Jenna Corderoy v Information Commissioner & Anor [2024] UKFTT 698 (GRC)

Case Reference: EA/2022/0434[2024] UKFTT 00698 (GRC)
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 6 October 2023 and 8 July 2024Date 29 July 2024
Information Rights
Heard by: CVP Remote Hearing
Amended on 6 August 2024
Before
TRIBUNAL JUDGE JACQUELINE FINDLAYTRIBUNAL MEMBER JO MURPHYTRIBUNAL MEMBER NAOMI MATHEWS
Between
JENNA CORDEROYAppellantINFORMATION COMMISSIONERRespondentTHE COMMISSIONER OF POLICE OF THE METROPOLISRespondentThe Appellant: Jenna Corderoynot represented for Respondent for Second Respondent: Francesca Whitelaw KCWitness for Second Respondent:Scott Didham, Inspector for DPS Misconduct Hearings UnitDecision: The appeal is Allowed in part.Substituted Decision Notice:The Second Respondent has disclosed information in full in response to Ms Corderoy’s Requests 1(a) and 2(a).The Second Respondent has disclosed redacted copies of messages and posts in response to Ms Corderoy’s Requests 1(b) and (c) and 2(b) and (c).The Second Respondent was entitled to withhold the redacted information under s. 40(2), s.30 and s.38 of the Freedom of Information Act 2000 (FOIA).The Second Respondent is not required to take any steps.REASONS
[1]The appeal is brought under s. 57 of the Freedom of Information Act 2000 (FOIA) against the Decision Notice (DN) of the Commissioner dated 22 November 2022 with reference IC-166434-G1H2 which is a matter of public record.[2]The Tribunal conducted a remote hearing by CVP on 6 October 2023 and adjourned part- heard. The Tribunal conducted a remote hearing by CVP on 8 July 2024 and considered all the evidence comprising an agreed Open Bundle and two Closed Bundles containing the unredacted Withheld Material. The Tribunal heard submissions from Ms Whitelaw KC, on behalf of the Second Respondent, and Ms Corderoy and evidence from Inspector Didham.[3]Ms Corderoy lodged a Request on 4 October 2021 in the following terms:
“For the years 2018, 2019, 2020 and available information for 2021, I would like to be provided with the following information: 1) Please indicate the number of police officers that were disciplined for their conduct on WhatsApp and/or other social media sites. (a) For each disciplined police officer, please describe briefly what happened. (b) If the police officer was writing offensive messages/posts, please disclose copies of these messages/posts. (c) If the police officer was sharing offensive posts, please disclose copies of these posts. 2) Please indicate the number of police officers that were dismissed for their conduct on WhatsApp and/or other social media sites. (a) For each dismissed police officer, please describe briefly what happened. (b) If the police officer was writing offensive messages/posts, please disclose copies of these messages/posts. (c) If the police officer was sharing offensive posts, please disclose copies of these posts.”
[4]The Second Respondent responded to the Request and provided partial disclosure of the number of officers disciplined by year and the sanctions imposed and relied on the exemption in s.40(2)(3A)(a) (personal information) to withhold the more detailed information sought (Requests 1(b)-(c) and 2(b)-(c)) because it would identify police officers and/or victims.[5]Following a request for an internal review on 20 January 2022 the Second Respondent made a further partial disclosure.[6]The Second Respondent undertook an internal review on 20 January 2022 and confirmed its position citing the exemptions by virtue of s. 40(2)(3A)(a) (personal information) of FOIA.[7]On 14 April 2022 Ms Corderoy referred the matter to the Commissioner.[8]On 27 September 2022 the Commissioner invited the Second Respondent to revisit his decision and address whether brief decriptions of conduct could be provided, whether the messages had been sifted and to provide detailed submissions concerning the FOIA exemptions upon which the Second Respondent sought to rely.[9]On 11 October 2022 the Second Respondent provided a response via the Commissioner as follows:• The Second Respondent has disclosed parts of a report which relates to police officers disciplined for using social media from 2018 which includes the year, sanction and parts of the allegation summary;• The Second Respondent confirmed that he continued to rely on the s.40(2)(3A)(a) exemption as well as s.30(1)(a)(i);• The Second Respondent set out fully the legal arguments as to why the data Requested is personal data, the disclosure of which would breach Article 5(1)(a) of the UK GDPR such that s.40(2)(3A)(a) is relied upon; set out the specific requirements in relation to disclosing criminal offence data; and addressed the three stage test for lawful processing: legitimate interests, necessity and the balancing test;• The Second Respondent set out the legal requirements of s.30(1)(a) and its application, and addressed the public interest test;• The Second Respondent drew attention to previous relevant IC decisions. The Decision Notice[10]The DN dated 22 November 2022 concluded that the Second Respondent was entitled to rely on the exemption in s.40(2)(3A)(a) (personal information) to withhold copies of WhatsApp/other social media posts involved where police officers were disciplined or dismissed for conduct in relation to such messages, as disclosure would contravene Article 5(1)(a) of the UK GDPR.[11]The Second Respondent relied on the exemption in s.30(1)(a) (investigations and proceedings) but the Commissioner did not find it necessary to consider this exemption as s.40(2) was properly engaged. The Second Respondent contended that s.38 FOIA (health and safety) also applied.[12]The Commissioner concluded:23. The Commissioner considers the individuals have a strong expectation of privacy relating to the information Requested. He has therefore determined that disclosure of the information, which consists of personal data would be unlawful as it would contravene a data protection principle; that is set out under Article 5(1)(a) of the UK General Data Protection Regulation.24. The Commissioner concludes that the MPS is entitled to rely on section 40(2) of FOIA to withhold the information Requested. As the exemption is engaged, the Commissioner is not required to consider the MPS’ reliance on section 30(1)(a) of FOIA.” Legal Framework[13]S.40(2)(3A)(a) provides as follow: 40 Personal information(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles.[14]When the first condition in (3A) is satisfied, s.40 is an absolute exemption in accordance with s.2(3)(fa) FOIA. It is therefore not subject to the public interest test.[15]Personal data is any information relating to an identified or identifiable living individual (s.3(2) Data Protection Act 2018 (DPA)).[16]Article 5 UK GDPR (Principles relating to processing of personal data) provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and transparency).[17]In considering whether disclosure would contravene the above principle the following need to be determined: i. Is the information special category data? ii. Is the information criminal offence data? iii. Is there any Article 6 lawful basis for processing personal data? iv. Does lawful basis (a) consent apply? v. Does lawful basis (f) legitimate interests apply? vi. Would disclosure be lawful generally?[18]Article 9 UK GDPR defines special category data as ‘personal data about an individual’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.’ The most likely special category data to apply to WhatsApp/social medial messages is data concerning race, ethnic origin, politics, sex life or sexual orientation.[19]In order for disclosure of special category data to be lawful, a lawful basis for processing under Article 6 UK GDPR must be identified and a separate condition under Article 9 UK GDPR. Article 9(2)(e) states: ‘processing relates to personal data which are manifestly made public by the data subject’.[20]Criminal Offence Data (Article 10 UK GDPR) - Pursuant to s.11(2) DPA criminal offence data is information relating to:a. The alleged commission of offences by the data subject, orb. Proceedings for an offence committed by the data subject or the disposal of such proceedings including sentencing.[21]Article 10 UK GDPR provides specific safeguards for processing such data which are relevant in this appeal and must be met:a. Consent is provided by the data subject.b. The data in question has been manifestly made public by the data subject.[22]If one of the above conditions is met, then there must also be a lawful basis for processing the information under Article 6 UK GDPR.[23]For disclosure to be lawful it must satisfy one of the six lawful bases in Article 6 UK GDPR. The only appropriate basis in this case is contained in Article 6(1)(f) (which can be used by a public authority in these circumstances due to s.40(8) FOIA). This provides: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.[24]To determine whether Article 6(1)(f) is satisfied, and therefore whether disclosure would be lawful, the following three-stage test applies: i. What is the legitimate interest in the disclosure of the information? (the legitimate interest test). ii. Is disclosure necessary for that purpose? (the necessity test). iii. Does this legitimate interest override the interests, rights and freedoms of the individual? (the balancing test).[25]Article 6(1)(f) states that the disclosure must be “necessary”. The test of whether a disclosure under FOIA is necessary for the purposes of the requestor’s legitimate interests must be satisfied before considering whether the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.[26]The test of necessity requires that disclosure be “more than desirable but less than indispensable or absolute necessity” as set out in Goldsmith International Business School v The Information Commissioner and the Home Office2014 UKUT 0563 (AAC) 2014 at [39] which is summarised as follows: The reasonable necessity test “involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.[27]The High Court in Corporate Officer of the House of Commons v Information Commissioner & Others [2008] EWHC 1084 (Admin) at [43] accepted the common ground in that case that:
““necessary” within schedule 2 para 6 of the DPA “should reflect the meaning attributed to it by the European Court of Human Rights when justifying an interference with a recognised right, namely that there should be a pressing social need and that the interference was both proportionate as to the means and fairly balanced as to ends.”
[28]Only if the disclosure passes the necessity limb of the test should the balancing test be conducted. The balancing of legitimate interests with the interests, rights and freedoms of the data subject requires an assessment on the facts of the specific case. The effect of the DPA, when it is incorporated through s.40 FOIA, is that the personal data of a third party will be protected unless there are strong reasons to disclose it.[29]Even if a disclosure is found to be lawful it must also be fair and transparent. There is no presumption that the openness and transparency of public authorities should take priority over personal privacy. Fairness involves consideration of the reasonable expectation of the data subjects, the possible consequences of disclosure for the data subject(s), and the balance between the rights and freedoms of the data subject(s) and any legitimate interests in the public having access to the information.[30]S.30(1) is a qualified exemption providing circumstances in which information does not have to be disclosed: 30 Investigations and proceedings conducted by public authorities (1) Information held by a public authority is exempt information if it has at any time been held by the authority for the purposes of— (a) any investigation which the public authority has a duty to conduct with a view to it being ascertained— (i) whether a person should be charged with an offence.[31]Provided that the information is held for this investigative purpose, s.30(1) applies even after investigations have been closed and it covers information gathered prior to, during, and after the investigation/decision to charge. ICO Guidance on Investigations and Proceedings explains the application and implication of the s.30(1) exemption: Section 30(1) provides an exemption from the duty to disclose information that a public authority has held at any time for certain investigations or proceedings. As long as the other requirements of the exemption are satisfied, the exemption will apply to information even if it was not originally obtained or generated for one of those purposes and it will continue to protect information even if it is no longer being used for the specified investigation or proceeding. It is only necessary for the information to have been held at some point for those purposes.[32]S.30 also captures investigations where civil sanctions rather than criminal procedures are used.[33]Since s.30 is a qualified right, it is subject to the public interest test within the FOIA. Information can be withheld if the public interest in maintaining the exemption outweighs the public interest in disclosure.[34]In Alan Digby Cameron v the Information Commissioner and Bedfordshire Police and Hertfordshire Police (EA/2008/0023 and 0025) at 14 the Tribunal summarised the relevant factors for a s30(1) public interest assessment: In assessing where the public interest balance lies in a section 30(1) case relevant matters are therefore likely to include(a) the stage a particular investigation or prosecution has reached,(b) whether and to what extent the information is already in the public domain,(c) the significance or sensitivity of the information requested and(d) whether there is any evidence that an investigation or prosecution has not been carried out properly which may be disclosed by the information.[35]S.38 FOIA provides: 38 Health and safety(1) Information is exempt information if its disclosure under this Act would, or would be likely to— (a) endanger the physical or mental health of any individual, or (b) endanger the safety of any individual.(2) The duty to confirm or deny does not arise if, or to the extent that, compliance with s. 1(1)(a) would, or would be likely to, have either of the effects mentioned in subsection (1).[36]This is a qualified exemption, subject to the public interest test. Issues and evidence[37]The issue before the Tribunal is whether the Second Respondent is entitled to withhold the Withheld Material under ss.40(2), 30 and 38 FOIA.[38]Ms Corderoy appealed the DN by Notice of Appeal dated 15 December 2020 and put forward the following points:a. The DN was not in accordance with the law;b. Legitimate public interest favours disclosure of the Requested information;c. The officers concerned have no reasonable expectation that the information would not be released;d. Disclosure is essential for the public to assess whether the punishment handed out by the MPS reflects the behaviour of the officers; ande. It would be difficult to identify the officers in question.[39]The issues between the parties have narrowed as this appeal has developed and disclosures have been made by the Second Respondent.[40]On 25 October 2021 the Second Respondent disclosed the number of police officers disciplined for their conduct on social media including any sanctions issued for the misuse of social media from 2018 to 2021 (Open Bundle (OB) C73 to C76). The Second Respondent withheld information in relation to the details of the specific cases and refused the Request by virtue of s.40(2)(3A)(a) (personal information) FOIA.[41]On 11 October 2022 the Second Respondent disclosed parts of a report which included years, sanctions and parts of the allegation summaries (OB C98 to C102).

(a) (i) (investigations and proceedings)

[42]The appeal came before this Tribunal on 6 October 2023 when the Second Respondent was directed to lodge and serve within 3 months any general privacy notice together with any particular privacy notice served prior to disciplinary meetings or hearings or a statement explaining any similar documentation that is provided prior to disciplinary meetings or hearings and to lodge and serve in a closed bundle the full unredacted copies of the posts relating to the 24 cases.[43]On 1 July 2024 the Second Respondent lodged in relation to parts 1(c) and 2(c) of the Request a Proposed further Disclosure document comprising:a. Posts which may be disclosed with redactions to identifiers.b. Descriptions of posts, which cannot be disclosed.c. Notes stating where items are withheld in their entirety.[44]Ms Corderoy confirmed she wished to pursue the appeal because the disclosure of 1 July 2024 raised further questions.[45]Case Management Directions have been issued pursuant to rule 14(6) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 regarding the Closed Hearing Bundle 2 (the Withheld Material).[46]Ms Corderoy accepted that the information had been disclosed in relation to the Requests relating to the number of police officers that were disciplined or dismissed for their conduct on WhatsApp and/or other social media sites. This is not in issue between the parties.[47]At the hearing Ms Corderoy submitted that having considered all the disclosed information the only remaining issues she wished to raise related to 6 Cases as follows: a) Case 10 (C101) – Withheld: criminal investigation methodology. What exemption is being relied on? b) Case 14 (C101) – Racist and inappropriate memes withheld. Descriptions provided. What exemption is being relied on? c) Case 16 (C101) – Offensive memes withheld. Descriptions provided. What exemption is being relied on? d) Case 17 (C101) – Withheld: criminal investigation methodology. What exemption is being relied on. e) Cases 23 and 24 (C102) – Offensive message about Sarah Everard murder withheld. Description provided. Which exemption relied on? If the Second Respondent relied on any additional exemptions Ms Corderoy would like the opportunity to present further arguments. She would like more clarification. She understands the reliance on the s.42 exemption regarding names and victims but regarding the other redactions she is confused.[48]Ms Whitelaw submitted that extensive disclosure had been provided and the small amount of withheld information was on the basis of good reason and the exemptions relied on had been fully explained.[49]The Commissioner in response to further partial disclosure indicated that he would be content to settle on the basis of the revised disclosure but maintained his position in relation to redacted/withheld material.[50]Ms Whitelaw submitted that extensive manpower time was involved in providing the disclosed information and the Second Respondent could have sought to rely on the s.12 exemption that the cost of compliance exceeds the appropriate limit. However, the Second Respondent had not sought this due to the time over which and the way in which the disclosures had been made.[51]Inspector Didham in evidence explained how complex and time consuming the process had been to obtain the information because of the format in which the information was kept and that the information had to be extracted on a case by case basis. He had looked at the Centurion system and read through all the cases. He then produced a spreadsheet with the results and commentary. He explained that the majority of the cases were heard at misconduct meetings which are private and do not result in notices being published under the Police Conduct Regulations.[52]He explained that it was necessary to examine each folder from the shared folder for misconduct meetings to scrutinise the documents and there were documents embedded within documents. He had to identify the relevant information which had to be redacted. Checks were then required to see if individuals could be identified. This had been a huge task which he had undertaken in addition to his other duties.[53]In closed session Ms Whitelaw took the Tribunal through the six cases in issue and Case 18 which was not put in issue. The Tribunal considered the redacted and unredacted material for each case and a Gist of the closed session was provided to Ms Corderoy. Conclusions[54]On an appeal under section 57 FOIA the task for the Tribunal is to decide whether the DN is in accordance with the law (section 58(1)(a) FOIA). The Tribunal is entitled to review any finding of fact on which the DN was based (section 58(2) FOIA).[55]In reaching its decision the Tribunal took into account all the evidence before it whether or not specifically referred to in this Decision. The Tribunal applied the legislation and case law.[56]Ms Corderoy is a journalist who has been investigating police forces over officers’ inappropriate use of social media.[57]Ms Corderoy submits that s.40(2) does not apply to the messages. She stresses that she has never asked for the officers’ names, ranks and genders and has focussed on obtaining copies of the offensive messages and posts that were written and/or shared.[58]She asked for each disciplined or dismissed police officer a brief description be given regarding their conduct on WhatsApp and other social media sites. She stated she was not asking for a detailed description and was not asking for any names of other identifiers.[59]She submits that her Request satisfies the legitimate interest because she wishes to scrutinise whether officers are receiving fitting punishments for their actions and it is difficult to assess this when the public does not have access to copies of the messages and posts. The term “inappropriate” in relation to comments and images does not convey how bad the officers’ actions were.[60]She submits that the disclosure is necessary to meet the legitimate interest in questions. Disclosure would allow the public to determine whether the punishment is severe enough to reprimand officers and discourage others from posting or sharing offensive messages.[61]She submits that the above interests override the legitimate interests or fundamental rights and freedoms of the data subjects. There is no reasonable expectation for the privacy of officers if they have published offensive messages in the public domain.[62]In relation to the Cases in issue the Tribunal found as follows:a. Case 10 – this case relates to the disciplining of an officer. The reference to ‘would have been dismissed’ means that the officer resigned prior to the misconduct proceedings. The Tribunal found that the redacted material included facial photographs and as such was personal data as defined namely, information relating to an identified or identifiable living individual. The Tribunal found that the Second Respondent was entitled to rely on s.40(2)(3A)(a) exemption and as this is an absolute exemption the public interest test does not apply. Had the Tribunal been required to consider ss. 30 and 38 the Tribunal would have found that the redacted information also included criminal investigation material and s.30 was engaged because the information was held by the Second Respondent for investigatory purposes, namely whether the officers had committed offences through their alleged misuse of social media. The most likely offences would be communications offences, harassment and misconduct in a public office. Also, the Tribunal would have found that s.38 was engaged. Reopening matters which are highly stressful and impactful into the public domain would be likely to endanger the physical or mental health or the safety of the data subjects and/or the mental health of victims, witnesses and relatives. The Tribunal would have found that the public interests in disclosure was outweighed by the significance and importance of maintaining the exemptions under ss. 30 and 38.b. Case 14 – the Tribunal found that the content of the redacted material was so specific and included such unusual detail that it was personal data and was information relating to an identifiable living individual. The Tribunal took account of the submission from the Second Respondent that research indicated that the subject officer or recipient of the memes could not be identified, however, the Tribunal disagreed taking into account the unusual nature of the memes, the subject matter and the dates. The Tribunal found that the Second Respondent was entitled to rely on s.40(2)(3A)(a) exemption and as this is an absolute exemption the public interests test does not apply. In view of the findings it was not necessary for the Tribunal to consider ss. 30 and 38.c. Case 16 – the Tribunal found that the material included photographs of individuals who could be identified and as such s.40(2)(3A)(a) was engaged. In relation to the memes the Tribunal found that s.38 was engaged on the grounds that members of public could be harmed by viewing them and it was not necessary to meet the public interest in understanding the misconduct. The Tribunal accepted Ms Whitelaw’s submission that this case could be distinguished from the Casey review because publication in this case would be to the world at large without context. The Tribunal found that the information could be withheld because the public interest in maintaining the exemption outweighed the public interest in disclosure.d. Case 17 – The Tribunal found that this case involved the inappropriate use of the Second Respondent’s account for private purposes in a criminal investigation so is not relevant to the terms of the Request.e. Case 18 – this case was not put in issue by Ms Corderoy and the Tribunal found that no post was recovered.f. Cases 23 and 24 – the Tribunal found that the posts were the subject of misconduct meetings for two officers who both received Final Written Warnings. The Tribunal found that s.40(2)(3A)(a) was engaged as was personal data, namely, information relating to an identified or identifiable living individual or individuals. The Tribunal found that taken in context the embedded memes were personal data and the Second Respondent was entitled to rely on s.40(2)(3A)(a).[63]In reaching its decision that a person or persons could be identifiable in the Cases in issue the Tribunal has given regard to the ICO guidance: What is identifiability?[64]The Tribunal found that in Cases 10, 14, 16, 23 and 24 individuals could be distinguished from other individuals and were identifiable. The Tribunal found that either names were given or the face was clearly visible. Where individuals could be directly identifiable this constituted personal data.[65]In Cases 23 and 24 the Tribunal found that there was the hypothetical possibility that someone might be able to reconstruct the data in order to identify an individual using readily accessible search engines in order to match the dates, the subject matter and the specific and unusual characteristics of the memes. In this context the tribunal considered the searches that could be made by an interested and sufficiently determined person. Taking into account the nature of the memes the Tribunal did not consider that the likelihood of identification had changed over time and that the information would have been available at the time of the Request.[66]In reaching its decision the Tribunal has attached weight to the ‘mosaic effect’ where requested information can be combined with other information obtained through other means.[67]The Tribunal considered whether disclosure of the personal data under FOIA would be lawful. The Tribunal found that Ms Corderoy had a legitimate interest in this information for the reasons put forward by her. There is public interest in the statutory provision of Police disciplinary proceedings for misconduct and that there should be scrutiny and transparency.[68]The Tribunal found that the disclosure of the personal data in the Withheld Material is not reasonably necessary for the purposes of the identified interests. The Tribunal is not satisfied that knowledge of the identity of individuals involved would significantly further openness and transparency.[69]The Tribunal has balanced these interests against the privacy rights and expectations of the data subjects and finds that the interests in disclosure are overridden by the legitimate interest or fundamental rights and freedoms of the data subject which require protection of personal data.[70]The Tribunal finds that the disclosure of the redacted personal data under FOIA would contravene the data protection principles and the Second Respondent was entitled to withhold it under s. 40(2)(3A)(a) FOIA.[71]The appeal is allowed in part in so far as there was an error of law in the Commissioner’s DN in deciding that all the information not disclosed at the date of the DN was correctly withheld and the Second Respondent was entitled to rely on s.