Peter Cleasby v The Information Commissioner [2024] UKFTT 89 (GRC)

Case Reference: EA-2023-0310[2024] UKFTT 00089 (GRC)
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 9 January 2024Date 29 January 2024
Information Rights
Heard: On the papers
Promulgated on: 30 January 2024
Before
TRIBUNAL Judge BUckleyTRIBUNAL MEMBER ANNE chaferTRIBUNAL MEMBER susan wolf
Between
PETER CLEASBYAppellantThe Information commissionerRespondentDecision: The appeal is allowed.Substituted Decision Notice:Organisation: The Governing Body of the University of ExeterComplainant: Mr Peter CleasbyThe Substitute Decision –IC-221258-X6G7

Signed Sophie Buckley Date: 29 January 2024

[1]For the reasons set out below The Governing Body of the University of Exeter was not entitled to rely on section 40(2) or section 41 to withhold the information requested in part 2 of the request, or to redact that information (or related identifying information such as job titles/roles) from the information released in response to part 5 of the request.[2]The part of the Commissioner’s decision notice relating to the name of the Chair was not subject to appeal and remains in force.[3]A copy of this decision shall be sent to the public authority by the tribunal.[4]The public authority shall disclose the information requested in part 2 of the request to the requestor within 42 days of the date this decision is sent to the public authority by the tribunal.[5]Any failure to abide by the terms of the tribunal’s substituted decision notice may amount to contempt which may, on application, be certified to the Upper Tribunal. REASONS

Introduction

[1]The parties and the tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of the Chamber’s Procedure Rules.[2]This is an appeal against the Commissioner’s decision notice IC-221258-X6G7 of 1 June 2023 which held that The Governing Body of the University of Exeter (‘the University’) was entitled to rely on section 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold the majority of the requested information. The Commissioner decided that the University was not entitled to rely on section 40(2) or section 41 in relation to the name of the Community Panel Chair. The Commissioner required the University to disclose the Chair’s name in the redacted Community Panel minutes.

Factual background to the appeal

[3]This matter relates to two University groups, the Exeter Community Panel and the Resident Liaison Group.[4]The aim of the Community Panel is to help the University to identify local issues, challenges and opportunities, and to engage with the local community and be more responsive to the needs of all social groups. The purpose of the Resident Liaison Group is to liaise with community representatives and other partners to take stock of concerns and queries relating to University/Community relations and to explore strategies that aim to improve specific concerns in partnership with other agencies. Requests, decision notice and appeal The request

Requests, decision notice and appeal

[5]This appeal concerns the following request made on 31 October 2022 by Mr Cleasby:
“I would be grateful for the following information about (a) the Community Panel, chaired by the Registrar, and highlighted in the latest “Community” newsletter, and (b) the Resident Liaison Group also referred to in the newsletter. For each body: 1 Its terms of reference 2 The names of its members, and which organisation/interest each member represents 3 How its members were selected 4 The duration of members’ appointments 5 The agenda and minutes of all meetings held to date 6 How the effectiveness of the body is assessed 7 The annual running costs of the body.”

For each body:

[6]In this decision the tribunal refers to the numbered parts of the request as ‘part 1’, ‘part 2’ etc. This appeal relates only to part 2 of the request.

The response

[7]On 23 November 2022 the University responded to the request. It provided the information requested in parts 1, 3, 4, 5 6 and 7. It withheld the information requested in part 2, relying on section 40(2) (personal data) and section 41 (confidential information). The University upheld its position on internal review.[8]Mr. Cleasby referred the matter to the Information Commissioner on 13 March 2023.

The Decision Notice

[9]The Commissioner noted that the Community Panel is made up of members of University staff and local residents. The Resident Liaison Group is made up of members of University Staff, representatives from Exeter City Council (ECC) and Devon and Cornwall Police and local residents. The University also confirmed that local residents attend the meetings simply because they are local residents; they don’t represent any organisation or interest (other than their own interest as a local resident).[10]The Commissioner was satisfied that the requested information was the data subjects’ personal data.[11]The Commissioner considered that the complainant had a legitimate interest and that there was a degree of wider public interest in this information that would be met through disclosure. Disclosure would provide transparency about precisely whose views and interests the University takes into account when it makes decisions.[12]The Commissioner accepted that the local residents who were members of the two groups and who were simply members of the public might reasonably expect that their personal data wouldn’t be disclosed to the wider world under FOIA and that disclosing it would therefore cause them distress. This was particularly the case given that their names and contributions might be discussed, perhaps critically, on a website with which the complainant was associated.[13]The Commissioner considered that the legitimate interest in transparency had been sufficiently met through the information that the University had released and considered it was sufficient to know that the two groups in question comprise local residents, members of University staff, the ECC and the police and that it is those organisations and interests that are represented. Knowing the names of the specific individuals doesn’t add any further insight.[14]The Commissioner considered that there was insufficient legitimate interest to outweigh the fundamental rights and freedoms of the members of Community Panel and Resident Liaison Group who were local residents and the majority of the members who were representatives of the University, and the representatives of the ECC and police.[15]The Commissioner considered that the Community Panel Chair might reasonably expect that their name would be disclosed in response to a FOIA request. Disclosing their name would therefore be fair and lawful and transparent.[16]The Commissioner did not consider section 41.

Notice of Appeal

[17]In summary, the grounds of appeal are (numbering inserted by the tribunal): Ground One That it is in the public interest to know who is purporting to advise the University on behalf of the public. Ground Two The Commissioner was influenced in reaching his decision by inaccurate and unsubstantiated opinions by the University about the complainant.[18]Although there is no public interest balance under section 40(2), the tribunal understands ground 1 to be, in essence, that the Commissioner was wrong to conclude that the legitimate interests in disclosure were overridden by the interests or fundamental rights and freedoms of the data subjects.[19]As this is a full merits appeal, ground two will be subsumed in our consideration of the appeal in any event. We are not bound to take account of matters taken into account by the Commissioner.

The Commissioner’s response

[20]The Commissioner points out that he found in Mr. Cleasby’s favour in relation to whether disclosure was necessary for the purposes of a legitimate interest.[21]The Commissioner submits that: 21.1. The University’s response to part 3 of the request explained that there are nine members of the Community Panel who represented six wards from across the city (Exeter). The University further explained that members of the RGL comprise of representatives from Resident's Associations, City and Council Councillors (who often represent feedback and comment from individuals that are not associated with a Resident's Association), City Council staff and Devon and Cornwall Constabulary's Neighbourhood Beat Manager for the University area and the University’s staff. 21.2. It is not clear to the Commissioner how ‘community characteristics’ can be accurately discerned by disclosing the names of members of both groups. 21.3. The minutes and agendas disclosed in response to part 5 of the request, reveal the manner in which members of both groups’ views are communicated and modulated. 21.4. The identity of the Chair of the Community Panel has been disclosed.[22]To the extent that any level and function of the representative members of the RLG has been redacted from the minutes and agendas disclosed in response to part 5 of the request, this did not form part of the Commissioner’s conclusions in his DN.[23]The Commissioner notes that the University has been slightly inconsistent with regards to whether all members of both groups consented to the disclosure of their personal data in response to the Appellant’s request. The University’s internal review outcome stated that “consent was not provided by the members for their personal data to be processed.” Whereas in its further submissions to the Commissioner dated 19 May 2023, the University stated, “not all [members] have given permission for their names and comments to be made public.”[24]The Commissioner considers that the University is best placed to comment on the Appellant’s reference in paragraph 5(a) of the Grounds of Appeal to representatives as opposed to individual members of the public in the RLG in respect of their expectations of privacy.[25]The Commissioner submits that he was entirely correct to rely upon the University’s representations to him during the course of his investigation.

Mr. Cleasby’s reply

[26]Mr. Cleasby submits that the members of the groups volunteered for what is a form of public service with a public body on behalf of their community. In doing so, they would, or should, have realised that public service, particularly where this involves the influencing of decisions by public bodies, is accompanied by a degree of public accountability. The proposition that these are “simply members of the public” cannot be sustained since they have volunteered for the work, undergone a selection procedure and been appointed to a body that the University publicises as an example of its commitment to community engagement. The Commissioner comments that “disclosure would therefore cause them distress” but does not clearly explain his reasoning.[27]Mr. Cleasby submits that the Commissioner was not entitled to take what the University said about the website at face value.[28]Mr Cleasby submits that the requested information will add materially to what has already been disclosed:a. Different parts of the city have different characteristics. For example, some are well-heeled, others suffer deprivation. Political allegiances, evidenced by ward voting figures, are increasingly diverse. A few parts of the city, again identifiable, are heavily populated by students (which can lead to town v gown tensions).b. Which part of the city a member of the groups (the Residents Liaison Group and the Community Panel) come from is likely to influence their views. He notes that the University has stated that there are 9 Community Panel members who represent 6 wards from across the city: but we do not know which are the 6 wards - out of 13 wards – nor why some of them appear to have more than one representative.c. Knowing which civil area-based organisations are represented in the groups is an important means of analysing their effectiveness as representative of the social mix that goes to make up Exeter.d. For this analysis to work it is necessary to know who said what at the meetings and the redacted minutes prevent this understanding.

Evidence

[29]We read an open and a closed bundle.[30]The closed bundle contained the withheld information, and unredacted versions of open documents where the withheld information had originally been redacted.[31]It is necessary to withhold the above closed information from Mr. Cleasby because it consists of the withheld information and to do otherwise would defeat the purpose of the proceedings. Legal framework Personal data

Legal framework

[32]The relevant parts of section 40 of FOIA provide:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) It constitutes personal data which does not fall within subsection (1), and (b) either the first, second or the third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act - (a) would contravene any of the data protection principles... …[33]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA): (2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of X.[34]The data protection principles are set out Article 5(1) of the UKGDPR. Article 5(1)(a) UKGDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[35]The only potentially relevant basis here is article 6(1)(f):
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”
[36]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows: 1. Is the data controller or a third party pursuing a legitimate interest or interests? 2. Is the processing involved necessary for the purposes of those interests? 3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[37]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: “27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “[38]Section 40(2) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

Section 41

[39]Section 41 provides, so far as relevant:
“S 41 – Information provided in confidence (1) Information is exempt information if – (a) it was obtained by the public authority from any other person (including another public authority), and (b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.”
[40]The starting point for assessing whether there is an actionable breach of confidence is the three-fold test in Coco v AN Clark (Engineers) Ltd [1969] RPC 41, read in the light of the developing case law on privacy: 40.1. Does the information have the necessary quality of confidence? 40.2. Was it imparted in circumstances importing an obligation of confidence? 40.3. Is there an unauthorised use to the detriment of the party communicating it?[41]The common law of confidence has developed in the light of Articles 8 and 10 of the European Convention on Human Rights to provide, in effect, that the misuse of ‘private’ information can also give rise to an actionable breach of confidence. If an individual objectively has a reasonable expectation of privacy in relation to the information, it may amount to an actionable breach of confidence if the balancing exercise between article 8 and article 10 rights comes down in favour of article 8.[42]Section 41 is an absolute exemption, but a public interest defence is available to a breach of confidence claim. Accordingly there is an inbuilt balancing of the public interest in determining whether or not there is an actionable breach of confidence. The burden is on the person seeking disclosure to show that the public interest justifies interference with the right to confidence.

The role of the tribunal

[43]The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[44]The issues for the tribunal to determine are: 44.1. Is the data controller or a third party pursuing a legitimate interest or interests? 44.2. Is the processing involved necessary for the purposes of those interests? 44.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

Discussion and conclusions

[45]It is not in dispute that the information is personal data.

Legitimate interest

[46]We accept that there is a legitimate interest in transparency about precisely whose views and interests the University takes into account when it makes decisions. We accept that there is a legitimate interest in knowing how broad a spectrum of locations and community characteristics are represented. It is not possible to determine which locations and community characteristics are represented simply from the list of names, but it may be possible to ascertain that from publicly available information if, for example, those individuals already have a public profile. We accept that there is a legitimate interest in the seniority, access and influence of the public sector members of the groups.

Reasonable necessity

[47]We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interests. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least intrusive means of achieving the legitimate aim in question, because it would not be reasonably necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subjects.[48]It is not possible to achieve transparency in relation to precisely whose views and interests the university takes into account, the level of seniority, access and influence of the public sector members and the locations and community characteristics without knowing the membership of those groups. We do not accept that this can be met by knowing simply that the two groups in question comprise local residents, members of University staff, the ECC and the police and that it is those organisations and interests that are represented. For that reason we accept that disclosure is reasonably necessary for the purposes of the above legitimate interests. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[49]The Community Panel is an outward facing group enabling the University to listen to and engage with the local community. The Resident Liaison Group is also an outward facing group enabling the University to liaise with community representatives and other partners to ‘take stock of concerns and queries relating to University/Community relations.’ These are not internal University meetings for the purpose of, for example, discussing staffing issues or taking substantive decisions. They are groups intended to facilitate community participation in a public body.[50]The membership of the Resident Liaison Group is made up of University staff, lead representatives of resident associations, Exeter City Councillors and County Councillors, Devon and Cornwall Constabulary Officers, Exeter City Council Staff and relevant community organisations. The Community Panel consists of local residents who expressed interest after the University advertised the opportunity and who have been through a selection process which chose 9 members who represented 6 wards across the city. The members are appointed for 3 years.[51]There is no suggestion that potential members of either group were ever told that their membership would be kept private. We would not expect anyone applying for membership of community groups such as these to be surprised if a list of the members of the group appeared on the community pages of the University website. We would not expect anyone applying or agreeing to be a member of the community group or attending the resident liaison group to be surprised if minutes of the meetings were regularly published on the University website with the names of attendees at the start.[52]We conclude that disclosure would have been within the reasonable expectations of both the staff members, and the resident members of both groups, in the absence of any evidence that they were given any assurance or even indication that their membership would be confidential.[53]The website with which Mr. Cleasby is associated is the website of the Exeter Observer, an online newspaper, adhering to the NUJ code of conduct and a member of the BBC local news partnerships. We do not accept that there is any evidence on which we could base a finding that there is any potential for harm and distress as a result of the publication of the names of the members of the groups.[54]We accept that there is a reasonable likelihood of occasional scrutiny of the meetings of the groups and that this might lead to some reporting in local newspapers, such as the Exeter Observer, which might in some circumstances identify individuals and might on occasion be robust or critical. In our view that is not outside the reasonable expectations of anybody applying or agreeing to join groups such as these and is unlikely to cause harm or distress.[55]Taking all the above into account, we conclude that the legitimate interests are not overridden by the interests or fundamental rights and freedoms of the members of the groups. In those circumstances we find that the university was not entitled to rely on section 40(2) to withhold the information requested in part two of the request. It also follows from our decision that the university was not entitled to rely on section 40(2) to redact the names or job titles/roles of any of the members of the groups from the minutes released in response to part five of the request.[56]We have not considered any redactions other than the names/job titles/roles of the members of the groups as they were not raised in the grounds of appeal.

Section 41

[57]The Commissioner did not go on to consider section 41. In the light of our findings above we conclude that the information was not imparted in circumstances importing an obligation of confidence and there was no reasonable expectation of privacy. Accordingly we find the Council was not entitled to rely on section 41.

Summary of decision

[58]For the above reasons we conclude that the Council was not entitled to withhold the requested information under section 40(2) or section 41 FOIA. Signed Sophie Buckley Date: 29 January 2024 Judge of the First-tier Tribunal