Independent Digital News and Media Limited v The Information Commissioner & Anor [2024] UKFTT 700 (GRC)

Case Reference: EA-2023-0405[2024] UKFTT 00700 (GRC)
First-tier Tribunal
(General Regulatory Chamber)
Date 30 July 2024
Information Rights
Decided without a hearing
Before
Judge BUckleyMEMBER susan wolfMEMBER DAVE SIVERS
Between
INDEPENDENT DIGITAL NEWS AND MEDIA LIMITEDAppellantThe Information commissionerRespondentHM TreasuryRespondentDecision: The appeal is allowed.Substituted Decision NoticeOrganisation: HM Treasury.Complainant: Independent Digital News and Media.The Substitute Decision –IC-190608-N3Q9

Signed Date:

[1]For the reasons set out below:a. The public authority was entitled to rely on section 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold the following information: i. Telephone numbers and email addresses. ii. The names of the individuals identified in paragraph 4 of the closed annex. iii. The text set out in paragraphs 15 and 16 of the closed annex.b. The public authority was not entitled to rely on section 40(2) FOIA to withhold the following information: i. The names and job titles of the individuals identified in paragraph 1 of the closed annex ii. The personal data of Rishi Sunak other than that set out in paragraphs 15 and 16 of the closed annex.c. The public authority was entitled to rely on section 27 FOIA to withhold the information highlighted in pink on pages A18 and A19 of the closed bundle.d. The public authority was not entitled to rely on section 27 to withhold the information set out in paragraphs13.1 and13.2 of the closed annex.[2]The public authority must disclose the following information within 35 days of this decision being sent to the parties: i. The names and job titles of the individuals identified in paragraph 1 of the closed annex ii. The personal data of Rishi Sunak other than that set out in paragraphs 15 and 16 of the closed annex. iii. The information set out in paragraphs13.1 and13.2 of the closed annex.[3]Any failure to abide by the terms of the tribunal’s substituted decision notice may amount to contempt which may, on application, be certified to the Upper Tribunal. REASONS

Introduction

[1]The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.[2]This is an appeal against the Commissioner’s decision notice IC-190608-N3Q9 of 31 August 2023 which held: 2.1. HM Treasury (‘HMT) was entitled to rely on section 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold some of the requested information. 2.2. HMT was entitled to rely on section 27 FOIA to withhold some of the requested information. 2.3. HMT was entitled to rely on section 35 FOIA to withhold some of the requested information. 2.4. Some of the information is outside the scope of the request. 2.5. HMT was not entitled to withhold some of the information. The Commissioner ordered the Council to disclose that information.[3]The request for information was made by Mr. David Cohen on behalf of the Independent. The relevant person at the Independent is now Robert Amies.[4]This appeal only relates to the application of section 40(2) and 27 FOIA.[5]We have provided a closed annex to this decision containing those aspects of our reasoning which refer to closed material. If the respondent does not appeal against our decision, or if any appeal is unsuccessful, then paragraphs 1, 2, 3, 12 and 13 of that reasoning need not remain confidential.[6]The time limit in the information rights jurisdiction for making an application for permission to appeal to the Upper Tribunal is normally 28 days from the date that the tribunal’s written reasons are issued: see Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, rule 42(2).[7]We therefore direct that paragraphs 1 2, 3, 12 and 13 of the closed annex will remain confidential until at least 28 days after the date this decision is issued to the parties or such later date as is required by rule 42 or final disposal of an application for permission to appeal and subsequent appeal.[8]The effect of this decision is that, in normal circumstances, the confidentiality will be removed from those paragraphs 28 days after this decision is issued, unless within that time a party makes an application for permission to appeal to the Upper Tribunal. In that event, and subject to any contrary order of the Upper Tribunal, the confidentiality order will continue until disposal of the permission application and any ensuing appeal but will then be discharged.[9]If the confidentiality order is discharged, paragraphs 1, 2, 3, 12 and 13 of the closed annex will then be added to the publicly available decision and copied the appellant. The remainder of the closed annex contains reference to the information we have determined can be withheld and will remain closed.

Factual background to the appeal

[10]Rishi Sunak has been the Conservative MP for Richmond (Yorkshire) since 7 May 2015. He was first appointed as a Minister of the Crown in January 2018 as the Parliamentary Under-Secretary of State at the then Ministry of Housing, Communities and Local Government. From 13 February 2020 – 5 July 2022, he served as Chancellor of the Exchequer.[11]In accordance with the Ministerial Code Mr Sunak made declarations of interest (or confirmed previous declarations) upon his appointment to Ministerial positions (in January 2018, July 2019, February 2020 and November 2021).[12]In 2022 Boris Johnson, the then Prime Minister, asked Lord Geidt, the Independent Advisor on Ministers Interests, to advise on Mr. Sunak’s adherence to the requirements of the Ministerial Code in respect of his declarations of interest. The resulting advice was published in April 2022 and is entitled ‘Advice from the Independent Advisor on Ministers’ Interests about the Chancellor of the Exchequer’s outside interests’. It is referred to in this decision as Lord Geidt’s report.[13]Lord Geidt’s report dealt with a number of interests held by Mr. Sunak or by his wife, in relation to which allegations had been made that these had not been declared or that they gave rise to conflicts of interest. One of those interests was the Chancellor’s possession of a US Permanent Resident Card (known as a Green Card) until October 2021.

Lord Geidt’s report included the following:

“18. While having initially been declared, on appointment to ministerial office at HM Treasury the fact of the [Green] Card was not repeated in the declaration. The Chancellor has explained that this was based on his previous understanding of the relevance of the Card. In light of the above analysis I am satisfied that this was an appropriate course of action. In doing so I note that, at the point of considering ministerial travel to the USA, he informed the department that he possessed the Card in case it should give rise to any material issue. He also discussed the matter with the relevant authorities in the United States and, as a result of those discussions, decided that it would be appropriate at that point to relinquish the Card.”
[15]The appeal relates to correspondence between HMT and US officials on the subject of the green card during the period of time when Mr. Sunak occupied senior ministerial roles at HMT namely Chief Secretary to the Treasury and then Chancellor of the Exchequer. Request, decision notice and appeal The request

Request, decision notice and appeal

[16]This appeal concerns the following request made on behalf of the Independent on 8 June 2022:
“All emails that passed between HM Treasury and US officials on the subject of Rishi Sunak's US green card for the period 1 August 2019 to 31 October 2021.”

The response

[17]HMT initially relied on section 40(2) (personal information) and section 35(1)(d) (ministerial communications). It upheld its position on internal review.[18]In the course of the Commissioner’s investigation HMT relied in addition on section 27 (international relations) and asserted that some information in relation to which it had originally applied section 40(2) was outside the scope of the request.

The Decision Notice

[19]In a decision notice dated 7 December 2021 the Commissioner decided that: 19.1. HM Treasury (‘HMT) was entitled to rely on section 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold some of the requested information. 19.2. HMT was entitled to rely on section 27 FOIA to withhold some of the requested information. 19.3. HMT was entitled to rely on section 35 FOIA to withhold some of the requested information. 19.4. Most of the information was within the scope of the request, although some of the information was outside the scope of the request. 19.5. HMT was not entitled to withhold some of the information. The Commissioner ordered the Council to disclose that information.[20]The reasons for the Commissioner’s conclusion that most of the information was within the scope of the request is set out in a closed annex.[21]It is not necessary for the purposes of this appeal to set out the Commissioner’s reasoning in relation to scope or in relation to section 35.[22]In relation to section 40(2) the Commissioner concluded that the information related to Rishi Sunak and named individuals who were involved in the exchange of correspondence. He was satisfied that this information both related to and identified the individuals concerned. It was therefore personal data withing section 3(2) of the Data Protection Act.[23]The Commissioner recognises a legitimate and compelling interest in learning more about exchanges with US officials regarding the then Chancellor’s US green card. According to the US Citizenship and Immigration Services website, having a green card allows the holder to live and work permanently in the United States. According to the website of the US Embassy in London, a foreign dignitary such as a senior UK politician would normally travel on an A1 visa which must be arranged in advance.[24]The Commissioner accepted that reasonable necessity had been met as, in line with that test, disclosure would provide greater transparency about the extent to which what is described by HMT as ostensibly a private matter was considered via a publicly resourced channel of communication.[25]It is now a matter of public record that Rishi Sunak had a green card and according to news reports, he rescinded this card before his visit to the US as Chancellor in October 2021. There is a legitimate interest in the public knowing more about the details of discussions with US officials given that green card status.[26]The Commissioner acknowledged that Mr Sunak’s green card is a personal matter. It was obtained in his capacity as a private citizen and not as an elected official and a government minister. The October 2021 trip in question to the US was in his official capacity as the then Chancellor of the Exchequer. In this case, any correspondence with US officials on the matter of his green card would inevitably relate to his impending official trip made in his public capacity.[27]The Commissioner recognised that a balance must be struck between Mr Sunak’s legitimate interest in keeping private any correspondence which related to his green card and the legitimate interest in transparency about arrangements for his official trip to the US and about the use of publicly resourced channels to discuss these matters. He acknowledged that the legitimate interest in disclosure has been served to a large extent by a report which had been commissioned in early 2022 entitled ‘Advice from the Independent Advisor on Ministers’ Interests about the Chancellor of the Exchequer’s outside interests’ (Lord Geidt’s report).[28]The Commissioner determined by a narrow margin that there was insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms.[29]In relation to the names of junior officials he concluded that disclosure would be unfair and wholly outside their reasonable expectations.[30]In relation to section 27, the Commissioner accepted that disclosure could encroach on the confidential space needed to conduct effective relations with senior representatives of other states, especially those which value the UK’s trust and discretion. The Commissioner accepted that disclosure would be likely to harm the UK’s relations with such states. He concluded that the public interest in disclosure was outweighed by the public interest in ensuring that the UK maintains effective relations with the US.

Notice of Appeal

[31]The two grounds of appeal are: 31.1. The Commissioner erred in holding that the requested information could be withheld in reliance on section 40(2). 31.2. The Commissioner erred in holding that a portion of the requested information could be withheld in reliance on section 27. Ground 1[32]It is argued: 32.1. The Commissioner erred in applying a public interest balancing test rather than asking if the legitimate interests were overridden by the fundamental rights and freedoms of the data subject. 32.2. The Commissioner wrongly placed excessive weight on whether the individuals would have a reasonable expectation that their information would not be disclosed. 32.3. The finding that Mr. Sunak’s green card was a personal matter was not compatible with the Commissioner’s finding that correspondence with US officials on the matter of his green card would inevitably relate to his impending official trip made in his public capacity. The Commissioner’s decision was inconsistent in relation to the legitimate interest. 32.4. The Commissioner erred in concluding that the legitimate interest had been served to a large extent by Lord Geidt’s report. This was not a relevant factor and the report did not contain or refer to the requested information. Ground 2[33]It is argued: 33.1. The Commissioner erred in focusing on the type or category of information (being correspondence between UK and US officials) and did not sufficiently particularise the information said to give rise to the prejudice, and in so doing, erred in concluding that the first criterion of the three-limb test was satisfied. 33.2. In conducting the public interest balancing exercise, the Commissioner appeared to give weight to the public interest in maintaining international relations with “other states, especially those which value the UK’s trust and discretion” which is too wide and overly vague, and in any event, the wrong test to be applied. The Commissioner erred in not focusing on the claimed public interest in maintaining the exemption as it applied to international relations between the UK and the USA and balancing that against the public interest in disclosure. Accordingly, the Commissioner erred in his assessment of the public interest balancing exercise. The Commissioner’s response Section 40(2)

The Commissioner’s response

[34]The Commissioner stated that he does not consider that, in practice, there is any real difference between the concept of a ‘balancing test’ and the question of whether the rights and freedoms of Mr Sunak or other data subjects override the legitimate interests in disclosure. In any case, the Commissioner considered that the result is the same.[35]In relation to the personal data of junior officials, the Commissioner argued that he was correct to place reliance on the reasonable expectations of those data subjects that the information would not be disclosed.[36]In relation to the personal data of Mr. Sunak, the Commissioner submitted that the fact that and purposes for which Mr. Sunak originally held a green card, alongside any decisions concerning that card are by their nature personal. That does not prevent correspondence relating to the trip itself being official in nature.[37]The Commissioner submitted that the alternative ground of public interest relied on in the decision notice is not incompatible with earlier references and only benefits the appellant’s case.[38]The Commissioner submitted that he did not place excessive weight on the reasonable expectations of the data subjects and primarily relied on this ground in relation to the personal data of junior officials.[39]In so far as the Commissioner’s conclusion that legitimate interests in disclosure were met by Lord Geidt’s report, the Commissioner invited the Tribunal to consider the withheld information and the contents of that report. The Commissioner agreed with the Treasury’s submissions (summarised at DN [50]) that disclosure would not meaningfully increase public understanding and that (per DN [52-53]) Mr Sunak’s interests in not having the data disclosed, which engage his rights and fundamental freedoms under the UK’s data protection legislation, override the public interest in disclosure.[40]In relation to section 27, the Commissioner noted that he is constrained in what he can say about the withheld information and invited the tribunal to examine the information and form its own conclusions. The Commissioner noted that the material raises a number of issues that concern the UK’s relationship with US officials, and that disclosure of that information would, in the Commissioner’s view, be likely to prejudice relations with the US, and in particular the smooth functioning of communications when coordinating or arranging ministerial trips to the US. The Commissioner considered that, in the circumstances of this case, he reached the correct conclusion on the balance of public interests.

HMT’s response

[41]HMT submitted that the Commissioner was justified in taking the approach set out in the Decision Notice. In particular, he correctly identified the interests in play – namely those in favour of disclosure, the interest in protecting the international relations between the UK and the US, those of Mr Sunak, and of those of other persons whose identity would be exposed by disclosure, and the limited additional value of the information being disclosed for transparency – and carried out a justified balancing act of those interests.[42]In particular, HMT said that the Decision correctly emphasised: 42.1. The fact that the Request concerned matters which were both personal and matters which related to public functions. 42.2. As such, it was important to reflect that the reasonable expectations of the individuals concerned would be that certain information would not become public. 42.3. Disclosure would be of limited additional transparency, given the existence of Lord Geidt’s report and its analysis of the self-same issues.

Ground 1

[43]HMT submitted that no appeal grounds are formulated by reference to the personal data of anyone other than Mr Sunak. As such, the Commissioner is justified in concluding that “personal data rights of those other than Mr Sunak outweigh interests in disclosure for the reasons given in the DN”.[44]HMT submitted that it is well-established that there is no material difference between the ‘overriding interests’ test and that concerning qualified exemptions.[45]HMT said that the reasonable expectation of privacy of the individuals concerned was a relevant factor and an appropriate consideration, in the presence of personal data which concerned personal matters (including Mr Sunak’s green card, which was not held in an official capacity). There is no evidence that any particular or undue weight was placed on this factor.[46]HMT said that the decision was not internally inconstant, by recognising the dual aspects of the discussions in this case (discussion by public officials of a private right to travel/live in the United States).[47]HMT submitted that the existence and content of Lord Geidt’s report was relevant to(i) the balancing of the interests at play and(ii) the assessment of necessity of disclosure, i.e. whether there were alternative means of obtaining the information requested.

Ground 2

[48]It is noted that the Commissioner expressly referred to “[…] the importance of confidentiality of communications between the UK and the US and of avoiding the harm disclosure could cause to relations between the two countries. It also referred to the potential chilling effect on everyday exchanges of correspondence in similar circumstances”. It is submitted that these are sufficiently particularised and specific interests which are the subject matter of the exemption in s.27(1). It is submitted that the decision reflected consideration of the requested information and carefully sought to balance the interests at play.

Reply of the appellant

[49]The Independent agreed that the information sought would inevitably contain information relating to Rishi Sunak and related individuals involved in the exchange of correspondence, and that this information falls within the definition of ‘personal data’ in section 3(2) of the DPA.[50]The Independent agreed that the data protection principle most relevant in these circumstances is the principle set out in Article 5(1)(a) of the UK GDPR, i.e., that information can only be disclosed pursuant to a request under FOIA if to do so would be lawful, fair and transparent.[51]The Independent agreed that the lawful basis most applicable in these circumstances is that set out in Article 6(1)(f) of the UK GDPR, i.e., that processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject which require protection of personal data.[52]The Independent agreed and endorsed the Commissioner’s finding that there was a legitimate interest in the public knowing more about the discussions taking place between Rishi Sunak, HMT, and US officials, and that disclosure was necessary to provide greater transparency about the extent to which what is described by HMT as ostensibly a private matter was considered via a publicly resourced channel of communication.

Distinction between data subjects

[53]It is submitted that the Commissioner did not draw a clear distinction between the interests or fundamental rights and freedoms of Rishi Sunak and those of other data subjects. In any event, the relevance of the distinction is not entirely understood given that section 40(2) is an absolute exemption. The appellant submitted that if personal data of any of those data subjects contained in the information sought was found to satisfy all the stages of the exemption such that their rights and freedoms overrode the legitimate interest and necessity of disclosure, then the public authority would be absolutely exempt from disclosing the information requested. Personal data of Rishi Sunak[54]It is submitted that the fact that Rishi Sunak obtained his green card prior to becoming an MP (and later the Chancellor of the Exchequer, and the Prime Minister), does not render his green card a ‘personal matter’; he held a US green card for over six years while he was an MP (during which time he was Parliamentary Under-Secretary of State for Local Government from 9 January 2018; and Chief Secretary to the Treasury from 24 July 2019), and for at least nineteen months while he was Chancellor of the Exchequer between February 2020 and October 2021. During that period, he had a right of permanent residency in the USA, enjoyed certain statutory rights in the USA, and filed annual tax returns with the US government.[55]In circumstances where Mr Sunak held high-level ministerial positions in the UK government (and for example, as Chancellor was responsible for domestic tax policy and negotiating international tax treaties), the independent submitted that it cannot be the case that “any decisions concerning that card… [were] clearly by their nature personal” [IC Response/§26]. It was submitted that it follows that Rishi Sunak cannot have had a legitimate interest “in keeping private any correspondence which relates to his green card” [D/§52].[56]As an elected politician and Chancellor of the Exchequer, working within public authority bodies subject to FOIA and the spirit of transparency, the Independent submitted that Mr Sunak cannot have had a reasonable expectation that his personal data would not be subject to disclosure.[57]In any event, it was submitted that the legitimate interest in disclosure that the Commissioner had already established could not have “been served to a large extent” by the independent report that had been commissioned in early 2022 (and referred to at paragraphs 40-44 of the DN) (“the Geidt Report”). The Geidt Report was “confined to the question of conflicts of interest and the requirements of the Ministerial Code”; and the role did not “touch on any wider question of the merits of such interests or arrangements (paragraph 27).[58]The Independent submitted that the Geidt Report relied upon “the material held by the office of Independent Adviser as well as requesting further information from HM Treasury and the Chancellor”. The Independent argued that it is not clear whether the Geidt Report relied upon or had access to correspondence between HM Treasury and US officials, which is the subject of the Request. In any event, it was submitted that legitimate interests identified by the Commissioner in the Decision Notice (namely, the “legitimate interest in the public knowing more about the details of discussions with US officials given that green card status” was and is not served by the Geidt Report.

Personal data of other data subjects

[59]The Independent is not clear on what individuals constitute the category of data subjects who are ‘individuals other than Mr Sunak’. It was submitted that if the personal data contained in the information sought belongs to either Rishi Sunak or to junior officials that seems potentially incompatible with the Commissioner’s conclusion as to the international relations exemption, that disclosure would encroach on “the confidential space needed to conduct effective relations with senior representatives of other states” (unless the personal data exemption was not relied upon to withhold that information, in which case there is perhaps no such incompatibility).[60]It was argued that the reasonable expectations of any ‘junior officers’ whose personal data is contained in the information sought needs to be carefully considered in the context of the Request. These ‘junior officers’ are individuals who work for, and with, Rishi Sunak, and whose responsibilities included having input or insight into correspondence with US officials relating to the serious and significant matter of Rishi Sunak’s green card and his upcoming travel to the US on a trip in a public capacity. That information is of a particular nature – and the responsibilities of a particular level – that those junior officers whose personal data is contained in the information sought would inevitably have had a reasonable expectation that their personal data may be disclosable.[61]To the extent that the legitimate interest of disclosure was overridden, it is submitted that a more proportionate approach would have been to redact identifying details relating to those individuals.

The international relations exemption

[62]It is submitted that the ‘international relations exemption’ is not engaged on the basis that the three-stage test in Hogan requires the applicable interest(s) within the relevant exemption to be identified; a causal relationship to be shown between the potential disclosure and the prejudice that is ‘real, actual or of substance’ (the evidential burden of which rests with the decision-maker); and a likelihood of prejudice to be shown (a step which also lies with the decision-maker). It is not understood how disclosure of communications in relation to “arranging travel abroad” can give rise to prejudice to international relations that is ‘real, actual or of substance’.[63]The Independent considered the application of the international relations exemption to be insufficient because it attaches any purported prejudice to a category of ‘communication’ without explaining how that prejudice is likely to be caused by the disclosure of the content of that communication, which it is understood to have related to “arranging travel abroad”.[64]The Independent argued that the IC wrongly took into account the likelihood of harm to states other than the US in its decision.[65]Even if the international relations exemption is engaged, it was submitted that any such engagement is weak (for the reasons given above) and overwhelmingly outweighed by the public interest in disclosure of the information requested.[66]It was argued that the fact that Mr Sunak, a UK MP holding various high-level ministerial positions of public responsibility, held a green card entitling him to certain statutory rights in the US and filed annual tax returns with the US government – and the fact that that green card was only forfeited by Mr Sunak in October 2021 (nineteen months after having been appointed Chancellor of the Exchequer) – render the decision-making around Mr Sunak’s green card to be a significant matter of public interest.[67]The Independent does not accept that it is in the public interest not to disclose information on the basis that such disclosure would have a chilling effect. On the contrary, the Independent submitted there is a public interest in ministerial and public officials being aware of their obligations under FOIA, and the spirit of transparency, and to conduct their public roles and official correspondence accordingly.

Additional submissions from HMT

[68]The tribunal sought additional submissions and clarification in relation to a number of issues from HMT as follows: 68.1. Why section 40(2) applies to the individuals, other than Rishi Sunak, whose names have been redacted with specific reference to the grade and/or level of seniority of each individual. 68.2. Confirming which exemption is relied on to make the redactions referred to in paragraph 8 of the closed annex to the Decision Notice and explaining that basis for the application of that exemption. 68.3. Explaining why section 27 is engaged and the public interest favours withholding the information with reference to the specific content of the information withheld under section 27.[69]HMT helpfully clarified that section 27 was relied on in relation to 67.2.[70]Unhelpfully HMT provided no separate submissions in relation to 67.1 and 67.3. Instead it relied on its previous ‘statement of facts’, its rule 14 Application and Annex A. There were no substantive submissions in the rule 14 application or Annex A which addressed the matters in in 67.1 or 67.3. HMT have not provided a document headed ‘statement of facts’ but the tribunal has taken into account any submissions already provided by HMT in, for example, its response to the appeal and in its letters to the Commissioner.

Evidence

[71]We read and took account of an open and a closed bundle. The closed bundle consisted of(i) the disputed information(ii) an unredacted version of correspondence between the Commissioner and HMT(iii) a confidential annex to the Decision Notice.[72]The tribunal considered that it was not necessary for some of the information originally in the closed bundle to remain closed. The tribunal’s deliberations were therefore adjourned and a case management order issued in relation to the closed bundle. A large portion of the previously closed information was provided to the appellant, and the Judge was satisfied that the remainder of the documents had to remain closed, otherwise the purpose of the proceedings would be defeated. The appellant and the Commissioner were given the opportunity to make further submissions on the basis of the newly open information but none were received. Legal framework Personal data

Legal framework

[73]The relevant parts of s 40 of FOIA provide:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) It constitutes personal data which does not fall within subsection (1), and (b) either the first, second or the third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act - (a) would contravene any of the data protection principles, or..[74]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA): (2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.[75]This is in line with the definitions in the General Data Protection Regulation (EU) 2016/679. Recital 26 to the Regulation is relevant, because it refers to identifiability and to the means that should be taken into account: (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.[76]The definition of "personal data" consists of two limbs: i) Whether the data in question "relate to" a living individual and ii) Whether the individual is identified or identifiable, directly or indirectly, from those data.[77]The tribunal is assisted in identifying ‘personal data’ by the cases of Ittadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA [2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.[78]In Durant, Auld LJ, giving the leading judgment said at [28]: Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.[79]In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance: It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.[80]The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider: (2) Does the data "relate" to an individual in the sense that it is "about" that individual because of its:(i) "Content" in referring to the identity, characteristics or behaviour of the individual?(ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?(iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)? (3) Are any of the 8 questions provided by the TGN are applicable? These questions are as follows: (i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller? (ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession? (iii) Is the data 'obviously about' a particular individual?(iv) Is the data 'linked to' an individual so that it provides particular information about that individual?(v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?(vi) Does the data have any biographical significance in relation to the individual?(vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?(viii) Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)? (4) Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?[81]The data protection principles are set out Article 5(1) of the GDPR and s 34(1) DPA. Article 5(1)(a) GDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) GDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[82]The only potentially relevant basis here is article 6(1)(f): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.[83]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows 1. Is the data controller or a third party pursuing a legitimate interest or interests? 2. Is the processing involved necessary for the purposes of those interests? 3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[84]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: 27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ...[85]Section 40(3A) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

Section 27(1) International relations

[86]Section 27(1) provides: Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice– (a) relations between the United Kingdom and any other State[87]The exemption is prejudice based. ‘Would or would be likely to’ means that the prejudice is more probable than not or that there is a real and significant risk of prejudice. The public authority must show that there is some causative link between the potential disclosure and the prejudice and that the prejudice is real, actual or of substance. The harm must relate to the interests protected by the exemption.[88]Section 27 is not an absolute exemption and therefore under s 27(1) the Tribunal must consider whether, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

The role of the tribunal

[89]The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[90]The tribunal has to determine the following issues: 90.1. Is the data controller or a third party pursuing a legitimate interest or interests? 90.2. Is the processing involved necessary for the purposes of those interests? 90.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject? 90.4. Would disclosure prejudice relations between the United Kingdom and any other state? 90.5. Does the public interest balance favour disclosure? Discussion and conclusions Section 40(2)

Discussion and conclusions

[91]The information withheld under section 40(2) is: 91.1. The contact details of individuals (telephone numbers and email addresses). 91.2. The names and job titles of officials or employees. 91.3. Other content related only to Rishi Sunak. Personal data of individuals other than Rishi Sunak Legitimate interest

Personal data of individuals other than Rishi Sunak

[92]We do not accept that there is any legitimate interest in emails addresses or telephone numbers. We conclude that this information is exempt under section 40(2).[93]We ordered HMT to provide submissions on why section 40(2) applied to the names of individuals, other than Rishi Sunak, with specific reference to the grade and/or level of seniority of each individual. HMT have not provided any substantive additional submissions. In the absence of those submissions we are not persuaded that some of the redacted names belong to ‘junior’ employees or officers. Those individuals are identified in the closed annex.[94]We do not accept that there is any legitimate interest in the names of ‘junior’ officials or employees and we conclude that this information is exempt under section 40(2). There are no redactions of job titles of individuals that we have accepted are ‘junior’.[95]We accept that there is a legitimate interest in the identity, i.e. the job titles and the names, of any individuals other than junior employees involved in discussions of this nature. Reasonable necessity[96]We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interests. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least restrictive means of achieving the legitimate aim in question, because it would not be necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subjects.[97]In our view the legitimate interest in the identity and names of any individuals other than junior employees cannot be achieved through other means and therefore it is reasonably necessary to disclose the names of those individuals. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[98]We do not accept that more senior employees in these type of roles have a reasonable expectation of privacy in relation to this this specific information (i.e. their names in a work context).[99]For those reasons we conclude that the names of more senior employees are not exempt under section 40(2).[100]We have considered the name and job title of one of those employees or officials under section 27, because it was considered in the decision notice under section 27. HMT have not relied on section 27 in the alternative in relation to the other names and this did not form part of the Decision Notice.

Personal data of Rishi Sunak

[101]We accept that this is Rishi Sunak’s personal data, in the sense that it relates to him – it is obviously about Rishi Sunak and he is its focus. He is also identifiable from the information.

Legitimate interest

[102]We find that there is a clear legitimate interest in transparency in relation to the precise circumstances and the detail of the discissions surrounding the following matter: “… I note that, at the point of considering ministerial travel to the USA, [Rishi Sunak] informed the department that he possessed the [Green] Card in case it should give rise to any material issue. He also discussed the matter with the relevant authorities in the United States and, as a result of those discussions, decided that it would be appropriate at that point to relinquish the Card.” (Geidt report at [18])[103]Further we agree with the Commissioner that there is a legitimate interest in transparency in relation to the extent to which what is described by HMT as ostensibly a private matter was considered via a publicly resourced channel of communications.

Reasonable necessity

[104]We accept that the Geidt Report does contribute to transparency in relation to this issue to some extent, however it does not set out any detail of what the discussions were with the relevant authorities or cast any light on why, as a result of those discussions, Mr. Sunak decided it would be appropriate at that point to relinquish the Card. In our view, it is reasonably necessary for the correspondence to be disclosed for the purpose of the identified legitimate interests. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[105]In relation to one redaction to page A20 and a redaction on page A14 of the bundle, the tribunal accepts that the legitimate interests are overridden by the interests of fundamental rights and freedoms of the data subject. Whilst this takes place in the context of official discussions about a state visit in Mr. Sunak’s official capacity as Chancellor, these particular sections of these emails fall squarely, in our view, into Mr. Sunak’s private life. We find that Mr. Sunak would have had a reasonable expectation of privacy in relation to this particular information.[106]In relation to the remainder of the information relating to Rishi Sunak withheld under section 40(2) we do not accept that Mr. Sunak would have had a reasonable expectation of privacy. The fact that Mr. Sunak held a Green Card and that he decided to relinquish it as a result of discussions with US officials was in the public domain at the date of the response to the request. These are discussions between state officials organising a visit by Mr. Sunak to the US in his capacity as Chancellor. We accept that the Green Card was held by Mr. Sunak as a private individual, but its relevance to these discussions between officials about a state visit is its impact on his public role and his public duties not on his private life. The discussions do not reveal any aspects of Mr. Sunak’s private life. We do not accept that there would be any harm or distress to Mr. Sunak as a result of disclosure of this information.[107]In our view there is an important legitimate interest in this information, given Mr. Sunak’s position as Chancellor and the controversy and public debate surrounding the holding and the relinquishing of his Green Card.[108]For those reasons we conclude that the legitimate interests outweigh the interests and fundamental rights and freedoms of Rishi Sunak in relation to the remainder of his personal data withheld under section 40(2). For the same reasons we conclude that disclosure would be fair and transparent.[109]We conclude that HMT was not entitled to rely on section 40(2) to withhold that information.

Section 27

[110]There is additional closed reasoning on section 27 in the closed annex.[111]The applicable interest under section 27 is the protection of the interests of the UK in its dealings with other states.[112]HMT’s arguments on this issue appear largely in the closed bundle in the redacted portions of its letter to the Commissioner. Some of that argument is repeated in the Decision Notice and so can be set out in open:
“Although not cited in the initial request or the internal review, we now consider that some of the information engages s27(1)(a) as the information is communications between a UK Government Private Office and officials in the US Embassy. In such matters when arranging travel abroad for ministers, Private Offices rely on candour from Embassy officials, and therefore we consider that releasing the information could harm the relationship between the UK and the USA.”
[113]There is another aspect to HMT’s argument which is contained in the closed bundle and considered in the closed annex to this decision.[114]We are not persuaded that emails that include what we would categorise as banal discussions of administrative arrangements or those that simply reveal that the discussions were between certain individuals engage section 27. We are also not persuaded in relation to one redaction that does not fall within this category.[115]We have considered the consequences that HMT asserts would flow from the disclosure of this information, but we are not persuaded of any causative link between the disclosure of this particular information and those consequences. We do not accept that release of this information carries a significant and weighty chance of causing any chilling effect on the candour with which Private Offices and Embassy officials communicate.[116]We are not persuaded that there is a significant any weighty chance of prejudice to relations between the United Kingdom and another state in either way set out by HMT through disclosure of this information.[117]We have set out the pages in relation to which we find that section 27 is not engaged in the closed annex.[118]In relation to two pages of the emails we do accept that section 27 is engaged for the reasons set out in the closed annex.

Public interest balance under section 27

[119]We accept that there is a very strong inbuilt interest in avoiding harm to the interest of the UK in its dealings with other states. In relation to the particular information redacted from the two pages in relation to which section 27 is engaged, we are not persuaded that there is a significant public interest in disclosure. The information does not illuminate the public interest issues highlighted by the appellant. We accept that there is a general public interest in transparency but in our view this is outweighed by the public interest in maintaining the exemption. Signed Date: Sophie Buckley 26 July 2024 Promulgated on: 30 July 2024