UA v The Information Commissioner [2024] UKFTT 76 (GRC)

[2024] UKFTT 00076 (GRC)Case Reference: EA/2022/0242
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 1 August 2023Date 24 January 2024
Information Rights
Heard by: determination on the papers
Promulgated on: 25 January 2024
Before
TRIBUNAL JUDGE STEPHEN ROPERTRIBUNAL MEMBER DAVID COOKTRIBUNAL MEMBER PAUL TAYLOR
Between
UA (anonymous)AppellantTHE INFORMATION COMMISSIONERRespondentDecision: The appeal is DismissedREASONS

Preliminary matters

[1]Pursuant to Case Management Directions issued by the Tribunal dated 24 January 2024, the Appellant was granted an anonymity order and accordingly is referred to only as ‘UA’ in this decision.[2]In this decision, we use the following abbreviations to denote the meanings shown: Authority: Chief Constable of Durham Constabulary. Balancing Test: The last question of the Legitimate Interests Test, as referred to in paragraph 50. Commissioner: Information Commissioner. Constabulary: Durham Constabulary. Decision Notice: The Decision Notice of the Information Commissioner dated 15 August 2022, reference IC-171869-H8N0. DPA: The Data Protection Act 2018. Disclosure Public Interest Test: The test as to whether, in all the circumstances of the case, the public interest in maintaining an exemption outweighs the public interest in disclosing the information, pursuant to section 2(2)(b) of FOIA (set out in paragraph 38). First Part of the Request: The first part of the Request, regarding the name of the individual who placed the call in question. FOIA: The Freedom of Information Act 2000. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f) of the UK GDPR, as set out in paragraph 44. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 49. NCND Public Interest Test: The test as to whether, in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, pursuant to section 2(1)(b) of FOIA (set out in paragraph 36). Request: The request for information made by the Appellant to the Authority dated 24 September 2019, more particularly described in paragraph 9. Requested Information: The information which was requested by way of the Request. Second Part of the Request: The second part of the Request, regarding whether the person who placed the call in question was not a member of the Appellant’s family. Tribunal Rules: The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.[3]We refer to the Information Commissioner as ‘he’ and ‘his’ to reflect the fact that the Information Commissioner was John Edwards at the time of the Decision Notice, whilst acknowledging that the Information Commissioner was Elizabeth Denham CBE at the time of the Request.[4]Nothing we say in this decision should be taken as an indication as to whether or not any Requested Information is held by the Authority.

Introduction

[5]This was an appeal against the Decision Notice, which (in summary) held that the Authority could rely on section 40(2) in order to withhold certain of the Requested Information and that the Authority could rely on section 31(3) of FOIA to neither confirm nor deny whether it held certain of the Requested Information. The Decision Notice did not require the Authority to take any steps.

Mode of Hearing

[6]The parties consented to the appeal being determined by the Tribunal without an oral hearing.[7]The Tribunal considered that the appeal was suitable for determination on the papers in accordance with rule 32 of the Tribunal Rules and was satisfied that it was fair and just to conduct the hearing in this way.

Background to the appeal

[8]The background to this appeal is as follows. The Request[9]On 24 September 2019, the Appellant sent an email to the Authority requesting for information in the following terms The Appellant also made a similar request by email later on the same date, but that request (whilst asking for essentially the same information) is not the subject of the appeal, as it was the subject of a separate decision notice from the Commissioner. :
“Please could you confirm urgently- for a Court Hearing on [redacted] the name of the individual who maliciously placed a call with yourselves on [redacted] or confirm that it was definitely not a member of my family.”
.

The Authority’s reply and the Appellant’s subsequent complaint to the Commissioner

[10]The Authority responded on the same day of the Request (24 September 2019) and refused to provide the Requested Information, stating that data protection legislation prohibited disclosure of personal data related to a third party. The response also advised the Appellant that they could make a subject access request in respect of their own personal data.[11]The Appellant then requested an internal review, though one was not immediately forthcoming.[12]The Appellant contacted the Commissioner to complain about the way the Request had been handled by the Authority.

The Decision Notice

[13]The Commissioner considered that there were two parts to the Request. The first part was for the name of the individual who placed the call. Only if that part of the Request was unsuccessful would the Appellant wish to obtain confirmation (the second part of the Request) as to whether the caller was at least not a family member. (As referred to in paragraph 1, we refer to these, respectively, as the ‘First Part of the Request’ and the ‘Second Part of the Request’.)[14]The Commissioner considered that, during the course of his investigation, the Authority provided what was, in effect, an internal review, on 15 July 2022.[15]The Commissioner also clarified, during the course of his investigation, that the Authority’s position was that it was relying on section 40(2) of FOIA in respect of the First Part of the Request, and section 31(3) of FOIA in respect of the Second Part of the Request.[16]In respect of the First Part of the Request, the Commissioner concluded, by way of the Decision Notice, that (in summary):a. The name of any caller would clearly relate to that individual, and would enable their identification. The information was therefore personal data.b. Whilst the Commissioner accepted that the Appellant had a legitimate interest in the relevant Requested Information, the Appellant’s interest in the information was purely a personal one.c. It was not necessary for the relevant Requested Information to be disclosed, as there were alternative means which would interfere less with the privacy of the individual in question (as those means would not entail disclosure to the world at large, in contrast to disclosure under FOIA).d. That individual would have a reasonable expectation that their name would not be released under FOIA, especially given the circumstances of the matter, and there was no wider public interest in the matter.e. The Appellant’s legitimate interests were therefore insufficient to outweigh the rights and freedoms of that individual.f. Accordingly, disclosure of the name of the caller would therefore be unlawful.[17]In respect of the Second Part of the Request, the Commissioner concluded, by way of the Decision Notice, that (in summary):a. Confirming or denying whether the relevant Requested Information was held would be likely to prejudice the Constabulary’s ability to apprehend or prosecute offenders (as referred to in section 31(1)(b) of FOIA) and the Constabulary’s function of ascertaining whether any individual had failed to comply with the law (as referred to in sections 31(1)(g) and 31(2)(a) of FOIA). This was based on the Authority’s submissions and in particular that if it were to issue any confirmation or denial then it would provide information about the caller, which could inhibit individuals from contacting the Constabulary. This was based on the view that such individuals could be concerned that there was a risk that their involvement in any incident, and their identity, could be made public as a result of a disclosure under FOIA.b. In respect of the NCND Public Interest Test, the Appellant’s interests in the matter were personal. On the other hand, confirming or denying whether the relevant Requested Information was held could discourage people from voluntarily providing information to the Constabulary and the wider police service, and this was not in the public interest.c. On balance, the relevant Requested Information had no wider public interest and there was a far greater public interest in ensuring individuals were not reluctant to contact the Constabulary, and accordingly the Authority was entitled to neither confirm nor deny holding the relevant Requested Information.[18]The Decision Notice also determined that the Authority’s refusal notice did not meet the requirements of section 17(1) of FOIA. This was on the basis that, in its refusal of 24 September 2019, it did not specify the FOIA exemption on which it was relying and it did not do so until 15 July 2022.

The appeal

[19]The appeal was an appeal against the Decision Notice pursuant to section 57 of FOIA.

Grounds of appeal

[20]Whilst we acknowledge all of the specific points made by the Appellant, their grounds of appeal were, so far as is material (and in summary), that:a. Section 40 of FOIA was not relevant to the Requested Information and did not apply; no individual could be identified in respect of the Second Part of the Request and FOIA was the least intrusive means of obtaining the information.b. The Authority was not entitled to rely on section 31(3) of FOIA, as there was no evidence of a crime - no action was taken by the Constabulary and no arrest was made. Rather, there was evidence of malicious behaviour on the part of the individual who made the call and it was prejudicial to the prosecution of offenders not to disclose the Requested Information. The only person who could be considered to have committed a crime was the person who placed the malicious call and therefore the reliance on section 31 of FOIA was ‘completely counterintuitive’.c. The Second Part of the Request “in no way related to a living individual” and therefore section 40 of FOIA was not a relevant exemption.d. The Authority did not rely on section 31(3) of FOIA at the time of its refusal of the Request. Indeed, it did not rely on this until years later, after its first reliance on section 40(2) of FOIA failed. It was not fair or lawful for the Authority to rely on a “non valid” exemption and then change to a different exemption later when that first attempt failed.e. No valid exemption was provided by the Authority.f. Confirming or denying whether the Requested Information is held would in no way harm or compromise the confidence of the public to supply information, as the call was malicious and there was no evidence of any crime (except for the person who placed the malicious call to the police).g. There was a clear public interest in disclosing the Requested Information, namely that the public are protected from malicious behaviour at all times. Indeed, it was important for the public to have confidence in the Constabulary and that vexatious and malicious calls will not be listened to.h. Disclosing that ‘it was not a member of my family who placed the call’ in no way had any possibility of identifying any living individual or deterring anyone from contacting the police. This was “a non-affirmative statement rather than an affirmative one”.i. There was no potential for any prejudice to occur and section of 31 of FOIA could not be engaged, as there was no evidence of any crime or investigation. Therefore it was impossible that disclosure would prejudice the prevention or detection of crime. The prejudice claimed was fanciful, when it must be real, actual or of substance.j. The FOIA route was the least intrusive means of obtaining the Requested Information, as instructing a solicitor would incur unnecessary costs and (as the Commissioner had attempted to argue) the Requested Information was not disclosable under the DPA in any event.[21]The Appellant also stated in their grounds of appeal that the Authority had tried to charge for the Request, whereas FOIA requests to public authorities that do not exceed £450 are not legally chargeable, and the Commissioner had failed to address this issue.

The Commissioner’s response

[22]In his response to the appeal, the Commissioner generally relied on the Decision Notice as setting out his findings and the reasons for those findings.[23]The Commissioner also stated that, on further review, he no longer considered that section 31(1)(g) of FOIA was engaged. In summary, the Commissioner stated that he was no longer satisfied that the Authority’s submissions sufficiently demonstrated, in the circumstances, that the Constabulary had the function to formally and conclusively determine whether an individual had failed to comply with the law or was responsible for conduct which is improper, or whether circumstances justifying regulatory action arose.[24]Rather, the Commissioner considered that section 30 of FOIA may have been the more appropriate exemption for the Authority to claim in the first instance in respect of both parts of the Request. The Commissioner stated that the Constabulary, as a police force, has a duty to investigate whether individuals should be charged with an offence; that is their primary purpose. In this case, the Commissioner was of the view that the police had presumably attended the incident with the view to investigating whether an offence was being or had been committed. On that basis, the Commissioner accordingly considered that the Requested Information would fall within section 30(1)(a)(i) of FOIA.[25]The Commissioner explained that, whilst section 30 of FOIA was not a prejudice-based exemption, it was subject to the Disclosure Public Interest Test and the Commissioner contended that the public interest favoured non-disclosure for the same reasons as set out in the Decision Notice regarding section 31 of FOIA.[26]The Commissioner further submitted, in respect of the Second Part of the Request, that the Authority would also have been able to rely on section 40(5B) of FOIA. The Commissioner considered that, in light of the nature of the incident, confirmation or denial as to whether the call had been placed by a family member would be very likely to lead to the identification of the caller and that, for the same reasons as set out in respect of section 40(2) of FOIA concerning the First Part of the Request, disclosure would be unlawful.

The Appellant’s reply

[27]In reply to the Commissioner’s response, the Appellant made various further submissions, including (in summary):a. The Commissioner should not be seeking to change the exemption relied on to section 30 of FOIA, and this had never been used by the Authority.b. Seeking to rely on a new exemption would seem to imply that the Commissioner is aware that the exemptions cited in the Decision Notice are erroneous and not lawful. Moreover, sections 30 and 31 of FOIA are mutually exclusive.c. The appeal was “not concerned in any way” with section 40 of FOIA, as confirming that it was not a member of their family who maliciously telephoned the police “in no way identifies a living individual”.d. Confirming or denying that it was not a member of their family who rang the police would not prejudice the Constabulary's ability to apprehend or prosecute offenders, as it would not provide any information about the caller. Therefore it would in no way inhibit individuals from contacting the Constabulary, as the information did not relate to a specific living individual.e. The Commissioner failed to provide any evidence to substantiate the alleged prejudice or a causal link between the disclosure and prejudice claimed. Accordingly, the duty to confirm or deny did arise.f. With regard to the Disclosure Public Interest Test, it was “very much” in the public interest that the information be disclosed, as the call was malicious. Malicious calls to the police pose a risk to individuals and a risk of being repeated and therefore is a genuine public interest in the information being disclosed, in order to protect other members of the public from the same malicious behaviour.g. For all of the above reasons, the Decision Notice was flawed, erroneous and unlawful. There was no valid reason or exemption under FOIA such that the Authority could not have confirmed that it was not a member of the Appellant’s family who placed the malicious call.[28]The Appellant also stated that public authorities have a duty to conduct themselves lawfully, fairly and in a transparent manner. They contended that the Authority “have at no time done this” and they referred to the Commissioner attempting to withhold and conceal information under rule 14 of the Tribunal Rules (by way of the provision of a closed bundle for use in the proceedings).[29]The Appellant also made some submissions to the effect that the Commissioner’s investigations leading to the Decision Notice were flawed. They also asserted that the Commissioner had failed to address the issue of the Authority failing to conduct an internal review and that, even if it could be said that it conducted an internal review on 15 July 2022 (as noted in paragraph 14), that was a delay of nearly three years.

The Appellant’s final submissions

[30]The Appellant also provided further submissions which, in summary, covered the following points:a. The Appellant reiterated their concerns about the conduct of the Authority and the Commissioner - including in respect of the inclusion of a closed bundle of evidence in the proceedings and claiming that some unredacted information in the closed bundle was illegible.b. The Appellant also made some submissions to the effect that the Commissioner’s investigations leading to the Decision Notice were flawed. They also asserted that the Commissioner had failed to address the issue of the Authority failing to conduct an internal review and that, even if it could be said that it conducted an internal review on 15 July 2022 (as noted in paragraph 14), that was a delay of nearly three years.c. The Appellant stated that there was dishonesty on the part of the Authority and/or the Commissioner, because there was a court hearing (as referred to in the Request), despite assertions to the contrary from the Authority. Also, despite claims from the Authority that the Independent Office for Police Conduct (IOPC) supported their actions, this was “most unequivocally” not the case.d. The Appellant had lost money awarded to them in connection with that court hearing as a direct result of the Authority’s failure to respond to the Request.e. The Appellant had suffered significant psychological distress as well as financial loss in connection with the Authority’s actions.

The Tribunal’s powers and role

[31]The powers of the Tribunal in determining this appeal are set out in section 58 of FOIA, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[32]In summary, therefore, the Tribunal’s remit for the purposes of this appeal is to consider whether the Decision Notice was in accordance with the law, or whether any applicable exercise of discretion by the Commissioner in respect of the Decision Notice should have been exercised differently. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. The law The relevant statutory framework General principles

The law

[33]Section 1(1) of FOIA provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[34]In essence, under section 1(1) of FOIA, a person who has requested information from a public authority (such as the Authority) is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, these entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) of FOIA provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[35]It is therefore important to note that section 1(1) of FOIA does not provide an unconditional right of access to any information which a public authority does hold. The right of access to information contained in that section is subject to certain other provisions of FOIA, which we address below.

Exemptions

[36]Section 2(1) of FOIA addresses potential exclusions to the duty (pursuant to section 1(1)(a) of FOIA) to confirm whether or not a public authority holds information. Section 2(1) of FOIA provides: “Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—(a) the provision confers absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.”.[37]Where any such exemption applies, it negates the duty of a public authority to confirm or deny whether or not it holds information which is requested. This means the public authority is permitted to neither confirm nor deny (sometimes known by the acronym ‘NCND’) whether or not it holds the requested information.[38]Section 2(2) of FOIA addresses potential exemptions to the duty (pursuant to section 1(1)(b) of FOIA) to provide information which is held by a public authority. Section 2(2) of FOIA provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[39]The effect of the above is that some exemptions set out in Part II of FOIA are absolute and some are subject to the application of a public interest test. Where an applicable exemption is not absolute and the public interest test applies, this means that (as applicable):a. a public authority may neither confirm nor deny whether or not it holds requested information under that exemption if the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether it holds the information (the NCND Public Interest Test);b. a public authority may withhold requested information under that exemption only if the public interest in doing so outweighs the public interest in its disclosure (the Disclosure Public Interest Test).[40]Section 2(3) of FOIA explicitly lists which exemptions in Part II of FOIA are absolute. Pursuant to that section, no other exemptions are absolute. For the purposes of this appeal, the relevant exemptions are sections 40(2), 31 and 30 of FOIA. Section 40(2) is included in that list, but only “so far as relating to cases where the first condition referred to in that subsection is satisfied”. Sections 31 and 30 are not included in that list.[41]Accordingly, in summary, the relevant exemptions referred to in the Decision Notice are as follows:a. section 40(2) of FOIA is an absolute exemption only in cases where a specific condition is satisfied (as referred to below) - otherwise the exemption is subject to the Disclosure Public Interest Test; andb. section 31 of FOIA is an exemption which is subject to the NCND Public Interest Test (not the Disclosure Public Interest Test, because the relevant issue in the Decision Notice related to the exclusion of the duty to confirm or deny pursuant to section 31(3) of FOIA).

Section 40 of FOIA

[42]So far as is relevant for the purposes of this appeal, section 40 of FOIA provides: “(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles… … (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles…”.[43]Section 40(7) of FOIA sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and therefore includes disclosure under FOIA;b. the “data protection principles” are those set out in Article 5(1) of the UK GDPR, and section 34(1) of the DPA. The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”; andc. a “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”.[44]To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f) of the UK GDPR).[45]Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) of FOIA provides that such exception is to be omitted for the purposes of section 40 of FOIA, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information by a public authority under FOIA.[46]The first recital to the UK GDPR is also relevant. This provides:
“The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.”
. The second recital to the UK GDPR also includes the following:
“The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”
.

Section 31 of FOIA

[47]So far as is relevantfor the purposes of this appeal, section 31 of FOIA provides:
“(1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— (a) the prevention or detection of crime, (b) the apprehension or prosecution of offenders, (c) the administration of justice, …(g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2),… (2) The purposes referred to in subsection (1)(g) to (i) are— (a) the purpose of ascertaining whether any person has failed to comply with the law, (b) the purpose of ascertaining whether any person is responsible for any conduct which is improper,… (3) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would, or would be likely to, prejudice any of the matters mentioned in subsection (1).”
.

Section 30 of FOIA

[48]So far as is relevant, section 30 of FOIA provides:
“(1) Information held by a public authority is exempt information if it has at any time been held by the authority for the purposes of— (a) any investigation which the public authority has a duty to conduct with a view to it being ascertained— (i) whether a person should be charged with an offence, or (ii) whether a person charged with an offence is guilty of it,… (2) Information held by a public authority is exempt information if— (a) it was obtained or recorded by the authority for the purposes of its functions relating to— (i) investigations falling within subsection (1)(a) or (b),… (3) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1) or (2).”
. Relevant case law Personal data and the legitimate interests basis

Relevant case law

[49]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[50]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last question of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[51]The approach set out above in the South Lanarkshire case was subsequently reiterated in the Upper Tribunal in the case of Goldsmith International Business School v Information Commissioner and Home Office [2014] UKAT 563 . In the Goldsmith case, Upper Tribunal Judge Wikeley also provided further helpful guidance relevant to this appeal, setting out various propositions derived from the relevant case law. We refer to those propositions in more detail below.[52]We should perhaps make it clear that the relevant test in this context, the Legitimate Interests Test, is different to the public interest tests arising under FOIA (namely the NCND Public Interest Test and the Disclosure Public Interest Test). As explained by Upper Tribunal Judge Kate Markus QC (now KC) in the case of Information Commissioner v Halpin [2019] UKUT 29, paragraph 29 :
“At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”
. FOIA creates a general right to information subject to the exemptions in section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”.”

Prejudice-based exemptions

[53]The exemptions under section 31 of FOIA use the terms ‘would’ and ‘would be likely to’ prejudice the relevant matters referred to in that section. This means that the prejudice in question is more probable than not or that there is a real and significant risk of it happening.[54]The following statement from a First-tier Tribunal case was subsequently confirmed by the Court of Appeal in the case of Department for Work and Pensions v Information Commissioner & Frank Zola [2016] EWCA Civ 758, paragraph 27 – see also Carolyne Willow v Information Commissioner and Ministry of Justice [2017] EWCA Civ 1876 at paragraph 27. as being the correct approach: “On the basis of these decisions there are two possible limbs on which a prejudice-based exemption might be engaged. Firstly, the occurrence of prejudice to the specified interest is more probable than not, and secondly there is a real and significant risk of prejudice, even if it cannot be said that the occurrence of prejudice is more probable than not.”.[55]Therefore for such exemption to apply, there must be some causative link between the potential disclosure of the relevant information and the prejudice to the commercial interests of a person (which may include the public authority in question). The prejudice must also be real, actual or of substance and it must relate to the interests protected by the exemption.

The public interest test

[56]In the case of O’Hanlon v Information Commissioner [2019] UKUT 34 (AAC), paragraph 15. , it was held that the public interest test under FOIA (for the purposes of this appeal, the NCND Public Interest Test and the Disclosure Public Interest Test) required the following three-step approach: “The first step is to identify the values, policies and so on that give the public interests their significance. The second step is to decide which public interest is the more significant. In some cases, it may involve a judgment between the competing interests. In other cases, the circumstances of the case may(a) reduce or eliminate the value or policy in one of the interests or(b) enhance that value or policy in the other. The third step is for the tribunal to set out its analysis and explain why it struck the balance as it did. This explanation should not be difficult if the tribunal has undertaken the analysis in the first two steps properly. It may even be self-evident.”.[57]The public interest test under FOIA is applied as at the time when the public authority refused disclosure of requested information; it cannot be re­assessed later, in the event of an appeal to the First-tier Tribunal, by reference to any public interest which has subsequently arisen (see, for example, the case of Maurizi v Information Commissioner and another [2019] UKUT 262 (AAC), paragraphs 181-1 84 ).

Timing of reliance on exemptions/exclusions

[58]The Upper Tribunal held in the case of DEFRA v Information Commissioner and Simon Birkett [2011] UKUT 39 (AAC) (also dealing with an appeal brought by the Information Commissioner, challenging the First-tier Tribunal’s decision under reference EA/2010/0011 that the Home Office was entitled to rely on new exemptions under FOIA). The Upper Tribunal’s decisionin the Birkett case was upheld in the Court of Appeal, in respect of the Environmental Information Regulations 2014- Birkett v Department for the Environment, Food and Rural Affairs (DEFRA)[2011] EWCA Civ 1606. that a public authority is entitled to rely on new exemptions in an appeal before the First-tier Tribunal. This is so even if those exemptions have not been raised by the public authority at an earlier stage (whether in its response to a request for information under FOIA, any subsequent review of that response or in its subsequent dealings with the Commissioner when the Commissioner is investigating a complaint relating to that request).

The pleadings and evidence

[59]The Tribunal read and took account of an open bundle of evidence and pleadings. We also read and took account of two closed bundles. One of the closed bundles contained certain information which had been redacted in the open bundle but also provided to the Appellant in unredacted format (with certain extracts remaining redacted). The second closed bundle contained those extracts in unredacted format (and was not provided to the Appellant). Discussion and findings; application of the law Outline of relevant issues

Discussion and findings; application of the law

[60]The primary matters before us to determine, having regard to the findings in the Decision Notice, were:a. whether the Requested Information under the First Part of the Request constituted the personal data of a third person, so that section 40(2) of FOIA was engaged;b. if section 40(2) of FOIA was engaged, was it an absolute exemption or did the Disclosure Public Interest Test apply;c. if section 40(2) of FOIA was engaged and the Disclosure Public Interest Test did apply, then whether, in all the circumstances, the public interest in maintaining the exemption outweighed the public interest in disclosing the relevant Requested Information;d. whether section 31(3) of FOIA was engaged in respect of the Requested Information under the Second Part of the Request;e. if section 31(3) of FOIA was engaged, then whether, in all the circumstances, the public interest in maintaining the exclusion of the duty to confirm or deny outweighed the public interest in disclosing whether the public authority holds the relevant Requested Information.[61]We address those issues below, after some preliminary points.

Remit of the Tribunal

[62]As we have noted, some of the Appellant’s grounds of appeal and subsequent submissions relate to the conduct of the Authority, as well as the Commissioner’s investigation of the Appellant’s complaint, leading up to the Decision Notice.[63]The scope of the Tribunal’s jurisdiction is as set out in paragraph 31 (and summarised in paragraph 32) and, in essence, relates to the lawfulness of the Decision Notice. Accordingly, other issues are beyond the Tribunal’s powers to determine and fall outside of the scope of the appeal.[64]Therefore the Tribunal’s jurisdiction does not extend to matters such as any allegations relating to misconduct, dishonesty, impropriety or other wrongdoing by the Authority. Accordingly, we have no power to consider or determine any such issues.[65]Likewise, the appeal cannot extend to matters regarding the conduct of the Commissioner’s investigation prior to the issue of a decision notice under section 50 of FOIA. Put another way, the Tribunal does not conduct a judicial review of the Commissioner’s activities. It is therefore outside of our remit to consider, or make any finding in respect of, the Commissioner’s conduct of his investigation leading to the Decision Notice.[66]However, as we have noted, the Tribunal may review any relevant findings of fact in the Decision Notice and may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned). That is what we have done.

Rule 14 of the Tribunal Rules

[67]The Appellant also alleged that the Commissioner had attempted to withhold and conceal information under rule 14 of the Tribunal Rules. Rule 14 of the Tribunal Rules provides a mechanism to enable relevant information which is withheld from disclosure to be considered by the First-tier Tribunal as part of its determination of an appeal. Obviously, it would defeat the purpose of the proceedings if information which was requested from a public authority and which was the subject of an appeal were to be disclosed to the requestor before the appeal had been determined by the First-tier Tribunal.[68]Given the above, there was nothing untoward regarding the Commissioner’s application for certain information to be withheld from disclosure to the Appellant pursuant to rule 14 of the Tribunal Rules and the Appellant’s allegations in that regard have no valid basis.[69]We could not identify any legibility problems in the unredacted contents of the closed bundle which was provided to the Appellant. Accordingly, we find that the Appellant was not prejudiced, as they alleged, regarding the purported illegibility of elements of that closed bundle. Charging for dealing with

The Request

[70]The Appellant stated in their grounds of appeal that the Authority had sought to charge for responding to the Request and that the Commissioner had failed to address this issue. However, we found no evidence that the Authority had sought to levy any such charge.

Reliance on new exemptions

[71]As we have noted (paragraph 58), even if a public authority does not rely on certain exemptions when refusing a request for information under FOIA (or on any subsequent internal review by it), it is entitled to rely on new exemptions in respect of an appeal before the First-tier Tribunal. This is also the case in respect of the public authority’s dealings with the Commissioner prior to the issue of the Decision Notice.[72]Whilst we understand the Appellant’s frustrations regarding the change in the Authority’s position regarding the exemptions being relied on, it was nevertheless lawful for it to rely on new exemptions, even at a late stage.

Alleged losses and distress of the Appellant

[73]The Appellant stated in their final submissions that they had suffered financial loss and psychological distress in connection with the Authority’s failure to respond to the Request. For the reasons already given, any such alleged losses and damage fall outside of the scope of the appeal and the Tribunal has no jurisdiction in respect of any such matters.

Was section 40(2) of FOIA engaged?

[74]In considering this issue, we focus only on the First Part of the Request.[75]As we have outlined: Paragraphs 42 to 44, and paragraphs 49 and 50.a. requested information is exempt from disclosure under FOIA if it constitutes the personal data of someone other than the requester and a specified condition is satisfied;b. one such condition is that the disclosure of the information would contravene any of the data protection principles;c. one of the data protection principles is that personal data shall be processed lawfully;d. to be lawful, the processing must meet one of the bases for lawful processing set out in the UK GDPR;e. one such lawful basis is the Legitimate Interests Basis;f. the Legitimate Interests Test must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario.[76]It may be helpful to reiterate the Legitimate Interests Basis. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”
. Translating that language to the context of the appeal: a. the disclosure of the relevant Requested Information would be ‘processing’; b. the Appellant would be the ‘third party’; and c. the individual who placed the call, as referred to in the First Part of the Request, would be the ‘data subject’.[77]We are satisfied that the First Part of the Request (requesting the identity of a caller to the Constabulary) related to the personal data of a third party and consequently that this engaged section 40(2) of FOIA. We also find that:a. the most relevant data protection principle is that set out in Article 5(1)(a) of the UK GDPR, relating to (amongst other things) personal data being processed lawfully;b. in considering whether the processing of the personal data in question is lawful, the only applicable lawful basis for processing is the Legitimate Interests Basis (the only other potentially applicable lawful basis would be that of ‘consent’ and the caller has not consented to their personal data being disclosed) This position is also supported by case law (see, for example:Christie v InformationCommissioner [2022] UKUT 315 (AAC), paragraph 3; Myhill v Information Commissioner [2022] UKUT207 (AAC), paragraphs 45-46.See also (whilst not binding on us) the First-tier Tribunal decision in the case of Illsley v Information Commissioner [2023] UKFTT207 (paragraph 21) dismissing an argument that Article 6(1)(e) of the UK GDPR (the ‘public task’ lawful basis)provided an alternative basis for disclosure under FOIA. ; andc. accordingly, the Legitimate Interests Test is applicable.[78]We therefore turn to the Legitimate Interests Test. Given the legal framework which we have outlined above, we consider that it is helpful to address the propositions from the Goldsmith case which we briefly noted above. As mentioned, in that case Upper Tribunal Judge Wikeley listed (from paragraph 35 onwards) various propositions derived from case law as to the correct approach to be adopted. We set out seven of those propositions below (some of which we paraphrase or otherwise summarise) and we address each in turn with regard to the facts of this appeal. For completeness, we should mention that Judge Wikeley also referred to an eighth Proposition in the Goldsmith case, but this related to tests which were applied in relevant case law and which does not alter the other seven propositions we refer to.[79]Applying the propositions is not a sequential process, in that some later numbered propositions need to be considered and determined before returning to earlier numbered propositions. Moreover, some earlier numbered propositions may be superfluous after applying later numbered propositions.[80]Proposition 1: The three questions set out in the South Lanarkshire case (as we have addressed above – namely, the Legitimate Interests Test) must be applied. Consequently:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? In this case, it would be the Appellant to whom the relevant personal data is disclosed. The Appellant’s aims in seeking the Requested Information in the First Part of the Request include, in essence, to ensure that alleged wrongdoing is identified and that there is accountability where appropriate. Our view is that such aim is legitimate and hence that there are legitimate interests being pursued by the Appellant by way of the First Part of the Request.b. Is the processing involved necessary for the purposes of those interests? In order to address this, we need to turn to Propositions 3 to 5 (inclusive), which we do below.c. Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? Given Proposition 2, we do not address this question at this stage, but comment on this later.[81]Proposition 2: The test of “necessity” under the second of those questions must be met before the third question can be considered. Again, this requires us to turn to Propositions 3 to 5 (inclusive).[82]Propositions 3 to 5 (inclusive) all relate to the concept of ‘necessity’ and so we group them together before commenting on them:a. Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less thanindispensable or absolute necessity.b. Proposition 4: It follows that the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality (albeit this may not add much to the ordinary English meaning of ‘necessity’).c. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.[83]With regard to those three propositions, we note that Lady Hale, in the South Lanarkshire case, stated that the word “necessary” must be considered in relation to the processing to which it relates.[84]We also note that, in the Halpin case paragraph 31 , Upper Tribunal

Judge Kate Markus QC (now KC) stated that:

“the Goldsmith guidance…makes it clear that the question whether there are alternative measures (proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it…”
[85]In the more recent case of Kol v Information Commissioner and Reigate and Banstead Borough Council [2022] UKUT 74 , Upper Tribunal Judge Edward Jacobs stated paragraph 22 : “If there is another way of satisfying [the requestor’s] legitimate interests without disclosing the information, then disclosure is not necessary”.[86]It is helpful to remind ourselves of the relevant wording from Lady Hale’s judgment in the South Lanarkshire case paragraph 27 , in respect of which Upper Tribunal Judge Edward Jacobs was commenting and which is the authoritative decision on the meaning of ‘necessary’ for current purposes: “It is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15, [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”.[87]We consider that these principles (together with others from additional cases cited in the Goldsmith case) are encapsulated in the three propositions (namely, Propositions 3, 4 and 5). In our view, therefore (and taking into account the above comments of Upper Tribunal Judge Kate Markus KC in the Halpin case), we need to consider all three of those propositions in assessing whether or not the processing (disclosure) of the personal data of the caller was necessary for the purposes of the legitimate interests being pursued by the Appellant by way of the First Part of the Request.[88]As noted, the legitimate interests being pursued by the Appellant include, essentially, for alleged wrongdoing to be identified and for there be accountability where appropriate. In the context of this appeal, we find that it is not necessary (within the meaning outlined in all three of those propositions) for the personal data in question to be disclosed in order to achieve those legitimate interests. In our view, those legitimate interests are fulfilled by the powers already available to the police to investigate and, if appropriate, take action in respect of the alleged wrongdoing (the alleged malicious call) if, for example, the call amounted to wasting police time. Further, the Appellant does not have any such power or authority, so that giving them information regarding the caller would not actually serve to fulfil the interests being pursued by the Appellant (in that it would not result in any accountability).[89]We recognise that the Appellant may consider that the Constabulary is disinterested in pursuing the possibility of a malicious call being placed (although we form no view on this either way). However, as we have already noted, it is not the role of the Tribunal to ascertain or opine on the role of the Constabulary/Authority or the actions it may or may not take. However, the mere existence of the powers available to the police to investigate and, if appropriate, take action in respect of any alleged malicious call is germane to our assessment of the Legitimate Interests Basis and the relevant legal principles and tests we have referred to.[90]As we have explained, the remit of the Tribunal is to determine whether or not the Decision Notice was in accordance with the law. In this regard, we remind ourselves that when a third party’s personal data is involved in respect of any request for disclosure of information under FOIA:a. the starting point (in accordance with the legislation and case law we have referred to) is the principle of the protection of privacy with respect to the processing of personal data; andb. disclosure of personal data must be necessary, within the meaning outlined in the three propositions we have referred to, for the purposes of the legitimate interests being pursued with regard to such request for disclosure.[91]In addition, as set out in Proposition 5 (and taken from the judgment of Lady Hale in the South Lanarkshire case):
“a measure would not be necessary if the legitimate aim could be achieved by something less”
. The fact that there is something less which can achieve the Appellant’s legitimate aims is a material point in this appeal. Again, it is not for the Tribunal to determine the merits of, or other matters pertaining to, the powers of the police as that ‘lesser means’, but rather for us to take into account in our decision making (as part of our assessment of ‘necessity’, as we have outlined) whether or not there are other means by which those legitimate aims could be achieved - which there are.[92]The Appellant asserted, in their grounds of appeal, that disclosure of the Requested Information via FOIA was the “least intrusive” means of obtaining the information on the basis that instructing a solicitor would incur unnecessary costs The Appellant also stated that a related point was that the Commissioner had argued that the Requested Information was not disclosable under the DPA. However, that was because the information related to the personal data of a third party and so could not be provided to the Appellant by way of subject access request under the DPA (and which is why the Legitimate Interests Test is applicable as outlined here). . However, that argument relates to the potential costs to the Appellant, rather than the aims which are being pursued by them - and it is the aims which are relevant for the purposes of the Legitimate Interests Test.[93]Having determined that there is another means of satisfying the Appellant’s legitimate aims, it would be wrong for us to then decide that an individual’s personal data should need to be disclosed as an alternative means of satisfying those aims. Such a conclusion would, in our view, be contrary to the legal tests of ‘necessity’ and the principles of privacy and protection of personal data we have referred to.[94]Having concluded that there is ‘something less’ available than disclosure of a data subject’s personal data in order to satisfy the legitimate interests of the Appellant, it follows that we do not need to go on to consider the Balancing Test.[95]At this juncture, we should return toProposition 2. As we have noted, this requires the test of “necessity” under the second of the questions in Proposition 1 to be met before the third of those questions can be considered. Given our finding that the processing involved is not necessary for purposes of the legitimate interests being pursued by the Appellant (that is, our answer to the second question is negative) then, in accordance with Proposition 2, we do not need to consider the third of the questions in Proposition 1. In other words, as we have reached the conclusion that, for the purposes of section 40(2) of FOIA and the first condition in section 40(3A) of FOIA, the disclosure of personal data is not necessary and therefore the Legitimate Interests Basis is not satisfied, we do not need to go on to consider the Balancing Test between the legitimate interests of the Appellant and the rights and freedoms of the data subject in question.[96]Proposition 6: Where there are no issues regarding an individual’s privacy rights, the question posed under Proposition 1 can be resolved at stage (ii) of the three-part test referred to (that is, the question can be resolved at the ‘necessity’ stage of the Legitimate Interests Test). Clearly, this appeal involves issues regarding the privacy rights of an individual (namely, the privacy rights of the person who made the call in question) and therefore Proposition 6 is not applicable here (we cannot resolve the question posed under Proposition 1 at stage (ii) of the Legitimate Interests Test).[97]Proposition 7: Where there are issues regarding an individual’s privacy rights, the question posed under Proposition 1 can only be resolved after considering stage (iii) of the three-part test referred to - namely, the Balancing Test. For the reasons given, this appeal involves issues regarding the privacy rights of an individual (the person who made the call). However, as we have stated, given the application of Proposition 2 and our findings on ‘necessity’, we do not need to consider the Balancing Test. Accordingly, Proposition 7 becomes redundant in the context of this appeal.[98]For all of the above reasons, we find that section 40(2) of FOIA was engaged in respect of the First Part of the Request and that the first condition referred to in section 40(2)(b) is satisfied. If section 40(2) of FOIA was engaged, was it an absolute exemption or did the Disclosure Public Interest Test apply?[99]Given our finding in paragraph 98, it follows that the exemption in section 40(2) of FOIA is an absolute one. Accordingly, the Disclosure Public Interest Test does not apply and we do not need to go on to consider it.

Was section 31(3) of FOIA engaged?

[100]In considering this issue, we focus only on the Second Part of the Request.[101]So far as is relevant for this appeal, the Authority could (pursuant to section 31(3) of FOIA) have refused to confirm or deny if it held the Requested Information if doing so would have, or would have been likely to, prejudice: the prevention or detection of crime, the apprehension or prosecution of offenders or the administration of justice.[102]As we have noted, the Appellant has argued that if the Authority confirmed only that the caller was not a member of their family, this would not constitute personal data on the basis that it would not identify anyone, or be capable of identifying anyone. We do not accept that argument, for the following reasons.[103]If, in the current case, for example (and we stress that this is a hypothetical scenario), the Appellant knew that the person placing the call could only be either a member of their family or one other person, then if the Authority were to confirm that the caller was not a member of their family then of course this would identify the only other person as therefore being the caller. Likewise (and again this only a hypothetical example), if the Appellant knew that, of all their family members, it could only be one of them who placed the call, then if the Authority were to confirm that the caller was a member of their family then of course this would also identify the caller. It is in such situations where neither confirming nor denying whether certain information is held could be the most appropriate response for a public authority.[104]It should also be remembered (see paragraph 43.a), that in order to constitute personal data, the information in question is not limited to information which itself identifies an individual but it also includes information which is capable of identifying them (makes them ‘identifiable’).[105]The purpose of a response to neither confirm nor deny whether or not any requested information is held is to leave entirely open the position about whether a public authority holds that information, so that no inferences can be drawn from an acknowledgement of the fact that information is held or not held. In that context, sometimes it is appropriate for a public authority to give a ‘neither confirm nor deny’ response based on theoretical considerations of what would be revealed by a confirmation or denial and the implications of this, without the public authority even needing to first ascertain itself if it holds the information.[106]In our view, if the Authority were to provide information about the caller (which, for the reasons above, could occur by simply confirming or denying if it held the relevant Requested Information) then this would be likely to inhibit individuals from contacting the Constabulary or the police in general. Disclosure under FOIA is, in effect, disclosure to the world at large and we consider that it is self-evident that members of the public who call the police regarding an incident would not want the world at large to know that they had done so and, if they considered that would happen under FOIA, it would be likely to prevent them from doing so. It follows that if members of the public are unlikely to report incidents to the police then it is likely that the Constabulary’s ability to apprehend offenders would be prejudiced.[107]The Appellant also argued that the Authority was not entitled to rely on section 31(3) of FOIA on the basis that there was no evidence of a crime, stating that no action was taken by the Constabulary pursuant to the call and no arrest was made. However, it does not matter whether or not there was a crime – the relevant issue is whether or not it is likely that there would be prejudice to the Constabulary’s ability to apprehend offenders generally (not just in connection with the call which was made).[108]Whilst the Commissioner, in his response to the appeal, stated that he no longer considered that section 31(1)(g) of FOIA was engaged, that section is only relevant in the appeal as one of the matters which is applicable for reliance on section 31(3) of FOIA in respect of the potential exclusion of the duty to confirm or deny (as section 31(3) of FOIA refers to prejudice to any of the matters set out in section 31(1) of FOIA). Section 31(3) of FOIA only requires that there be prejudice to any of those matters, which include (aside from section 31(1)(g) of FOIA) the prevention or detection of crime and the apprehension or prosecution of offenders – and which we find are applicable for the reasons we have given. We also remind ourselves that the Decision Notice correctly identified the ability to apprehend or prosecute offenders as a relevant matter for the purposes of engaging section 31(3) of FOIA.[109]We therefore find that section 31(3) of FOIA is engaged in respect of the Second Part of the Request. As that section is not an absolute exemption, we turn to consider the NCND Public Interest Test. In all of the circumstances, did the public interest in maintaining the exclusion of the duty to confirm or deny outweigh the public interest in disclosing whether the relevant Requested Information was held?[110]In our view, the Appellant’s interests in seeking the Requested Information included personal reasons (including linked to their interest in the court case referred to in the Request). However, we do not agree with the Commissioner’s position that the Appellant’s interests in the matter were only personal interests. As we have referred to in the context of the Legitimate Interests Test, the Appellant was also interested in any alleged wrongdoing to be identified and for there be accountability where appropriate (in the context of malicious calls being made to the police). Therefore we consider that there are some broader public interest factors which weigh against maintaining the exclusion of the duty to confirm or deny.[111]On the other hand, for the reasons we have given, confirming or denying whether the relevant Requested Information was held could discourage people from voluntarily providing information to the Constabulary and the wider police service. This is a factor which weighs against the public interest in disclosing whether or not the Authority holds the Requested Information.[112]On balance, we find that there is a far greater public interest in ensuring that members of the public are not deterred from contacting the police. In part, this is because the public interest referred to in paragraph 110 can still be realised by other means, for the same reasons we have referred to in respect of the Legitimate Interests Test.[113]Accordingly, in applying the NCND Public Interest Test, we find that, in all of the circumstances, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the Authority holds the relevant Requested Information. On that basis, the Commissioner was correct to conclude in the Decision Notice that the Authority was entitled to neither confirm nor deny holding the relevant Requested Information.

Were any other exemptions engaged?

[114]We note that the Commissioner, in his response to the appeal, considered that section 30 of FOIA may have been the more appropriate exemption for the Authority to claim in the first instance in respect of both parts of the Request. The Commissioner further submitted, in respect of the Second Part of the Request, that the Authority would also have been able to rely on section 40(5B) of FOIA to refuse to confirm or deny whether or not the relevant Requested Information was held, as to do so would disclose the personal data of a third person.[115]We should stress that those views were put forward by way only of submissions and was not a view held within the Decision Notice itself. It is not permissible for the Commissioner to change the content of the Decision Notice once it is issued, and it is the Decision Notice which we need to consider for the purposes of the appeal.[116]We would observe, in passing, that:a. section 30 of FOIA could have been an appropriate exemption to be relied on by the Authority, given the role of the Constabulary as a police force and given the nature of the Request; andb. section 40(5B) of FOIA could have been an appropriate exclusion of the duty to confirm or deny whether or not the Requested Information in the Second Part of the Request was held, linked to the issues we have referred to regarding disclosure of the personal data of a third person.[117]However, given our other findings above, it has not been necessary for us to consider whether or not any other exemptions were engaged.

Section 17

[118]For completeness, we would also note that we agree with the Commissioner’s conclusion in the Decision Notice that the Authority’s refusal notice did not meet the requirements of section 17(1) of FOIA, on the basis that, in its refusal of 24 September 2019, it did not specify the FOIA exemption on which it was relying and it did not do so until 15 July 2022.

Final conclusions

[119]For all of the reasons we have given, we find that the Commissioner was correct to conclude in the Decision Notice that the Authority could rely on section 40(2) of FOIA to withhold the Requested Information in respect of the First Part of the Request and could rely on section 31(3) of FOIA to refuse to confirm or deny if it held the Requested Information in respect of the Second Part of the Request. We are accordingly satisfied that the Decision Notice did not involve an error of law.[120]We therefore dismiss the appeal.