“1) The minutes of any meetings of the Risk Committee that were held during the 2021/22 financial year. 2) The minutes of any meetings of the Audit Committee that were held during the 2021/22 financial year. 3) The minutes of any meetings of the Board of the company that were held during the 2021/22 financial year.”
“Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.”
“It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.”
“(2) Does the data "relate" to an individual in the sense that it is "about" that individual because of its: (i) "Content" in referring to the identity, characteristics or behaviour of the individual? (ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated? (iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)? (3) Are any of the 8 questions provided by the TGN are applicable? These questions are as follows: (i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller? (ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession? (iii) Is the data 'obviously about' a particular individual? (iv) Is the data 'linked to' an individual so that it provides particular information about that individual? (v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual? (vi) Does the data have any biographical significance in relation to the individual? (vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event? (viii) Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)? Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?”
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”
“Information is exempt information if its disclosure under this Act, would, or would be likely to prejudice the commercial interests of any person (including the public authority holding it)”
“… when assessing competing public interests under FOIA the correct approach is to identify the actual harm or prejudice that the proposed disclosure would (or would be likely to or may) cause and the actual benefits its disclosure would (or would be likely to or may) confer or promote. This … requires an appropriately detailed identification of, proof, explanation and examination of both (a) the harm or prejudice, and (b) benefits that the proposed disclosure of the relevant material in respect of which the exemption is claimed would (or would be likely to or may) cause or promote.”
“1. The Judge asked Mr Lye the five questions that Mrs Cross had raised. Mr Lye’s answers were: 2. Did the Bank consult with the individuals whose job titles are in question regarding the potential disclosure of their job title? Mr Lye: no, we didn’t. The same applied to those no longer employed by the Bank. 3. If so, what was the nature and outcome of this consultation? This question was not applicable. 4. Has the Bank sought consent from these individuals for the release of their job titles in the context of these minutes? Mr Lye answered: no, we have not. 5. On a case-by-case basis, are there any specific circumstances that the Bank is aware of, relating to the individuals holding the job titles at the time of the relevant meetings, that would tip the balance in favour of non-disclosure under the legitimate interests test, such as security or safety considerations? Mr Lye explained that the Bank had not taken it on an individual basis but on a bank-wide position aligned with government departments of not including anyone below Senior Civil Service. So anyone below exec or senior leadership team it had redacted. As an organisation that has grown rapidly, we have many unique roles, with LinkedIn it would be easy to identify these people. In response to a question from the Panel, whether BBB encourages its members of staff to put their information on LinkedIn, Mr Lye stated that the Bank didn’t have a policy, but we do encourage them to share certain information (updates from the Bank, etc.) 6. In the event that any of the individuals is not employed by the Bank, has the Bank consulted with that individual's employer regarding the disclosure of their job title? Are any individuals not employed by the Bank? Mr Lye stated that he did not believe so. Mr Cornwell stated that the personal data in respect of job tiles which was in dispute, was of those employed by the Bank only. Mr Lye clarified that they were employed at the time of the meeting, but may not be now. 7. Mr de Monchy confirmed that the information in paragraphs 17(a) to (c) was not concerned with the COVID-19 schemes operated by the Bank. In paragraph 17(d) there was a sideways connection to the COVID-19 schemes but little relationship. The delivery partners may assist on other schemes as well as the COVID-19 schemes. 8. Mrs Hoyland updated the Tribunal in respect of possible litigation in respect of the redacted passages of the8 April 2021 Board minutes. 9. The Tribunal discussed with Mrs Hoyland who was present at the Board meetings when the discussions in respect of which the Bank seeks to rely on s.42 FOIA took place. In respect of the8 April 2021 meeting, Mrs Hoyland stated that she considered the client to be the Board but also members of the executive. There were also present the minute taker and the chief financial officer and the chief risk officer, who Mrs Hoyland would regard as holding executive positions. They would usually sit throughout board meetings as executive members and Mrs Hoyland would regard them, the executive committee, as the client also. Apart from the executive committee and the board she was not aware of anyone else being present. 10. In respect of the3 March 2022 Board Minutes, apart from the Board and Executive the only one present was the chief impact officer who wasn’t there for that item and she would regard that everyone else as being as board or executive and therefore the client. Mrs Hoyland thought that the chief impact officer would only attend for relevant items. 11. Mr Cornwell then made closed submissions. His submissions on Ground 2 (s.40(2) FOIA) will be repeated in open. On s.42(1) in respect of the litigation limb of LPP, there was clearly a strong anticipation of litigation that easily satisfies the “in contemplation” described in Three Rivers and Starbev. In respect of the advice limb of LPP, the client is the company who acts through the board and executives. There has been no waiver. These are the most senior members of the company. There was a client/lawyer relationship (relevant only for legal advice limb of LPP). The communications recorded in the minute are clearly on the continuum. Both limbs are clearly engaged. Public interest to be spoken to in open. 12. On s.43, a clear explanation from Mr Lye in respect of suppliers to the Bank and in relation to delivery partners there was a clear explanation from Mr de Monchy as to how prejudice would be likely to arise. The Bank is only applying its exemption to granular information that is particularly commercially sensitive. It is plainly important that a commercial organisation can engage in frank discussions, about risk and so on but those kinds of discussions will have a potentially adverse effect. There is a derivative but still important prejudice to BBB’s commercial interests.”
“The BBB is a reasonably small and well-connected organisation, and job titles are employee’s both contained in employee's email signatures and also published on a corporate directory contained on our intranet. Furthermore, many of our employees utilise online networking websites, such as LinkedIn, and post their job titles on these. Given this context, the release of the Role Information would be akin to releasing the names of attendees of the meetings, in that individuals can be identified as having attended the relevant meeting.”