Pensby High School v The Information Commissioner [2025] UKFTT 1129 (GRC)

[2025] UKFTT 01129 (GRC)
First-tier Tribunal
General Regulatory Chamber
Date 25 September 2025
Information Rights
Decided without a hearing
Before
TRIBUNAL Judge BUckleyTRIBUNAL MEMBER ANNE CHaferTRIBUNAL MEMBER PIETER DE WAAL
Between
PENSBY HIGH SCHOOLAppellantThe Information commissionerRespondentDecision:1.The appeal is dismissed.2.Pensby High School shall:a.comply with its duties under section 1(1) of the Freedom of Information Act 2000 (FOIA) in relation to part 2 of the request by issuing a fresh response under section 1(1)(a) FOIA that confirms or denies that the requested information is held and, if the information is held, disclosing it or providing a refusal notice in accordance with section 17(1) FOIA (not relying on section 40(5)(B)) if it claims that any of the requested information is exempt from disclosure by virtue of any provision;or, alternativelyb.provide a notice under section 17(5) FOIA if it intends to maintain that it is not obliged to comply with the request because the request is vexatious.REASONS

Introduction

[1]This is an appeal against the Commissioner’s decision notice IC-339660-G0Y1 of 12 February 2025 which held that Pensby High School (the School) was not entitled to rely on s 40(5B) of the Freedom of Information Act 2000 (FOIA) to refuse to confirm or deny whether it held the requested information.

Factual background to the appeal

[2]This appeal arises against the background of a legal claim for harassment brought by the headteacher of the School against the parents of two former pupils. A substantial amount of the legal costs of that claim were funded by the School. A large amount of information about the harassment claim and its funding was in the public domain when the request in issue in this appeal was made. Request, decision notice and appeal The request

Request, decision notice and appeal

[3]Declan Conroy (the requestor) made the following two part request for information to the School on 17 June 2024 and resubmitted on 20 July 2024. This appeal concerns part two of the request:
“1. Please can I request the integer number of all Freedom of Information requests submitted to Pensby High School during the tenure of [Head Teacher] or failing this from the time that the current Office of the Data Protection Officer starting acting (sic) in its capacity for Pensby High School. Please can I request the integer number of Freedom of Information request (sic) that have been rejected by Pensby High School over the same time period. … 2. Please can I request the integer number of complaints against [Head Teacher] that have been escalated or referred to the Chair of Governors, or the Board of Governors at Pensby High school, and the number of complaints that have been upheld.”

The response

[4]On 12 August 2024 the School responded to the request. It disclosed the information in part 1 of the request but refused to confirm or deny whether it held the information requested in part 2 relying on s 40(5B)(a)(i) FOIA. It upheld the position on internal review on 4 August 2024. The requestor referred the matter to the Commissioner on 21 October 2024.

The Decision Notice

[5]In a decision notice dated 12 February 2025 the Commissioner decided that the School was not entitled to refuse to confirm or deny whether the requested information is held. He required the School to issue a fresh response to part 2 of the request that confirms or denies that the requested information is held and, if held, either discloses it, or provides a valid refusal notice according to section 17.[6]The Commissioner decided that confirming or denying that the requested information was held would disclose personal data. The Commissioner concluded that the headteacher was identifiable because he was named in the request, and confirming or denying that information was held would reveal information with biographical significance for the headteacher, namely whether or not he had been the subject of at least one complaint.[7]The Commissioner held that the requestor was pursuing a legitimate interest. He noted that the requestor had concerns about the conduct of the headteacher and that those concerns were shared by other members of the public. He noted that the headteacher was pursuing a claim for harassment against two individuals and that the School would be contributing to the headteacher’s legal fees. He said that there was a wider public interest in transparency and accountability given the significant sums of money involved. The Commissioner decided that understanding whether previous complaints had been made against the headteacher may help the public to understand why the School has agreed to make a financial contribution to the costs of litigation.[8]The Commissioner concluded that confirmation or denial was necessary for the purposes of a legitimate interest. He decided that there was a legitimate interest in understanding the information available to the School when it decided to provide financial support for litigation pursued by the headteacher, which would not automatically be made available to the requestor through other routes.[9]The Commissioner recognised that the wider circumstances of the request had caused the headteacher distress, and that the School’s confirmation or denial was likely to cause distress by bringing up the matter again. He found that the request related to circumstances that straddled both the headteacher’s professional role and professional life. He noted that the headteacher had not consented to disclosure of the requested information or confirmation or denial that the information is held.[10]The Commissioner accepted that the details being requested were not strictly in the public domain, but he concluded that a reasonable person could infer from the information in the public domain that such information would be held, because it is likely that the two respondents to the headteacher’s civil claim would have submitted at least one formal complaint. On this basis he concluded that, by confirming or denying that the information is held, the invasion of privacy was minimal. If the School were to deny holding the information, he concluded that would provide important context to the headteacher’s civil claim and the School’s decision to provide funding support for that claim.[11]Whilst acknowledging the emotive circumstances surrounding the request, the Commissioner considered the distress, and consequences, of the School confirming or denying that the information is held, would be limited due to the significant amount of information, about the headteacher and the School, that was already in the public domain.[12]The Commissioner said that a legitimate interest was being pursued where a significant amount of public money was being spent, by the School, on the headteacher’s civil claim. Whether justified or not, he said that this money is either money that cannot be spent educating children or money that must be re-raised by the School to ensure no detriment to its pupils.[13]The Commissioner concluded that in this case the need for transparency overrides the privacy rights of the headteacher. He found that confirmation or denial would be compliant with principle (a) (which appears to be a reference to Article 5(1)(a) of the General Data Protection Regulation) and the requirement that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject) and accordingly found that section 40(5B) of FOIA was not engaged. He required the School to issue a fresh response that confirms or denies whether the information is held and, if held, either discloses it or provides a valid refusal notice according to section 17 FOIA.

Notice of Appeal

[14]The Commissioner’s decision, as set out above, was limited to a finding that the School had to confirm or deny whether it held the requested information because it was not entitled to rely on section 40(5B).[15]The extent to which the School challenges that decision is not clear from the Grounds of Appeal. In the grounds of appeal, in which the School provided consent for a copy of the Grounds to be sent to the requestor, the School confirmed the number of complaints against the headteacher that were escalated to the School’s governing body. However, the grounds of appeal did not say how many of those complaints were upheld.[16]When read in the light of the School’s submissions during the Commissioner’s investigation, it appears that the Commissioner’s decision is challenged on the grounds that the Commissioner failed to take proper account of a campaign of harassment targeting the headteacher. The School asserts that the requestor is part of this campaign.[17]The Grounds of Appeal also appear to suggest that the School takes the view that it would be entitled to refuse to comply with section 1(1) FOIA on the basis that the request was vexatious, although the School does not mention or rely on section 14 FOIA (vexatious requests) in this appeal.

The Commissioner’s response

[18]The Commissioner understood the ground of appeal to be that the Commissioner was wrong to decide that the School was not entitled to refuse to confirm or deny whether the requested information was held because the Commissioner did not place enough weight on the impact of the harassment of the headteacher. On that basis he stood by his decision notice.

Evidence

[19]We took account of an open bundle. Legal framework Personal data

Legal framework

[20]The relevant parts of s 40 of FOIA (in force at the relevant time) provide:
“(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies – (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) - (i) would (apart from this Act) contravene any of the data protection principles, ...

(b) section 34(1) of the Data Protection Act 2018;”

[21]Section 40(5B) relates to an absolute exemption (section 40(3A)(a)) and the public interest balance accordingly does not apply.[22]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA):
“(2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to— (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”
[23]The definition of "personal data" consists of two limbs: i) Whether the data in question "relate to" a living individual and ii) Whether the individual is identified or identifiable, directly or indirectly, from those data.[24]The data protection principles are set out Article 5(1) UK GDPR. The first principle provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UK GDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[25]The most relevant basis here is article 6(1)(f): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.[26]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows: 26.1. Is the data controller or a third party pursuing a legitimate interest or interests? 26.2. Is the processing involved necessary for the purposes of those interests? 26.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[27]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: 27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ...

The role of the tribunal

[28]The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[29]The issues for the tribunal to determine are: 29.1. Would confirming or denying that the requested information was held constitute the disclosure of a third party’s personal data? 29.2. Is a third party pursuing a legitimate interest or interests? 29.3. Is the confirmation or denial necessary for the purposes of those interests? 29.4. Are the legitimate interests overridden by the interests or fundamental rights and freedoms of the data subject?

Discussion and conclusions

[30]We note that the School has, in the grounds of appeal, confirmed the number of complaints made against the headteacher that were escalated to the headteacher. That is part of the information requested in part 2 of the request, which also requested the number of complaints that were upheld. Those grounds of appeal have, with the School’s consent, been copied to the requestor. The question for us, however, is whether the School was entitled to rely on section 40(5B) to refuse to confirm or deny that it held the requested information at the time of its response to the request. Would confirming or denying that the requested information was held constitute the disclosure of a third party’s personal data?[31]Given the terms of the request, including the fact that the headteacher is named in the request, if the School were to confirm or deny that the requested information was held, it would disclose a third party’s personal data. The fact that at least one complaint has or has not been made against the headteacher is a fact that ‘relates’ to him. It is proximate and relevant to him, focussed on him and is of clear biographical significance to him.

Is a third party pursuing a legitimate interest or interests?

[32]Even if the School is right that the request forms part of a ‘campaign of harassment’ by the requestor, in concert with a group of other individuals, we agree with the Commissioner that there is a legitimate interest in transparency and accountability in relation to whether or not complaints had been made against the headteacher and referred to the governing body. Confirmation or denial also acts as a gateway to potential disclosure of the requested information, i.e. the number of those complaints and the number that have been upheld. The headteacher is in a senior leadership position. It is public knowledge that the School has used significant sums of public money to fund a legal claim for harassment brought by the headteacher against two parents of pupils at the School.[33]As the tribunal noted in its decision in FT/EA/2024/0328, an appeal arising out of the same background, it is not the tribunal’s role to judge whether the School was right or wrong to fund the litigation pursued by the headteacher. There is, however, a legitimate interest in transparency in relation to why a School with limited resources spent significant sums funding a legal action for harassment brought by its headteacher against two private individuals. We agree with the Commissioner that information about whether complaints have been brought against the headteacher and referred to the School’s governing body and the outcome of those complaints would contribute to public understanding of the information that was known to the School when it made that decision.[34]Against that background, we find that confirmation or denial under FOIA would serve a legitimate interest in transparency and accountability. We are satisfied that a legitimate interest is being pursued.

Is the confirmation or denial necessary for the purposes of those interests?

[35]We have determined that there is legitimate interest in transparency and accountability specifically in relation to whether or not complaints have been made against the headteacher and referred to the School’s governing body and if so, what the outcome was. That information is not available to the requestor or to the public via another route. On that basis we find that confirmation or denial was necessary for the purposes of those interests. Are the legitimate interests overridden by the interests or fundamental rights and freedoms of the data subject?[36]We have to consider the impact of revealing that any complaint has, or has not, been brought against the headteacher and referred to the School’s governing body. By confirming or denying whether the information is held the School will not be revealing any information about the nature of such complaint/s. It is information about the headteacher’s professional life in a senior, publicly paid position. Given the particular background to this appeal, including the information already in the public domain, we do not accept that the headteacher would have a reasonable expectation that this limited information would be kept private. We agree with the Commissioner that any additional intrusion into the headteacher’s privacy by the disclosure of those particular facts is minimal.[37]In considering the damage or distress that is likely to flow from confirmation or denial that the information is held, the School asks us to take account of an underlying campaign of harassment, but there is nothing before us to support a finding that confirming or denying that the information is held would be likely to cause further harassment.[38]We take account of the fact that the headteacher has not consented to the disclosure (i.e. a confirmation or denial being given by the School). We accept that he has suffered distress, in particular as a result of the conduct described in the bundle that was the subject of separate legal proceedings, and we take account of the fact that confirming or denying that the information is held is likely to lead to some distress to the headteacher simply by raising this issue again.[39]Taking into account the value of transparency arising out of the expenditure of significant sums of public money, we are persuaded that the interests or fundamental rights of the data subject are outweighed by the legitimate interest in confirming or denying that the information is held.[40]We find that the School was not entitled to rely on section 40(5B) to refuse to confirm or deny that the information was held.

Next steps

[41]Although the School has confirmed in its grounds of appeal that it holds some of the requested information and has indeed included some of the requested information in the grounds of appeal, it has not yet complied with its duties under section 1(1) FOIA.[42]We have therefore ordered that the School provide a fresh response to the request. Signed Sophie Buckley Date: 24 September 2025 Judge of the First-tier Tribunal