Christopher McKeon v The Information Commissioner & Anor [2024] UKFTT 71 (GRC)

[2024] UKFTT 00071 (GRC)Appeal Number: EA/2023/0357Date 24 January 2024
First-Tier Tribunal
(General Regulatory Chamber)
Information Rights
Christopher McKeonAppellant:The Information CommissionerFirst Respondent:Independent Parliamentary Standards AuthoritySecond RespondentDate and type of Hearing: on GRC CVP Remote Hearing RoomsPanel: Brian Kennedy KC, Kate Grimley Evans and Stephen Shaw.Date of Decision:- 11 January 2024.Representatives:
Between
Christopher McKeonAppellantThe Information CommissionerRespondentIndependent Parliamentary Standards AuthorityRespondentDate and type of Hearing: on GRC CVP Remote Hearing RoomsRespondentPanel: Brian Kennedy KC, Kate Grimley Evans and Stephen Shaw.RespondentDate of Decision: - 11 January 2024.RespondentRepresentativesRespondentChristopher McKeon as Litigant in Person. for Appellant for First Respondent: Alec J. Watson, Solicitor with the ICO. for Second Respondent: Robin Hopkins of Counsel.Result : –The Tribunal dismiss the Appeal.REASONS

Introduction:

[1]This appeal is against the decision of the First Respondent, the Information Commissioner (“the Commissioner”), brought by Christopher McKeon (“the Appellant”), under section 57 of the Freedom of Information Act 2000 (“FOIA). It is against the Commissioner’s Decision Notice of 17 July 2023 - Ref. IC-219998-J5R4- (“the DN”).[2]On 12th December 2022 the Appellant wrote to the Independent Parliamentary Standards Authority (“IPSA”) and requested information in the following terms: “Please provide the following information broken down [sic] MP: For the whole of the current Parliament the total number of staff hired by each MP. For the whole of the current Parliament the total number of staff who have left the employment of each MP”.[3]IPSA responded on 24 January 2023 providing the information requested in an anonymised spreadsheet.[4]The provision of the information in un-redacted form was refused in reliance on the FOIA exemption contained at Sections 40 (2) and 40 (3A)(a) namely the personal data of third parties.[5]On 3 March 2023 IPSA affirmed its position after internal review.[6]On 6 March 2023 the Appellant filed a Section 50 complaint to the Commissioner.[7]The Commissioner issued the DN on 17 July 2023.

Legal Framework

[8]Section 1(1) FOIA affords a general right of access to information from public authorities on request, and a corresponding duty on public authorities to comply with such a request by (a) confirming or denying that it holds the requested information and(b) communicating the information to the requester.[9]However these rights are subject to certain exemptions, set out in Part II FOIA.[10]For the purposes of this case, the relevant exemption in Part II is Section 40 of FOIA.[11]Section 40 FOIA reads insofar as relevant: 40 Personal information(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if (a) it constitutes personal data which do not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B)The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing). (4A)The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.[12]By virtue of Section 40 (7) FOIA , “the data protection principles” means the principles set out in the General Data Protection Regulations (“GDPR”), and section 34(1) of the Data Protection Act 2018.[13]For instant purposes the applicable data protection principle is that disclosure of third-party personal data in response to a FOIA request is only permissible where to do so would be lawful, fair and transparent.[14]By virtue of Section 2(3) of FOIA, Section 40(2) provides an absolute exemption if disclosure of personal data would contravene any of the data protection principles.

Decision Notice

[15]The Commissioner concluded in his DN that the Section 40 (2) exemption was engaged.[16]The Commissioner is satisfied that the information represents personal data.[17]The small numbers of staff (on average five) associated with each MP, combined with other information already in the public domain (including that known by the individuals’ colleagues or relatives), suggests that it is reasonably likely that individuals may be identified.

Identifiability:

[18]Article 4 GDPR defines personal data thus; “’personal data’ means any information relating to an identified or identifiable natural person (‘data subject’ ); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.[19]Further amplification of this definition is found in recital 26 GDPR, were, inter alia:
“The principles of data protection should apply to any information concerning an identified or identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.”
[20]The guiding principle to Recital 26 is “data should be such as not to allow the data subject to be identified via “all” “likely” and “reasonable” means”, and “clearly sets a very high standard”.[21]Personal data is a relational concept: data in the hands of one individual may not be personal data, where in the hands of another individual holding additional relevant data, it would be personal data: per Cranston J. in Department of Health v Information Commissioner [2011] EWHC 1430 (Admin).[22]When considering identifiability in the context of FOIA it must be borne in mind that FOIA disclosure is disclosure into the public domain (’the world at large’).[23]Thus the ‘identifier’ presumed by the GDPR may be any other person in the public domain, not just the requester. This could plainly include complete strangers to the data subject but also friends, family, colleagues, and enemies to the data subject.[24]In regards this latter category, the Upper Tribunal has previously utilised the concept of the ‘Motivated Intruder’ to assist in consideration of means likely to be used by a third party to seek to identify data subjects, who would have a number of routes and tools to do so (per Information Commissioner v Magherafelt District Council [2012] UKUT 263 and Miller v Information Commissioner [2018] UKUT 229, found here: https://assets.publishing.service.gov.uk/media/5b59ab68e5274a3ff594d141/GIA 244 4_2017-00.pdf[25]The correct question formulated by UT Judge Markus in Miller (adopted and approved in NHS Business Services Authority v. Information Commissioner & Spivack [2021] UKUT 192) was: “Whether a person can be identified taking account of ‘all means reasonably likely to be used’?”.[26]In Miller the nub issue was whether public authority was permitted to redact ‘small numbers’ data concerning a few individuals from within a larger data set.[27]The Tribunal is asked to consider paragraph 28 of Miller which affirms the correct threshold for the likelihood of indirect identification was “greater than remote.”[28]It is apparent from the anonymised spreadsheet that the number of staff for some MPs is greater than five.[29]It appears the reason behind the Appellant’s request is to explore MPs’ staff turnover, as part of a wider investigation into workplace culture in Westminster.[30]It is submitted that the motivated intruder would likely leave no journalistic stone un-turned in pursuit of such a story – which is a factor weighing in favour of applying the exemption.[31]In the present case, having determined that the disclosure of personal information would be prima facie contrary to the data protection principle, the Commissioner went on to ask himself the 3 gateway questions(i) whether there is a legitimate interest in disclosing the information,(ii) whether disclosure of the information is necessary, and(iii) whether these interests override the rights of the individuals whose personal information it is.[32]The Commissioner determined that there is insufficient legitimate interest to outweigh the fundamental rights and freedoms of the individuals.[33]The Commissioner considered that there is no legal basis for the IPSA to disclose the requested information, and it would thus be unlawful to do so.[34]In summary the Commissioner supported IPSA’s entitlement to rely on section 40(2) FOIA to refuse to provide the requested information.

Grounds of Appeal:

[35]In his grounds of appeal (“GoA”), the Appellant argues the following grounds:a. naming the MPs cannot lead to individual staff being identified;b. the requested data cannot identify individual members of staff;c. the “Register of Interests of Members’ Secretaries and Research Assistants” contains the individuals’ name(s), and the name of the MP they work for, in a publicly accessible document;d. a person’s LinkedIn profile already contains the month and year in which they worked for a particular employer as well as the name of that employer – which is therefore already in the public domain.

Commissioners Response:

[36]The Commissioner maintains his position as set out in the DN setting out his findings and the reasons for those findings. The Commissioner makes further observations in his Response to the Appellant’s GoA and submits that there is a real (as opposed to hypothetical) risk of re-identification:a. For reasons already stated the motivated intruder is likely to be driven to identify the staff member in question.b. The motivated intruder is likely already to know (or be able to detect) a great deal about the staff member in question;c. they are likely to have a good knowledge of the staff member’s links to the particular geographical constituency and/or other known connections, and of key dates relating to their employment.d. There is a high potential for leakage and transposing of such information between the motivated intruder and other persons with complementary knowledge about the staff member (which the Commissioner described as “triangulation”).[37]The Commissioner argues that immediately it can be seen that the Appellant’s contention that the individual’s name and the name of the MP they work for is already published on the Register is not correct. This is because there are two qualifying requirements before a staff member is required to go on the Register, namely(i) hold a parliamentary pass and(ii) hold outside employment, and/or(iii) receive benefits, gifts and/or hospitality.[38]The Commissioner argues that the important point to note is that holding a position as an MP’s member of staff does not, in itself, trigger an obligation to go on the Register, or to put it another way any member of staff who does not meet the criteria set out is not required to place their name on the Register. The Register self-evidently is not a comprehensive public record of all staff in the employ of Members of Parliament, and the Appellant is wrong to suggest otherwise.[39]The Commissioner recognises that many (perhaps the majority) of staff may make such a declaration. But ‘most’ if not ‘all’ , which is the premise upon which the Appellant’s ground is effectively predicated.[40]The Commissioner submits there must be a likelihood that not all members of all MPs’ staff have posted their work status on Linked-In (if for no other reason than safety concerns, as the Appellant himself has conceded). Thus Linked-In cannot be regarded as a comprehensive public domain record of all staff in the employ of Members of Parliament; the Appellant is wrong to suggest otherwise.[41]Furthermore he argues, it is far from inconceivable that a motivated intruder could use Linked-In as a tool to discover other members of staff by association (and who themselves do not have a profile), which amounts to a risk of indirect identification (“the jigsaw effect”).[42]The Commissioner submits that in all the circumstances IPSA was entitled to withhold the information requested by the Appellant and the Commissioner’s DN is correct in law. The Appellant’s GoA do not reveal any error of law in the balancing exercise as alleged and the Commissioner submits that this Appeal should be dismissed.

Second Respondent’s Reply:

[43]IPSA submit the withheld information is clearly the personal data of the MPs in question and explain however, IPSA does not rely on the data protection rights of MPs to withhold that personal data: this is because, as regards MPs, IPSA has taken the view that, on balance, disclosure of the withheld information would be lawful, because of the public roles and profiles of MPs. Instead, it relies on the data protection rights of individuals who were members of each MP’s staff over the period covered by Mr McKeon’s request. To disclose the withheld information would be to disclose the personal data of those individuals. “Personal data” is defined in Article 4(1) of the UK GDPR.[44]IPSA submit that the GoA do not undermine IPSA’s case or the Commissioner’s conclusions on section 40(2) FOIA:(1) Mr McKeon argues that “the [withheld information] on its own cannot identify individual members of staff”. IPSA agrees. It relies on the relative ease with which indirect identification would be affected:.(2) Mr McKeon then argues that “even combined with other information in the public domain, the [withheld information] cannot identify individuals unless they have already disclosed that biographical detail about when they joined or left employment with an MP”. In other words, Mr McKeon argues that the disclosure of the withheld information would add nothing to what can already be discerned from public sources. If that were correct, it is not clear why Mr McKeon pursues this FOIA request and his appeal. But it is not correct: for the reasons explained, the disclosure of the withheld information would reveal something new about the relevant data subjects (current and/or former staff of each MP), namely that they were part of a workplace that some people would infer to have had certain characteristics (e.g. tainted by bullying or similar “causes of concern”).(3) It is this new information that is likely to give rise to additional intrusive and unwarranted contact being made with some members/former members of MPs’ staff, by journalists and/or by persons with hostile, abusive and harassing agendas. In his Grounds of Appeal, Mr McKeon says this:
“Put bluntly, a person looking to harass a member of a particular MPs’ staff would already be able to identify them using the Register of Interests or LinkedIn”
. This misses a key point underlying IPSA’s concerns, namely that the public disclosure of this new information relating to MPs staff/former staff is likely to be acted upon in ways that cause unwarranted prejudice to those data subjects, because it is likely to cause additional intrusive and unwarranted contact of the kinds described above. That is the crucial difference that this disclosure would make.[45]The Commissioner and IPSA argue they were therefore correct to conclude that the withheld information is exempt from disclosure under section 40(2) FOIA.[46]If the Tribunal agrees with IPSA’s case on section 40(2) FOIA, then it need not consider IPSA’s supplementary case. However, should the Tribunal need to consider the matter further, IPSA also maintains that the withheld information is exempt under section 38(1) FOIA, which provides as follows: (1) Information is exempt information if its disclosure under this Act would, or would be likely to— (a) endanger the physical or mental health of any individual, or (b) endanger the safety of any individual.[47]IPSA’s view is that the disclosure of the withheld information would create a significant and weighty risk of some members/former members of MPs’ staff being subjected to the kinds of abusive, harassing and dangerous contact. Even if this were to be only a very small number of such instances, that would suffice for section 38(1) FOIA to be engaged.[48]Section 38(1) is a qualified exemption, but as the Tribunal recognised in BUAV v IC and Newcastle University (EA/2010/0064):
“self-evidently, there would need to be very weighty countervailing considerations to outweigh a risk to health or safety which was of sufficient severity to engage section 38(1)”
. There are no such weight countervailing considerations in this case. Therefore, if section 38(1) FOIA is engaged, the public interest balance clearly favours maintaining that exemption rather than disclosing the withheld information.[49]Accordingly, should the Tribunal need to consider section 38(1) FOIA, it is invited to agree that the withheld information is exempt under that provision also.[50]For those reasons, together with the reasons given by the IC in his decision notice, Mr McKeon’s appeal should be dismissed.

Appellant’s Reply

[51]The Appellant provided submissions in relation to his appeal and response to the Commissioners argument submitting that the Commissioner failed to demonstrate how individual staff members could be identified using the details of staff turnover and further, that there is no clear mechanism involving the date requested that would result in individual members of MPs’ staff being identified without their consent.[52]The Appellant refutes that the Miller threshold is met.[53]The Appellant avers that the IPSA’s original position was untenable and therefore the Commissioner’s conclusion is no longer appropriate.[54]The Appellant contended that the Commissioner misunderstands and mischaracterizes his argument. The Appellant argued that the Commissioner has failed to explain how the requested information could lead to the identification of MPs’ staff without their consent. Therefore, the appeal should be allowed, and the names should be released.

Submissions from the Second Respondent:

[55]IPSA’s concerns about disclosing that data can be summarised as follows: I. Information linking a named MP to staff turnover data is obviously the personal data of that MP, within the meaning of Article 4(1) of the UK General Data Protection Regulation (“UK GDPR”). IPSA does not, however, seek to withhold that information by reference to the data protection rights of MPs. This is because IPSA accepts that, within reasonable limits, MPs should expect transparency about such matters. II. Importantly, however, data about the staff turnover of a notional “Named MP” during a specified period is also the personal data of their staff members. Each MP has a small number of staff, who will generally be identifiable from information in the public domain. Information about staff turnover is information about the work environment of those staff. Specifically, the information that Mr McKeon suggests could be gleaned is that, if one works for Named MP with a high staff turnover, one works in an environment tainted by “causes of concern” such as bullying. IPSA does not accept that such an inference would be well-founded, but it is the inference that would be drawn, and that constitutes information that relates to identifiable staff members. The disclosure Mr McKeon seeks would therefore entail the disclosure of the personal data not only of MPs, but also of their staff members. III. Public disclosure of that personal data about staff members would contravene Article 5(1)(a) of the UK GDPR: it would be unfair and disproportionate, and no lawful processing condition would be met. This is because – given the emotive issue to which this inferential personal data relates (most notably, suspected bullying) – individuals who work or have worked for MPs with high staff turnover are likely to be contacted about those inferred concerns. That contact is likely in at least some cases to be intrusive and unwelcome. Unlike elected MPs, staff should not be expected to endure speculative contact of that kind, i.e. contact based on inferences that they work or worked for a bullying MP and were thus victims of, witnesses to or even complicit in bullying. This would be unfair, unwarranted, and would be likely to cause distress to at least some affected staff. IV. The data Mr McKeon seeks is therefore exempt from disclosure under section 40(2) FOIA, by reference to the personal data rights of MPs’ staff (rather than the MPs themselves). V. In addition, there is a strong body of evidence that both MPs and their staff are unfortunately at significant risk of contact from members of the public that is in some cases abusive, harassing and even dangerous. That is not a speculative concern: see e.g. IPSA’s summary to the IC [C126], media coverage about risks to MPs’ staff [E164 onwards; E188 onwards]; a House of Commons report [E212] and a Joint Committee on Human Rights report [E243] to similar effect, and specialist coverage about mental health issues faced by MPs’ staff [E266]. As IPSA understands it, Mr McKeon does not dispute that evidence, i.e. he does not challenge IPSA’s contention that MPs and their staff are vulnerable to abuse, harassing and dangerous contact from members of the public. VI. Instead, Mr McKeon’s argument is that the disclosure he seeks would make no difference to those risks: people who want to make such contact with MPs and/or their staff can already do so. It is not right to say that this disclosure would make no difference: a public disclosure that gives rise to the inference (whether rightly or wrongly) that a Named MP is a bully is likely to spur additional harassing contact with that MP and/or with relevant staff, because of the emotive nature of that issue. That incremental risk is of significant concern, particularly when inferences about bullying are likely to receive media coverage, which is the reality of this case. VII. For those reasons, IPSA also relies on section 38(1) FOIA to withhold the data Mr McKeon seeks. IPSA does so based on the danger that this disclosure would be likely to cause to MPs and their staff. Even if that danger were to materialise in only a very small number of cases, the exemption is engaged, and the public interest favours maintaining it.[56]That is the summary of IPSA’s case that the Tribunal is invited to uphold. If Mr McKeon’s appeal is to succeed, he needs to make clear which part(s) of the above summary he says are wrong and why. IPSA maintains that its summary above is right, and compelling. The exemptions under sections 40(2) and 38(1) FOIA are engaged, and the appeal should be dismissed. In the remainder of this skeleton argument, IPSA reiterates its case, as put in its Response to the Grounds of Appeal [A18], in more detail.

The Appellant’s Skeleton

[57]The Appellant made the following submissions for the Appeal.[58]That the section 40 (2) exemption was incorrectly applied. Further, that the original argument was flawed. The Appellant stated that disclosure would support the legitimate interests of journalism and transparency.[59]The Appellant argued that any harm to the interests of others in disclosing the information would be limited. Finally, that disclosure would ensure compliance with the data protections principles.

The Hearing:

[60]After discussion on the general submissions the Tribunal questioned the Appellant on specific factual matters that we feel are crucial to the request. We asked the Appellant what he would do with the information and how useful it would be. In answer he described how he had a lot of information already, but this information would, on “a longer term and with a sensitive approach” allow him to identify those who had left their job with certain MPs’, and it would “- confirm his suspicions”. He continued to describe how he could look at adverts for the jobs and add this information to a lot of things in Westminster that are done informally and not advertised etc. This would allow him to piece together information he already has and help focus his inquiries.[61]When asked if he recognised the risks of speculation, based on the information he seeks leading to inferential conclusions for the use of Personal Data which leads to the identity of the Data Subjects, he answered that the risk of this happening is low, and it would provide a fuller and clearer picture of turnover. The Tribunal explained that like IPSA, the Tribunal accept that the Appellant is a responsible individual but there are many in the world at large that are not so responsible, and disclosure would be to the world at large. The Appellant did not challenge IPSA’s contention that MPs and their staff are vulnerable to abuse, harassing and dangerous contact from members of the public.

Conclusions:

[62]The Tribunal accept there is a legitimate interest in addressing any issue of bullying of staff by MPs. We have been provided with evidence of alternative mechanisms of detection of bullying and published outcomes of proper and fair investigations into such unjustified conduct. However, we have serious concerns about disclosure of the withheld information to the world at large. On the Appellants own evidence, it could lead to the identification of the Data Subjects who are employed by MPs at Westminster. Otherwise, the Appellant would not be making the request or appealing the DN. Others could use similar or even alternative methodology as described to us by the Appellant to achieve the same purpose he wishes to use the withheld information for. This, on his own evidence could lead to speculative interpretation that could and in our view would have an unfair, disproportionate, and significant detrimental and harmful effect on the data subjects concerned, as described by IPSA in these proceedings and as we as a Tribunal have judicial notice of in any event. Those data subjects have a strong legitimate expectation that their privacy rights would be protected by law. Even if only one such employee was to be identified those legitimate expectations would be undermined.[63]The Tribunal recognise there may be a legitimate interest in exposing bullying in the workplace and in circumstances that concern the Appellant however we are of the view that there is not much to be gained from disclosure of the withheld information as we find high turnover rates within an MR’s office may occur for many reasons other than harassment and/or bullying. Accordingly we find the information is not definitive and may well lead to incorrect assumptions. We cannot see benefits to the public interest in disclosure of the withheld information in this case being exposed to the world at large. The Appellant has failed to persuade us otherwise. Such speculative assumptions that might be made, in our view cannot possibly outweigh the data subject protection afforded by the Law to the Data Subjects.[64]The Tribunal accept that that the withheld information amounts to personal data and s40(2) is engaged as argued by the Respondents. We accept and adopt the Commissioners’ reasoning as set out at paragraph 31 above and similarly address the the 3 gateway questions(i) whether there is a legitimate interest in disclosing the information,(ii) whether disclosure of the information is necessary, and(iii) whether these interests override the rights of the individuals whose personal information it is. We agree there is a legitimate interest in general terms, but as explained above we are not persuaded disclosure is necessary, or in any event that the identified interests in disclosure (transparency and journalism) outweigh the interests or fundamental rights and freedoms of the data subjects which require the protection of personal data and the legitimate interest balancing test weighs in favour of non-disclosure.[65]We find the arguments presented by Mr. Hopkins in his submissions, and upon the authorities he has cited, compelling and refer also to the helpful ICO guidance at:

s40 Personal_information_(section_40_and_regulation_13)_version2.3 (ico.org.uk)

[66]For all the above reasons we can find no error of law in the DN nor in the exercise of his discretion by the Commissioner therein and we must dismiss the appeal.

Coda :

[67]All members of the panel have contributed to the writing of this decision. Brian Kennedy KC 23 January 2024.