Freedom of Information Request, as was the case with regard to your previous request.”
[5]The Appellant requested an internal review on 26 June 2023, on the following grounds: 1. Various emails referred to documents, but these had not been provided. 2. No emails had been provided regarding the complaints or the panel. 3. The redactions made under section 40 went beyond what was necessary to protect personal data.[6]The Appellant indicated his disagreement with the application of section 40 to withhold proposals assessments and reports in respect of the notifications, investigation and conclusions relating to the Code of Conduct Review Panel Hearing.[7]The Council responded on 20 July 2023, as follows: 1. It asked the complainant to specify the documents he believed had been omitted. 2. It said that complaint emails were exempt under section 40(1) of FOIA, all emails regarding the forming of the panel had been disclosed and that it held no other emails regarding the panel. 3. It said that section 40(1) had been applied correctly to redact personal data. 4. It said that the information was subject to legal professional privilege and that section 42 had been applied correctly. 5. It withdrew reliance on sections 21 and 14(2) and disclosed the Code of Conduct Hearing Procedure, Complaints Procedure and Council Code of Conduct. It said any remaining information was exempt under section 40(1) of FOIA. It made no comment on the complainant’s final point.[8]Then, on 28 July 2023, the councillor who was the subject of the Review Panel Hearing wrote to the Council, confirming that they had no objection to their personal data being disclosed in response to the request.[9]On 3 November 2023, the Council disclosed to the Appellant several email exchanges with the councillor regarding the complaints against them, with redactions for the personal data of third parties, which it held to be exempt under section 40(2) of FOIA. It confirmed that the remaining information continued to be exempt from disclosure under section 40(2) of FOIA.[10]The Appellant contacted the Commissioner on 31 July 2023 to complain about the following aspects of the Council’s handling of the request:• The delay in responding to the request;• The extent of information identified by the Council as falling in scope; and• The application of section 40 to withhold information.[11]In follow-up correspondence, he expressed the view that the Council was applying FOIA exemptions to ‘cover up’ its actions and that this was not an appropriate use of FOIA.[12]The Commissioner’s duty under FOIA is to decide whether a request for information has been dealt with in accordance with the requirements of Part 1 of FOIA, which is concerned with the disclosure of information held by public authorities. The Commissioner has explained to the Appellant that any concerns he has about breaches of law not explicitly covered by FOIA should be pursued with the relevant law enforcement agencies.[13]The Council clarified to the Commissioner that, in its responses to the Appellant, it cited section 40(1) of FOIA (which concerns an applicant’s own personal data) in error. It confirmed that it considered that section 40(2) of FOIA applied (which is concerned with the personal data of third parties).[14]The Commissioners’ analysis considered the application of section 40(2) of FOIA to the withheld information. The Commissioner also considered the extent of the information in scope and the timeliness of the response.[15]The Appellant did not complain to the Commissioner about the Council’s application of section 42, and so that has not been considered in the DN.[16]In follow-up correspondence, the Appellant expressed the view that the Council was applying FOIA exemptions to ‘cover up’ its actions and that this was not an appropriate use of FOIA.[17]The Commissioner’s duty under FOIA is to decide whether a request for information has been dealt with in accordance with the requirements of Part 1 of FOIA, which is concerned with the disclosure of information held by public authorities. The Commissioner again reminded the Appellant that any concerns he has about breaches of law not explicitly covered by FOIA should be pursued with the relevant law enforcement agencies.[18]The Council had clarified to the Commissioner that, in its responses to the Appellant, it cited section 40(1) of FOIA (which concerns an applicant’s own personal data) in error. It confirmed that it considered that section 40(2) of FOIA applied (which is concerned with the personal data of third parties).[19]The Appellant indicated that certain information has not been provided to him. He wrote to the Council on 28 July 2023, listing the items which he had expected to receive. The Commissioner noted that this list is virtually identical to a list of outstanding information he submitted to the Council after it responded to his previous request. In that case, the Council explained to the complainant that it did not hold most of the information, a position the Commissioner upheld in his previous decision notice. In regard to the information it did hold, it said it fell outside of the scope of that request. The complainant did not appeal the Commissioner’s decision notice in that case. In this case, the Commissioner has therefore not found itnecessary to re-investigate whether the Council holds the sameinformation. His previous decision still stands on that point.[20]As regards the information the Council said it did hold, the Commissioner is satisfied that it falls within the scope of this, wider request.[21]Therefore, the withheld information in question is; Two complaint letters; the councillor’s apologies; the initial assessment of the complaints; the councillor’s response to the complaints; five interview notes; the councillor’s response to the draft investigation report; the final investigation report; Email correspondence (in whole and in part), and covering emails regarding the complaints and the hearing.[22]The Council said it had applied section 40(2) of FOIA to refuse to disclose this information and the Commissioner has viewed all the withheld information.[23]The Tribunal carefully considered the Commissioners’ analysis of the application of the exemption and make no apology for setting it out step by step herein in light of the grounds relied upon in the appeal. The Legal Framework: Section 40(2) – Personal information

The Legal Framework:

[24]Under section 40(2) of FOIA, information is exempt from disclosure if it is the personal data of someone other than the requester and a condition under section 40(3A) is satisfied.[25]In this case, the relevant condition is contained in section 40(3A) (a). This applies where disclosing the information to any member of the public would contravene any of the principles relating to the processing of personal data (‘the DP principles’), as set out in Article 5 of the UK General Data Protection Regulation (‘UK GDPR’). General Data Protection Regulation (‘UK GDPR’).[26]First, the Commissioner must determine whether the withheld information can be categorised as ‘personal data’ as defined by the Data Protection Act 2018 (‘the DPA’). If it is not personal information, then section 40(2) of FOIA cannot apply.[27]Section 3(2) of the DPA defines personal data as: - “any information relating to an identified or identifiable living individual”.[28]An identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as their name. Information will relate to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus. The Council said that the withheld information was the personal data of the complainants, and of the councillor about whom they complained.[29]The Commissioner has acknowledged that the councillor is named in the request, and the complaint and hearing were about their alleged conduct. As the withheld information identifies and relates to the councillor, it is clearly their personal data.[30]However, the Council says that it has recently received the councillor’s consent to disclose their personal data in response to this request. It says it has disclosed as much of their personal data as it is able to, without breaching the privacy rights of the third parties who made the complaint.[31]The Council says the councillor’s remaining personal data cannot be disclosed because it is inextricably intertwined with the personal data of the third parties who made the complaint against the councillor; it says that the remaining information is therefore exempt from disclosure under section 40(2) of FOIA.[32]The third parties who made the complaint are not identified in the information the Council has published on its website, but they are repeatedly named in the withheld information, and they are frequently referred to by their position within the Council and their relationship to the councillor. For the same rationale set out in paragraph 35, the Commissioner is satisfied that the withheld information comprises their personal data. However, unlike the councillor, the Council does not have the consent of the third parties to disclose their personal data in response to the request.[33]Although not raised by the Council, the Commissioner notes that the withheld information also includes the names and contact details of Council staff who administered the Council’s handling of the complaint. Clearly, this is also their personal data.[34]The second element of the test is to determine whether disclosing the information would breach any of the DP principles. The most relevant principle is that under Article 5(1)(a) of the UK GDPR.

Would disclosure contravene principle (a):

(a) :

[35]Article 5(1)(a) of the UK GDPR states that: “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.[36]In the case of an FOIA request, personal information is processed when it is disclosed in response to the request. This means that the information can only be disclosed if to do so would be lawful, fair and transparent.[37]In order to be lawful, one of the lawful bases listed in Article 6(1) of the UK GDPR must apply to the processing. It must also be generally lawful.

Lawful processing: Article 6(1)(f) of the UK GDPR:

(f) of the UK GDPR:

[38]Article 6(1) of the UK GDPR sets out the requirements for lawful processing. It says that “processing shall be lawful only if and to the extent that at least one of the” lawful bases for processing listed in the Article applies.[39]The Commissioner considers that the lawful basis most applicable is basis 6(1)(f), which states:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
[40]When he considers the application of Article 6(1)(f) of the UK GDPR in the context of a request for information under FOIA, the Commissioner has to consider the following three-part test: Legitimate interest test: Whether a legitimate interest is being pursued in the request for information; Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; and Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of those who made complaints against the councillor and the Council staff who administered the complaints and subsequent hearing (‘the data subjects’).[41]The Commissioner considers that the test of ‘necessity’ must be met before the balancing test can be applied. If it cannot be met, the processing will be unlawful.

Legitimate interests:

[42]In considering any legitimate interest(s) in disclosing the requested information under FOIA, the Commissioner recognises that such interest(s) can include broad general principles of accountability and transparency for their own sakes, as well as case-specific interests.[43]A wide range of interests may also be legitimate interests. They can be the requester’s own interests, the interests of third parties, commercial interests as well as wider societal benefits. They may be compelling or trivial, but trivial interests may be more easily overridden in the balancing test.[44]The Appellant has an interest in this information which stems from his belief that the complaint against the councillor may have been maliciously motivated, and that the hearing panel may not have followed proper procedures.[45]As regards the Council’s position, it told the Commissioner: - “The Council has identified certain legitimate interests in the release of this information. There is a level of transparency required by the Council due to its public facing nature. There is also a legitimate interest in the conduct of its councillors who are elected on behalf of the public and a higher level of transparency and scrutiny is therefore required.”[46]The Commissioner acknowledges that there is a wider legitimate interest in transparency, regarding the Council’s handling of conduct complaints against elected officers. The Commissioner therefore agrees that disclosure of the information in this case would go some way towards informing the public about the Council’s response to, and handling of, complaints about elected members.[47]Therefore, the Commissioner recognises there is a legitimate interest in disclosure in this case.

Necessity test:

[48]Necessary’ means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity and involves considering alternative measures which may make disclosure of the requested information unnecessary. Disclosure under FOIA, (which is to the world at large) must therefore be the least intrusive means of achieving the legitimate aim in question.[49]The Commissioner accepts that disclosing the withheld information about the complaint and the hearing, insofar as it contains the third-party complainants’ personal data, would be necessary to meet the complainant’s legitimate interest and, to a lesser degree, the more general interest of transparency.[50]However, he can see no equivalent argument that disclosing the names and contact details of non-senior Council staff, whose contact details are not in the public domain in connection with this matter, is necessary to meet the interests of transparency. Their details would add nothing to the public’s understanding of the matter or its handling by the Council, and the information in scope is not diminished by their details being omitted.[51]The Commissioner is therefore satisfied that disclosure of the names and contact details of Council staff is not necessary to meet the legitimate interests identified above. As the Commissioner has decided that their disclosure is not necessary, he has not gone on to conduct the balancing test. As disclosure is not necessary, there is no lawful basis for this processing, and it is unlawful.

Balancing test:

(a) Balancing test:

[52]In view of the above decision, the Commissioner need only consider the balancing test in respect of the third-party complainants’ personal data.[53]In balancing the complainant’s legitimate interests and the data subjects’ rights and freedoms, it is necessary to consider the impact of disclosure. For example, if the data subjects wouldn’t reasonably expect that their personal data would be disclosed to the public under FOIA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override legitimate interests in disclosure.[54]When conducting the balancing test, in the Commissioner’s view, a key issue is whether the data subjects would have a reasonable expectation that their information will not be disclosed. These expectations can be shaped by factors such as an individual’s general expectation of privacy, whether the information relates to an employee in their professional role or to them as individuals, and the purpose for which they provided their personal data.[55]It is also important to consider whether disclosure would be likely to result in unwarranted damage or distress to those individuals.[56]The Commissioner has found in this case that the requested information is the personal data of third parties. Although the information relates to them in their professional capacity, the Commissioner is satisfied that they would reasonably expect that information about them, and the complaints they had submitted (which had been withheld from proactive publication under the LGA), wouldn’t be disclosed to the wider world. As such, disclosing this information under FOIA would be likely to cause them harm or distress. It may also deter them, and others, from making such complaints in future, due to fear of disclosure to the world at large under FOIA.[57]There is some public interest in how public officials behave and carry out their elected roles, and in how the Council deals with complaints against them, which the requested information may shed a little light on. However, a summary of the issues considered by the hearing, and the outcome, have been placed in the public domain; the Commissioner considers the general interest in transparency to be served by this to a considerable degree. Furthermore, the councillor who was the subject of the complaints is free to pursue appeals mechanisms if they consider they were dealt with unfairly or unreasonably by the Council. To the Commissioner’s knowledge, they have not done so.[58]The Commissioner is therefore satisfied that the Appellant’s interest and the general interest in transparency, while legitimate, aren’t sufficient to outweigh the data subjects’ fundamental rights and freedoms in this case.[59]The Commissioner therefore finds that there is no Article 6 basis for processing and so disclosing the third parties’ personal data would not be lawful. Given the above conclusion that disclosure would be unlawful, the Commissioner does not need to go on to consider separately whether disclosure would be fair or transparent.[60]The Commissioner’s decision is therefore that the Council was entitled to withhold the requested information under section 40(2) of FOIA, by way of section 40(3A) (a).

Procedural matters:

[61]The Council exceeded the 20-working daytime for compliance when responding to the request. This is a breach of sections 1 (General right of access) and 10 (Time for compliance) of FOIA.[62]The Commissioner has logged this breach for monitoring purposes.

The Decision Notice:

[63]The Commissioner found: - a) The Council weas entitled to rely on s40(2) (personal data) of FOIA to withhold the information (DN3) b) The Council breached sections 1 & 10 of FOIA by failing to respond within the statutory time for compliance (DN2) and c) The Commissioner required no steps as a result of the decision.

The Grounds of Appeal:

[64]In his grounds of appeal signed and dated 31 January 2024, the Appellant stated as follows; “Establish in hierarchy terms if the request for information relating to decisions by public funded bodies including Local Authorities that places the health, safety, wellbeing and quality of life of UK citizens must be declared supreme and overrides any and all exemptions including those in the FOIA”.

Discussion:

[65]The appeal does not provide any arguments as to why s40(2) should not apply to his request, nor argue that the Commissioner's Decision is wrong in law or that discretion should have been exercised differently.[66]Indeed, the thrust of the appeal appears to be that it doesn't matter whether the requested information is exempt under s40(2) because FOIA should in any case be overridden by Health and Safety Concerns in what he describes as a 'hierarchy of legal obligations' in which Health and Safety legislation should reign supreme; - he says that with no duty of care or statutory obligations to consider the health, safety and wellbeing of UK citizens when undertaking their duties.[67]The Appellant's desired outcome appears to be for the Tribunal to rule that such a hierarchy of legal obligations does, or should, exist. Such a ruling is not within the Tribunal's jurisdiction, and we cannot consider such matters.[68]The requested information is unquestionably the personal information of third parties. The Appellant has failed to provide any evidence or arguable grounds to dispute the evidence and rationale on which the DN has been based. We agree, accept and endorse the Commissioner's carefully reasoned DN.

Conclusion:

[69]The only remaining disputed information in scope of this appeal is the personal data of third parties named in the requested documentation. The Tribunal notes that the Council disclosed relevant information from which Councillor Baxter could be identified, following receipt of his consent to do so on 28/7/23 (see email at OB, p.240).

Whether s.40(2) Applies:

[70]From the Appellant's grounds of appeal and submissions there appears to be no dispute that section 40(2) applies. The tribunal make this ruling, as the remaining disputed information clearly contains the personal data of identifiable individuals.

Legitimate Interests in Disclosure:

[71]The Appellant's identified legitimate interests appear to be that:
"... the decisions by SKDC are placing the life and quality of life of UK citizens at risk which is a criminal offence in violation of safety legislation."
[72]The Council have identified some legitimate interests in disclosure, including: " ..level of transparency required by the Council due to its public facing nature... the conduct of its councillors who are elected on behalf of the public and a higher level of transparency and scrutiny is therefore required." (see OB, p.306).

Legitimate Interests in Withholding:

[73]The Council have identified several legitimate interests in support of withholding the requested information. At OB, para.9, p.306 they say:
" There is the possibility that disclosure could lead to damage to the individuals [sic] reputation and would certainly lead to a level of distress as the information a [sic] was provided with a view of it being confidential to the extent that the individuals would not be identified."
[74]They go on to say at para.10 of the same page:
"...the release of the information is likely to lead to a level of distress and may deter individuals from making complaints against Councillors in future."

Whether disclosure is necessary:

[75]Having considered these factors, we have gone on to consider whether disclosure is necessary for the purposes of the legitimate interests identified. We note in particular that the Council have now disclosed a considerable amount of information regarding the allegations against Councillor Baxter, including the outcome of the investigation. This is described, in part, at OB. P.306, para.5 as follows: "...the decision and minutes of this meeting have been published on our website here - https://moderngov.southkesteven.gov.uk/ieListDocuments.aspx?CId=723&MId=4378&Ver=4.[76]The Tribunal find that the decision that was published is sufficient for people to understand the nature of the complaint against Cllr. Baxter and the outcome of the investigation.[77]It is far from clear how the Appellant has established that disclosure of the disputed information would further the legitimate interest identified by him (i.e. that decisions made by the Council are placing "...the life and quality of life of UK citizens at risk which is a criminal offence in violation of safety legislation." The Tribunal find this does not relate at all to the content of the requested information, which is about a complaint made against a councillor of the Council in relation to his conduct.[78]In light of this and the fact that the Council have placed information into the public domain about the investigation and outcome of the complaint against Councillor Baxter, we find that disclosure is not necessary for the identified legitimate interests.[79]Consequently, the First Data Protection Principle, set out in Article 5(a) of the UK General Data Protection Regulations is not satisfied.

Balance between legitimate interests and rights and freedoms of data subjects:

[80]Having decided that disclosure is not necessary, we do not need to go on and consider the balancing exercise. However, it is clear to us, given the legitimate expectations of the data subjects and the confidential nature of the complaints process, that the balance would be clearly in favour of upholding those rights and freedoms.

Jurisdiction:

[81]As the Commissioner correctly observed and argued at §18 of his Response (see OB, p.192):
“The Commissioner submits that the Appellant’s concerns regarding health and safety matters are separate to FOIA considerations and are not matters which can be determined by a Tribunal in a section 57 FOIA appeal. The Commissioner cannot look into allegations of misconduct.”
[82]In his Notice of Appeal, the Appellant noted at part 7 (Reasons for your appeal) see §64 above: Such an outcome is beyond the jurisdiction of this Tribunal. Our remit is founded in section 58, FOIA and we cannot go beyond that.[83]Accordingly, we are not persuaded there is any error of law in the DN nor in the Commissioners exercise of his discretion therein and we in a collegiate and unanimous decision must dismiss this appeal. Brian Kennedy KC. 14 June 2024. Promulgated on: 18/06/2024.