Reuben Kirkham v The Information Commissioner & Anor [2024] UKFTT 7 (GRC)

FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
[2024] UKFTT 00007(GRC)
(INFORMATION RIGHTS) Appeal Reference: EA/2019/0227
Heard via CVP on 16 November 2023
Before
UPPER TRIBUNAL JUDGE RINTOUL
Between
REUBEN KIRKHAMAppellantTHE INFORMATION COMMISSIONERRespondentALAN DRANSFIELDRespondentin person for Appellant for First Respondent: Mr Kosmin for Second Respondent: in personDECISION AND REASONS Amended pursuant to rule 40 on 23 February 2024Date 2024-02-29

Decision

[1]On the balance of probabilities, the ICO has not complied with section 1 (1)(a) of the Freedom of Information Act 2000 in respect of part (ii) of the request and must within two months of the issue of this decision undertake a fresh search for any minutes or internal correspondence discussing or relating to the taking of the decision to issue the section 50 (2) decision against Mr Dransfield.[2]The recorded information falling within the scope of parts (i) and (iii) of the request to which the ICO has applied section 40(2) is the personal data of a third person and is exempt from release under this exemption. Preliminary matters 4. Abbreviations Decision notice Decision notice FS50802258 dated 6 June 2019 FOIA Freedom of Information Act 2000 GDPR General Data Protection Regulation, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as enacted by the European Union ICO Information Commissioner, the First Respondent in this appeal Chronology 1 August 2018 ICO categorises Mr Dransfield’s request as vexatious pursuant to section 50 (2) of FOIA 22 August 2018 Appellant’s request for information 17 September 2018 ICO responds to request 19 September 2018 Appellant requests internal review 15 October 2018 ICO’s internal review upholds initial decision 14 November 2018 Appellant complains to ICO about its handling of the request 6 June 2019 ICO issues its Decision Notice 27 June 2019 Appeal lodged 26 June 2020 Mr Dransfield consents to information being disclosed 7 July 2020 Mr Dransfield joined as second respondent 29 July 2020 ICO responds to Mr Dransfield’s consent Mode of hearing[1]The proceedings were held via the Cloud Video Platform. The appellant and Mr Kosmin joined via videolink as did the witness, but Mr Dransfield joined by telephone. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way, and no objections were made to that. Although there were at times problems with connections, these were resolved at the time. The hearing was paused at times to allow Mr Dransfield to dial in by telephone.[2]The Tribunal considered the bundle of material and the authorities bundle. It also took into account a transcript of another hearing, produced by Dr Kirkham on the day. It also took into account skeleton arguments from Mr Kosmin and Dr Kirkham; Mr Dransfield did not provide a skeleton argument.

Introduction

[3]The appellant challenges a decision of the First Respondent made on 6 June 2019 to refuse (Decision FS50802258) a request for information in respect of the Second Respondent. That request was in three parts, the Appellant seeking:(i) the email correspondence between Mr Dransfield and the Commissioner concerning the effective ban imposed on Mr Dransfield (including any warnings that were made);(ii) any minutes or internal correspondence discussing the basis for implementing this decision; and(iii) the contents of s.50 complaints that were rejected under section 50(2)(c).

Preliminary matters

[4]The ICO’s case is, in summary that it does not hold the information sought at (ii) and that the exemption set out in s 40 (2) of FOIA applies to (i) and (iii). It is now also the ICO’s case that the appeal is academic in respect of (i) and (iii) as Mr Dransfield has now given his express consent and disclosure has taken place.[5]A notice of appeal with grounds attached was served on 27 June 2019, with the ICO replying on 14 August 2019. Dr Kirkham submitted a response to that on 17 August 2019.[6]Mr Dransfield (the Second Respondent) was joined to the proceedings on 7 July 2020.[7]There has been a number of case management directions and challenges to those, and on 14 July 2021, a Case Management Hearing was held at which a preliminary issue was identified.

Procedural History

[8]There have been numerous requests for directions made and directions subsequently made, some of which have been challenged by reference to rule 4 (3). These are set out in section B of the consolidated bundle. The panel sees no purpose in listing all of these, but records that no less than 13 sets of directions have been issued. It is, however, necessary to set out the details of the preliminary issue raised. The preliminary issue[9]In a ruling issued on 16 July 2021, the Tribunal identified a preliminary issue which ought to be determined.[10]In a decision issued on 28 February 2022, the Tribunal answered the questions put as follows:(1) When considering an exemption under section 40(2) of FOIA, is the Tribunal bound to make the assessment of the public interest at the point the decision was made? That is, is the reasoning in APPGER v ICO & FCO [2015] UKUT 377 (AAC) and Maurizi v The Information Commissioner and The Crown Prosecution Service [2019] UKUT 262 (AAC) applicable? A: The Tribunal is bound by the reasoning in APPGER and Maurizi to make the assessment of the public interest at the date of decision. (2) If so, are there any exceptions to the general rule which may apply on the facts of this appeal? A: There are no applicable exceptions, save that the issue of when consent was given will be in issue as will the issue of whether the processing of Mr Dransfield’s data by disclosure is contrary to the GDPR.(3) If not, what is the appropriate point for the consideration of the public interest? A: Not applicable.[11]Permission to appeal this decision was refused by the First-tier Tribunal, and the renewed application for permission was struck out by the Upper Tribunal for the reasons given its decision of 13 December 2022.[12]Subsequent to that, both Dr Kirkham and Mr Dransfield made applications for directions to be issued in respect of disclosure and for witnesses to be summonsed to attend the hearing. Those applications were refused by means of directions from Judge Griffin on 29 June 2023 and 18 July 2023. Those directions were challenged and for the reasons given the decision and directions issued by Judge Rintoul on 13 September 2023, the applications to summon witnesses were refused and the ICO was given time to respond to the application for disclosure which he did. For the reasons set out in a further order on 27 October 2023, issued by Judge Rintoul, the request for disclosure was refused. The Request[13]Given the manner in which the appeal progressed before us, we consider it necessary to set out the request in full. I write to make a Freedom of Information Act (2000) request concerning Alan Dransfield's blog post, where he states he has been banned entirely from using the s.50 complaint procedure. His blog post is here: http://blog.olliesemporium.co.uk/#post672 It simply reduces what is said to be (I do not know if he has edited the email) an email from the ICO with the title "What you get if you ask the ICO about Grenfell Tower". The email itself says:
"Subject: Complaint to ICO re: Royal Borough of Kensington and Chelsea[Ref. FS50772688] 15th August 2018 Case Reference Number FS50772688 Dear Mr Dransfield I am writing with regard to your email of 1 August 2018 in which you explain that you wish bring a complaint to the Information Commissioner’s Office (ICO) about the Royal Borough of Kensington and Chelsea’s handling of a freedom of information request. As you will re-call, we wrote to you earlier this year on 15 March 2018 and explained that we were not prepared to accept any further complaints from you under section 50 of the Freedom of Information Act (FOIA). A copy of our letter is attached. We do not consider the circumstances to have changed since that letter was issued. Therefore, we consider your application to the ICO in relation to the Royal Borough of Kensington and Chelsea’s handling of this request to also be frivolous and/or vexatious for the purposes of section 50(2)(c) of FOIA. We will therefore not be accepting this complaint. Yours sincerely The Information Commissioner’s Office"
If true, this would be a blanket ban on accessing the Commissioner and the Tribunal system. I therefore ask for (i) the email correspondence between Mr Dransfield and the Commissioner concerning the effective ban imposed on Mr Dransfield (including any warnings that were made) (ii) any minutes or internal correspondence discussing the basis for implementing this decision and (iii) the contents of s.50 complaints that were rejected under s.50(2)(c). The reason I ask is that I am genuinely interested in how the ICO would reach such a decision, given the extreme implications of it. Given the voluminous material that Mr Dransfield publishes on social media, and the fact that he is well known as the complainant in the lead case in the Upper Tribunal concerning vexatiousness, it is highly doubtful that s.40 would apply to any of the information requested. If I can be of assistance with this request, please let me know. Otherwise, I look forward to receiving the information in question. Best wishes, Reuben” The Initial Refusal and Review[14]In summary, the decision explains that the information held within issues (i) and (iii) has been withheld pursuant to section 40 (2) of FOIA as disclosure would breach one of the data protection principles, the information being the personal data of the person who has raised complaints, and believed that he would have done so, and corresponded with the ICO in the expectation of confidence and would not expect the information to be disclosed in response to a request under FOIA. It was also said that there was no strong legitimate interest that would override the prejudice to the rights and freedoms of the data subject. The ICO also stated that that no information is held in respect of part (ii).[15]Dr Kirkham replied to that decision on 19 September, stating that he did not believe Mr Dransfield had any expectation that his complaints to the commissioner would be confidential. It is also said: It is said that there is no "any minutes or internal correspondence discussing the basis for implementing this decision". I am afraid I am not convinced by that: Mr Dransfield has been prolific, to say the least, and this is an unprecedented step taken by the Commissioner. It would be surprising if there was not extensive discussion, including in respect of the lawfulness (or not) of such a ban. Accordingly, I would like to understand what searches the ICO performed in order to identify this documentation. The Decision Notice[16]In the Decision Notice, at [14], the ICO states: The complainant considers that the ICO holds information falling within the scope of part (ii) of his request, which was for “any minutes or internal correspondence discussing the basis for implementing this decision”[17]It is then stated that in order to answer this part of his request the ICO performed searches of its case management system (“CMEH”) and reviewed all the documents and records held on the cases raised by Mr Dransfield that were subject to its application of section 50 (2)(c) in this instance. It also had consultations with the author of the section 50 (2) letter, the case officer and others who may have been involved with the handling of the cases; and, that these people were requested to conduct searches for any material not held on CMEH such as email accounts and Sharepoint. It is also recorded that this did not locate any information falling within the scope of the request [16], and the further searches carried out by the reviewer Mr G Tracey, did not locate any such information.[18]With respect to the information held in parts (i) and (iii), at [25] and [26] it is stated that the information withheld relates to correspondence between the ICO and Mr Dransfield; internal correspondence; and, correspondence between Mr Dransfield, the ICO and the FtT (part (i)) and correspondence between Mr Dransfield, other public authorities and the ICO associated with FOI complaints that he submitted to the ICO under section 50 of the FOIA (part (iii)).[19]The ICO sets out that this is personal data which would be processed by disclosure in response to a request which would not be lawful processing as although a legitimate interest is being pursued [36] to [38], disclosure is not necessary as the explanation provided is sufficient to meet the legitimate interest [41] and that the disclosure of actual correspondence would add nothing of value [42] and would be intrusive into Mr Dransfield’s private life. Balancing the legitimate interests and the data subject’s interests or fundamental rights or freedoms [45] to [57], the ICO concluded that there was insufficient legitimate interest to outweigh Mr Dransfield’s fundamental rights and freedoms. On that basis, the processing by disclosure would not be lawful processing within article 6 (1)(f) of the GDPR; and, on that basis, disclosure would breach one of the data principles. For that reason, the condition set out in section 40 (3A) (a) was met and so the ICO was entitled to withhold the information under section 40 (2) of FOIA. Grounds of Appeal[20]The ground of appeal served by Dr Kirkham are six in number:(1) The ICO did not satisfy section 1 of FOIA, in that the searches carried out were insufficient in that it has not been explained how systems were searched;(2) Mr Dransfield had evidently consented to the disclosure of the information, given his publicly expressed beliefs, and that if that position was not clear, the ICO could have asked him for consent, and had not done so for improper reasons;(3) Mr Dransfield cannot expect his correspondence to be confidential;(4) Mr Dransfield cannot control what information is disclosed on how the commissioner operates, given it is a matter of public record that he is subject to a ban on using the section 50 procedure;(5) The ICO’s summary of information was not accurate, was in fact misleading, and it has not struck the balance correctly; and(6) As Dr Kirkham is a bona fide academic, his request to examine the documentation engages articles 85 and 89 of the GDPR. The ICO’s Response[21]Having set out the background and the law at length, the ICO then goes on to address the grounds of appeal in turn.[22]Ground 1: Relying on Bromley v IC and Environment Agency EA/2006/0072 (31 August 2007), [2011] 1. Info LR 1273 it is submitted that the scope, quality and thoroughness of the searches entitled the ICO to conclude that there was no information falling within part (ii).[23]It is further submitted that Dr Kirkham’s proposition that the search must be designed to obtain all the information is correct, and that the means by which the searches were conducted were set out in the Decision notice. It is averred that there was more than sufficient information on the depth and thoroughness of the search for information to entitle the Commissioner to conclude on the balance of probabilities that there was no information held.[24]Ground 2: It is submitted that any consent to disclosure must be specific, informed and freely given prior to disclosure; and, at the time of the decision, that had not been given; the material relied upon by Dr Kirkham was insufficient. There is no duty imposed on data controllers to seek consent for disclosure. Although Mr Dransfield had consented on 27 June 2019, the relevant date for assessment of whether there had been consent is the date of the decision notice.[25]Ground 3: It cannot be argued that requesters to a public authority under FOIA forgo confidentiality. And, as stated in response to ground 2, consent had not been given to disclosure.[26]Ground 4: It is denied that Dr Kirkham has been prevented from receiving information simply because Mr Dransfield is named, it being evident from the request that this was what he required.[27]Ground 5: It is submitted that the information was accurately summarised, and the balancing exercise was carried out correctly.[28]Ground 6: It is submitted that Dr Kirkham’s argument that he should receive the information as a journalist is misguided as the nature of disclosure under FOIA to the world is such that even were he a data processor under GDPR, that would not change the quality of the disclosure. Nor could it be argued that freedom of expression pursuant to article 10 requires disclosure or that article 85 or 89 of the GDPR apply. Dr Kirkham’s Further Submissions[29]Dr Kirkham submitted in respect of ground 1 that the ICO has not provided sufficient information of the computer searches undertaken, in particular not specifying the search words used. He also cast doubt on whether Mr Sowerbutts had taken the decision to invoke section 50 (2)(c) against Mr Dransfield in the manner claimed. He further submitted [12] that the ICO’s position that the post-Decision Notice consent was not relevant is not based on any authority.[30]In respect of ground 3 to 6, Dr Kirkham seeks to refute the ICO’s points, submitting that his case has been misrepresented [18], and that Mr Dransfield is not acting as a private citizen. It is argued also that in its response to ground 4, the ICO is taking an irrational position. Issue is also taken with the balancing exercise, it being argued that Mr Dransfield himself should be “on the scales” rather than an imaginary doppelganger [24]. It is also argued that articles 85 and 88 9 Amended pursuant to rule 40 on 23 February 2024 of GDPR do apply. Mr Dransfield’s Submissions[31]In a letter dated 26 June 2020, Mr Dransfield requested to be joined as a party. He states [2] that the ICO’s claim in the Decision Notice that they are protecting his interests was done without his consent, and the claims are wrong; and, [3] that the ICO has acted against his interests in denial of his constitutional rights. He also states [5] that the information Dr Kirkham has requested should be disclosed in full which would in effect make the information public. The Hearing on 16 November 2023 Preliminary Issues[32]Mr Dransfield renewed his application, made in correspondence, that Judge Rintoul should recuse himself. The applications made for witness summonses, refused in writing by Judge Rintoul were renewed, and Dr Kirkham sought permission to adduce the transcript of a hearing. Recusal[33]The applicable test, as established in Porter v Magill [2001] UKLH 67 is whether a fair-minded and informed observer, having considered the facts, would conclude that there was a real possibility that the judge would be biased. This hypothetical observer is taken to know that judges take an oath to administer justice without fear or favour, but also to know that the taking of the oath, by itself, is not sufficient guarantee to exclude all legitimate doubt.[34]Mr Dransfield’s complaints are summarised in his email of 30 October 2023 where he wrote:
“Judge Rintouls should recuse himself from my FOIA Cases. Let's not beat about the bush here, the Dransfield Vexatious Court Precedent was designed by crooks to protect crooks and I now wish to add Judge Rintould to the BAND OF Crooks I.E. Judge Wikeley, Court of Appeal,Supreme Court. It's fairly obvious to me Judge Rinoul does not recognise FRAUD UNRAVELS ALL BY LORD DENNING1956 and more recently by the Supreme Court.”
[35]These allegations do not, on any rational view, indicate even arguably any appearance of bias, nor do the further allegations made that Judge Rintoul expressed irritation in previous hearings, in which he admonished Mr Dransfield for making unsubstantiated and serious allegations of fraud against counsel for the ICO and his chambers, the ICO’s lawyers, and others. Witness Summonses[36]We reject the submission that Judge Rintoul acted ultra vires in rejecting these applications while sitting alone. We remain of the view that, even though the appeal was to an extent part-heard owing to the determination of the preliminary issue, the procedural rules permit a judge sitting alone to determine such interlocutory matters. Further, and in any event, the panel adopted the same reasoning as Judge Rintoul in his decision of 13 September 2023, a copy of which is attached. Additional Evidence[37]We were persuaded it was in the interests of justice that relevant parts of the transcript of a hearing in EA/2018/00036 held on 5 March 2019 could be admitted, so long as the relevant parts could be identified. As it turned out, the transcriptwas of little relevance. Substantive Hearing[38]We heard evidence from Mr Tracey called by the ICO. We also heard evidence from Mr Dransfield, and submission from Mr Kosmin, Dr Kirkham and Mr Dransfield. The Law[39]As far as is relevant, FOIA provides:
“(1) Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him. … (4) The information— (a) in respect of which the applicant is to be informed under subsection (1)(a), or (b) which is to be communicated under subsection (1)(b), is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request…” (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (a) in respect of which the applicant is to be informed under subsection (1)(a), or (b) which is to be communicated under subsection (1)(b), is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request…”
[40]Section 2 of FOIA provides, so far as is relevant: 2.— Effect of the exemptions in Part II. … (2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.[41]As at the date of the ICO’s decision, section 40 of FOIA provided, so far as is relevant: 40.— Personal information.(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing). (4A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section. … (7) In this section— "the data protection principles" means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; "data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); "the GDPR" "personal data" and "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) (10) and (14) of that Act); (8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.[42]Although section 40 has been amended with effect from 31 December 2020 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019/419, we do not consider that this was material. The effect of the amendments was primarily to reflect that the GDPR is now the “UK GDPR” but without changing the underlying substance.[43]Sections 50, 57 and 58 of FOIA provide, so far as is relevant to the consideration of this appeal: 50.— Application for decision by Commissioner.(1) Any person (in this section referred to as “the complainant” ) may apply to the Commissioner for a decision whether, in any specified respect, a request for information made by the complainant to a public authority has been dealt with in accordance with the requirements of Part I.(2) On receiving an application under this section, the Commissioner shall make a decision unless it appears to him— (a) that the complainant has not exhausted any complaints procedure which is provided by the public authority in conformity with the code of practice under section 45, (b) that there has been undue delay in making the application, (c) that the application is frivolous or vexatious, or (d) that the application has been withdrawn or abandoned. … (4) Where the Commissioner decides that a public authority— (a) has failed to communicate information, or to provide confirmation or denial, in a case where it is required to do so by section 1(1), or (b) has failed to comply with any of the requirements of sections 11 and 17, the decision notice must specify the steps which must be taken by the authority for complying with that requirement and the period within which they must be taken. … (7) This section has effect subject to section 53. 57.— Appeal against notice served under Part IV. (1) Where a decision notice has been served, the complainant or the public authority may appeal to the Tribunal against the notice. (2) A public authority on which an information notice or an enforcement notice has been served by the Commissioner may appeal to the Tribunal against the notice.(3) In relation to a decision notice or enforcement notice which relates— (a) to information to which section 66 applies, and (b) to a matter which by virtue of subsection (3) or(4) of that section falls to be determined by the responsible authority instead of the appropriate records authority, subsections (1) and (2) shall have effect as if the reference to the public authority were a reference to the public authority or the responsible authority. 58.— Determination of appeals. (1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

Discussion

[44]We have separated our consideration of this appeal into two parts: the first, considering parts (i) and (iii) of the request; the second, concerned with part (ii) as these raise discrete issues.

(i) and (iii)

[45]We consider that the information covered by parts (i) and (iii) can be considered together, as the parties have done.[46]The ICO’s case is that the information requested is exempt from disclosure as it is the personal data of a third party, that is, Mr Dransfield. He says that to disclose it would be unlawful because of the operation of Article 6 (1)(f) of the GDPR (see [19] above). Dr Kirkham submits that is not a correct interpretation of the law, and that in any event, Mr Dransfield has consented to disclosure both by means of an email dated 20 March 2015 (page G356), as well as consenting to disclosure expressly after the decision notice which, he submitted, is a matter to be taken into account in the appeal.[47]In response, the ICO submitted that the email of 20 March 2015 does not amount to consent, and that consent post Decision Notice is not a matter to be taken into account.[48]Mr Dransfield maintained in his oral evidence that he had consented but did not specify on which date he had done so.[49]As stated in our decision on the preliminary issue, we remind ourselves that the FtT is a creation of statute; its powers are limited. We are satisfied that, on the basis of the reasoning in Evans and in APPGER the FtT is confined when considering whether an exemption applies, to a consideration of the factual matrix which existed at the time of that decision. As it is, however, conducting an appeal, it can take into account material not before the public authority (as can the ICO) which may show that the findings of fact were wrong, or the law was wrongly applied. The additional material may show that the public authority was wrong, albeit with the benefit of hindsight, but what it is not permitted to do is consider a different factual matrix as at the date of the hearing.[50]Accordingly, and applying that reasoning, we find that if Mr Dransfield consented to disclosure only after the date of the Decision Notice, that would be considering a different factual matrix, and not something we can lawfully do. We are therefore concerned only with whether Mr Dransfield consented to disclosure prior to 6 June 2019.[51]In considering that issue, we remind ourselves of what is required for consent under the GDPR. Article 6 (1) provides that processing of information (in this case disclosure under FOIA) is lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. That consent must be freely given, specific, informed and unambiguous – see article 4(11) GDPR.[52]The email of 20 March 2015 says this: ICO Dear Sirs Under protection of the FOIA 2000 please provide me with a PDF copy of the Metadata and in particular a copy of all internal and external emails containing my name between 2005 and Feb 2015. This should not be confused with a DPA 98 request as I am not seeking data about myself. With thanks Yours sincerely Alan M Dransfield[53]We do not consider that this could be seen as unambiguous or specific, bearing in mind that it is argued that this would have to be consent to the material being made available to all, as is the effect of disclosure under FOIA.[54]Dr Kirkham also submits that Mr Dransfield’s consent has been given by his public statements, as averred in the grounds of appeal. Again, we do not consider that such actions could rationally meet the test of informed consent under the GDPR.[55]In reaching that conclusion, we have taken into account Mr Dransfield’s oral evidence that he understood what data should be protected and what should not, an issue on which he was examined at length in the hearing. We accept that Mr Dransfield does not suggest that all data, such as information relating to health, should be disclosed, but we find no sufficient basis from his evidence to conclude that he had given consent by his actions in disclosing material and information on his blogs, nor do we, viewing the evidence as a whole, come to that conclusion given the strictures that apply for valid consent to have been given under GDPR.[56]While Mr Dransfield’s oral evidence was that he had given consent, and that was not challenged in cross-examination, a simple bare statement that he had given consent but without specifying when, or how, is not sufficient to demonstrate that he had given consent sufficient to meet the requirements of the GDPR.[57]Stepping back from the particulars of this appeal, the suggestion that consent could be implied, would be fundamentally to undermine the structure of the GDPR and the protections it provides.[58]We turn next to article 6 (1)(f) of the GDPR.[59]We accept that in considering whether article 6 (1)(f) applies, there is a three-part test:(1) Is a legitimate interest being pursued?(2) Is disclosure necessary to meet the legitimate interest?(3) Do these interests override the legitimate interests of fundamental rights and freedoms of the data subject?[60]It is accepted that a legitimate interest is being pursued. We agree that there is a wider interest in the decision taken to make an order against Mr Dransfield pursuant to section 50 (2) of FOIA.[61]We do not, however, accept that disclosure of personal data is necessary in this case, given that it is unclear why disclosure of the actual correspondence would add value to the explanation given. It would not, necessarily shed light on how the decision was reached.[62]Further, we are not satisfied that the balancing test was improperly carried out, nor, having had regard to all the relevant material in existence at the time, would we have reached a different conclusion.[63]The starting point is that data is not to be processed unless it comes within an exemption. We also bear in mind the fundamental principle of consent under GDPR, and also that data must be processed fairly (see article 5(1) GDPR)[64]In that context, we have regard to the balancing exercise to be carried out. We note that Dr Kirkham submitted in his grounds, that Mr Dransfield did not have a reasonable expectation that correspondence between him and the ICO would be confidential. That it may end up on a court file is not making it a public record. If, however, he had provided the information himself, publicly, then it would cease to be confidential. But that is not the test under the GDPR.[65]The effect of the restrictions placed on data processing by the GDPR, and the concomitant focus on consent, fairness and transparency, is to create a reasonable expectation in an individual that his or her data will not be processed by disclosure. It is reasonable to expect that had his personal data been disclosed at Dr Kirkham’s request, that Mr Dransfield would have objected, strongly. We consider also that disclosure would not have been fair and would have offended against the principle of transparency.[66]What, in effect, Dr Kirkham argues, is that there are some people who, through their actions, fall to be treated less favourably. That would, necessarily, involve introducing a significant, unwarranted and subjective evaluation of data subjects which would neither be practical nor consistent with the approach of the GDPR.[67]In this case, we have not been pointed to any sufficient evidence that the information withheld was already in the public domain, nor that it was known to some individuals, nor has the appellant effectively rebutted what the ICO said in paragraph [49] of the Decision Notice.[68]It is less easy to speculate about how Mr Dransfield would have reacted to disclosure, given that, for the reasons given above, he had not provided valid consent to it at the relevant time.[69]We are not persuaded by the evidence provided either by Dr Kirkham or Mr Dransfield that he would not have objected.[70]We consider, finally, in this part, ground 6 which was not fully argued before us. We are not satisfied that, despite Dr Kirkham’s submissions, the GDPR has materially affected the position that disclosure under FOIA is disclosure to the world at large. Nor are we satisfied that article 85 assists him, given that it only requires a state to ensure that legislation is enacted which meets the requirements of that article, and he has not shown that the law which was enacted to do so - paragraph 26 of Schedule 1 to the Data Protection Act 2018 – does not achieve that effect. Further, we accept the ICO’s argument that in this case the nature of the disclosure, that is, unrestricted disclosure, would fall within scope. Nor do we accept that article 89 of the GDPR applies.[71]While we note Dr Kirkham has prayed in aid article 10 of the European Convention on Human Rights and relies also on Magyar Helsinki Bizottság v Hungary [2016 ECHR 975, we do not find that this assists him. As the Grand Chamber wrote at [188] to [200], any right to information in the sense protected by article 10 can be interfered with, so long as it is justified by reference to whether it is lawful, whether it has a legitimate aim and whether it is necessary in a democratic society. That is not materially different from the analysis mandated by article 6 (1)(f).[72]Further, article 89 does not assist Dr Kirkham as it cannot properly be said that disclosure in this context falls within the ambit of this article.[73]Taking all of these factors into account, we find that the withholding of the evidence would have been, at the time of the decision notice, lawful.[74]On that basis, we find that the exemption in section 40 (3A) (a) of FOIA is made out.[75]Further, and in any event, as the relevant material has now been disclosed, we are satisfied that this issue is academic, despite the submissions made to the contrary. Part (ii).[76]Mr Tracey’s evidence was confined to this issue. Mr Tracey adopted his witness statement and was cross-examined. He said he was unaware of ICO staff socialising, or that Mr Dransfield was a “hot topic”. He had not had involvement with anything to do with Mr Dransfield prior to the review he was asked to undertake. He explained that his role was not involved with setting policy; his role is to advise senior case-officers on complex and high-profile section 50 FOI cases, and he is the ICO lead on national security related FOI cases.[77]It was his evidence that he had spoken to Mr Ian Goddard who had dealt with the original request and Mr Goddard informed him that he had spoken to Mr Adam Sowerbutts (who had issued the notice in respect of Mr Dransfield), and others. They each conducted searches of their emails and personal drives to check for any recorded information within the scope of the request.[78]He also had a face-to-face meeting to discuss the matter with Mr Sowerbutts to establish whether any recorded information may have been overlooked but he confirmed that searches had failed to identify any information falling within the scope of part (ii) of the request.[79]Mr Tracey also said that Mr Sowerbutts also confirmed that as the decision to issue the notice in respect of Mr Dransfield was a straightforward one for a Head of Department, he had not found it necessary to hold any meetings with anybody to seek approval and as a consequence it was not surprising that there was no recorded information relating to that aspect of the request.[80]Mr Tracey also confirmed that the group manager confirmed to him that having already searched his emails and personal drive, he had repeated the exercise and had again not identified any relevant information.[81]Mr Tracey concluded that, given the way in which the ICO recorded and stored its case-related information and the measures taken both at the initial request stage and further by myself at the internal review stage I was of the opinion that the ICO did not hold any information falling within the scope of this part of the request.[82]Much of the cross-examination was directed to showing that Mr Tracey’s evidence was unreliable and/or that he was naïve in the manner in which he had conducted his review and had not properly probed what he had been told.[83]We found Mr Tracey’s evidence to be guarded to an unusual degree; and, frankly, limited to the extent that it bordered on the evasive. For example, when asked if ICO staff socialised together, he said he believed so. He was content to accept what he was told at face value, and we found it somewhat surprising that he had never on any occasion when asked to conduct a review thought he had not been given the full picture. He said that he had undertaken the task, relying on the honesty of those to whom he had spoken, as he always does, absent any reason to believe that someone is dishonest or lying. There was also a distinct lack of any probing carried out when carrying out the review, and it was only in re-examination that we obtained the full picture of what had been done.[84]While Mr Tracey may well be over trusting, that does not mean that we should not take his testimony at face value.[85]In determining whether or not information is held, as stated in Preston V ICO & Chief Constable of West Yorkshire Police [2022] UKUT 344, we apply the normal civil standard of proof - the balance of probabilities, as further explained in Bromley v IC and Environment Agency.[86]As Dr Kirkham accepted, much of what he had had to say about search terms and methods used was of little relevance given how the ICO had interpreted the request, and then conducted a page-by-page analysis of five files. Accordingly, the transcript of the previous hearing which we had given permission to adduce is of little relevance.[87]Dr Kirkham submitted that the ICO had unreasonably taken an overly narrow view of the scope of his request and had taken it out of context. He submitted that, properly understood, given how the request was framed, he wanted information about the decision-making process which led to the decision to make the section 50 (2) notice against Mr Dransfield, not just implementation of that decision information. Amended pursuant to rule 40[88]Mr Kosmin submitted that the ICO had applied a proper construction of the request, and that it was, in effect, narrow in scope, and was properly confined to just the five cases referred to in the request, given how it was framed by reference to the implementation of the decision.[89]Under section 1(1) FOIA there is no definition of a valid or effective request as such. The only provision is that any person making a request, in writing, for information to a public authority is entitled to be informed by the public authority whether it holds information of the description specified in the request. Section 1(3) of FOIA provides a mechanism whereby the authority can seek to clarify the request and if this further information is not supplied then the authority is not obliged to comply with the request. That mechanism was not invoked here.[90]In Department for Culture, Media and Sport v IC (Freedom of Information Act 2000) [2010] UKFTT EA_2009_0038 the FtT held at [16]: In general the scope of a Freedom of Information Act request (which is what gives rise to and defines the obligations of a public authority under section 1(1) of the Act) must be determined by an objective reading of the request itself in the light of any relevant background facts. In this case the parties expressly agreed the scope of the request (see paragraph 9 above; only (b) of the agreement is relevant for the purposes of the appeal but it must obviously be read with (a)) and the Tribunal’s task is to interpret the words of that agreement against the relevant background set out above.[91]There was, in this case, no agreement, but the relevant background facts are set out in the heading of the request.[92]We find that the ICO has taken an overly forensic, legalistic and narrow interpretation of the request, given that it is clear from the context and full wording of the request that what is sought is information about the decision taken and how it was reached. A narrower interpretation, that the request relates only to how the decision was put into force in five cases, requires “implementation” – the word used in the request – to be construed as meaning only what flowed from the decision, rather than it referring to how the decision was taken. We consider that is not a reasonable interpretation, given the context, and as the phrase used is “basis [emphasis added] for implementing this decision” which strongly militates in favour of a wider interpretation, that is meaning how the decision was taken and that, properly understood, the request extended to documentation relating to how the decision was taken, and any correspondence.[93]We note Mr Tracey’s evidence of what he had been told by Mr Goddard Sowerbutts Amended pursuant to rule 40 on 23 February 2024 (see his witness statement at [8]) that: [Mr Goddard Sowerbutts Amended pursuant to rule 40 on 23 February 2024 ] also confirmed to me in our meeting that as the decision was a straightforward one for a Head of Department, he had not found it necessary to hold any meetings with anybody to seek approval and as a consequence it was not surprising that there was no recorded information relating to that aspect of the request.[94]That is hearsay, and while the civil rules of evidence do not apply, we consider that less weight can be attached to that as evidence. We also note that this is carefully crafted to avoid whether emails were exchanged, or whether there were telephone calls, or simple conversations which might have been minuted.[95]We note also that this is not entirely consistent with the emails from Richard Bailey and Adam Sowerbutts of 16 March 2018 which were copied to a significant number of people, passing on Mr Dransfield’s response to the letter of 15 March 2018. This, we find, is surprising if there had been no prior communication. We also bear in mind that, as Dr Kirkham submitted, the letter to Mr Dransfield of 15 March 2018 was novel and not something done previously and involved an individual well-known in FOIA circles.[96]We find the submission that the decision was made without any prior consultation to stretch credibility well beyond breaking point. Whether or not Mr Tracey believed Mr Sowerbutts Goddard’s account is of little relevance. Viewing the evidence as a whole, and in context, we consider that there may well be additional information relating to how the section 50 (2) decision was made against Mr Dransfield. Thus, it cannot be said that the scope of the request as interpreted by the ICO is immaterial.[97]Having reached the conclusion that the narrow way in which the ICO interpreted the request is unlawful, it is unnecessary for us to consider whether Dr Kirkham has shown that it has withheld information. Without a proper consideration of the scope of the request, the decision is unlawful and must be carried out again, using a wider scope.[98]Mr Tracey’s evidence as to how the review was conducted is, in consequence, of limited relevance as he did not question the scope of the request.

Conclusion

[99]For these reasons, we allow the appeal in part as we are not satisfied that the ICO interpreted the scope of the request correctly. We therefore find it necessary to make a substitute decision notice.

Additional Matters

[100]Mr Dransfield has in his submissions on this issue, both in writing and oral, and in the documents adduced, sought to raise issues about corruption and unlawfulness on the part of the ICO, the former president of the GRC, and others involved in the hearing. This is wholly inappropriate and even if supported by relevant evidence, which it is not, was not a matter within the scope of this appeal. While he may well be aggrieved at his surname being attached to vexatiousness, and being used as shorthand for the type of order made against him, that is not a matter over which we have control. Hearings before the First-tier Tribunal are not the place for unfounded and unsubstantiated allegations of fraud and corruption to be made. Mr Dransfield does not assist himself or his arguments in so doing. Signed Date: 22 December 2023 Date Promulgated on: 29 February 2024 Jeremy K H Rintoul Upper Tribunal Judge Rintoul (sitting as a judge of the First-tier Tribunal)