Peter Stead v The Information Commissioner [2025] UKFTT 311 (GRC)

Case Reference: FT/EA/2024/0352[2025] UKFTT 00311 (GRC)
First-tier Tribunal
(General Regulatory Chamber)
Date 13 March 2025
Information Rights
Decided without a hearing
Before
JUDGE SOPHIE BUckleyMEMBER Dr PHEBE MANNmember anne chafer
Between
peter steadAppellantThe Information commissionerRespondentDecision: The appeal is allowed in partSubstituted Decision Notice:Organisation: Governing Body of the University of YorkComplainant: Peter SteadThe Substitute Decision -IC-315095-G9D1

Signed Date:

[1]For the reasons set out below:a. The Governing Body of the University of York (the University) was not entitled to rely on section 40(2) of the Freedom of Information Act 2000 (FOIA) to withhold the name of the Chief Operating Officer of the Creative Industries Independent Standards Authority (CIISA).b. Save for the name identified above, the University was entitled to rely on section 40(2) FOIA to withhold the personal data of third parties.c. The University was entitled to rely on section 40(1) FOIA to withhold the personal data of the Complainant.[2]The University is required to take the following steps within 35 calendar days of the date that this decision is sent by the parties by the tribunal: a. The University is required to disclose a further copy of the information to the appellant, removing the redaction of the name referred to above.[3]Any failure to abide by the terms of the tribunal’s substituted decision notice may amount to contempt which may, on application, be certified to the Upper Tribunal. REASONS

Introduction

[1]This is an appeal by Mr Stead against the Commissioner’s decision notice IC-315095-G9D1 of 2 September 2024 which held that the Governing Body of the University of York (‘the University’) was entitled to rely on section 40(1) and section 40(2) (personal information) to withhold the information in issue. The Commissioner held that the University did not comply with section 17(1) because it incorrectly relied on section 40(2) in relation to Mr Stead’s own personal data.[2]This appeal was heard at the same time as FT/EA/2024/0351 but a separate decision has been issued.

Factual background

[3]This factual background is based largely on the factual background provided by the Commissioner in his response to the appeal.[4]This appeal concerns the Creative Industries Independent Standards Authority (CIISA), which is an organisation with the stated purpose and vision to “uphold and improve standards of behaviour across the creative industries and to prevent and tackle all forms of bullying and harassment, including bullying and harassment of a discriminatory nature ... "[5]The CIISA website states as follows:
“…In 2021, in light of a number of serious allegations being made in the public domain relating the Creative Industries, Time's Up UK Chair, Dame Heather Rabbatts joined forces with legal advisors from Field Fisher and scoped the concept for an Independent Standards Authority for the Creative Industries and began to consult with leaders across Film, Music, TV and Theatre. In September 2022, CIISA brought on board Jen Smith as interim CEO, to lead the work and CIISA is now expanding its team, finalising its governance, legal and operational processes, funding and business plan aiming to provide some services by the end of 2024 ....”
[6]In October 2023, Dr Anna Bull from the education department at the University of York ("University") released a 64-page Report entitled "Safe to Speak Up?" about sexual harassment in the UK film and television industries. A summary policy briefing and industry briefing were also released at the same time.[7]On 31 October 2023, Mr Stead made the following request for information to the University:
“Please send to me all of the materials you hold in connection with the report: “Safe to Speak Up?”
By Dr Anna Bull … However, please exclude the following: - Anything which may lead to the identities of the interviewees being exposed. - The raw material of the interviewees’ accounts to which the report makes reference .....”

However, please exclude the following:

[8]The University refused to comply with the request in reliance on section 22A FOIA (information intended for future publication). This was upheld by the Commissioner in March 2024 in a decision notice IC-28929-F5J6. This is subject to an appeal to the First-tier Tribunal in EA/2024/0109.

The request for information

[9]Mr Stead requested the following information from the University on 9 March 2024: “... This is(1) a FOI request and(2) a SAR. 1. I request the following information under the Freedom of Information Act: All the materials you hold related to my previous FOI request, ICO reference IC-282929-F5J6. Please note that this is not a repeat of the above request, it is about the above request. This is sometimes referred to as a 'meta request'. For more information, please see the ICO's guidance: ... 2. I make the following Subject Access Request under the Data Protection Act and U.K. GDPR: A) A copy of the personal data you hold about me. B) Where any of this personal data consists of an extract from a longer document, the full text of that document. Again only in relation to FOI request IC-282929-F5J6. ... "[10]On 10 April 2024 the University confirmed that it held information within the scope of part 1 of the request. It disclosed the information but stated that it had redacted personal data which was withheld under section 40(2). The University upheld its position on internal review.

Decision notice

[11]In a decision notice dated 2 September 2024 the Commissioner upheld the University’s reliance on section 40(2) save that in relation to Mr Stead’s own data the Commissioner determined that it should have been withheld under section 40(1).[12]In relation to Mr Stead’s own personal data the Commissioner held that this was subject to the absolute exemption under section 40(1) FOIA.[13]In relation to the other information, the Commissioner determined that it was the personal data of third parties.[14]The Commissioner stated that he appreciated that Mr Stead had a personal interest in the information as it concerns a previous complaint that he submitted to the Commissioner, but the Commissioner held that there was little wider public interest in the information, save for the disclosure demonstrating that the University was open and transparent.[15]The Commissioner found that the interest in the University demonstrating that it was transparent was met through the disclosure of the other information that Mr Stead had requested. The Commissioner accepted that disclosure of the information was necessary for the purposes of Mr Stead’s legitimate private interests because it would provide a more complete picture of the University’s communications about the FOIA complaint.[16]The Commissioner found that the data subjects would reasonably expect that their personal data would not be disclosed to the world at large under FOIA. He noted that they had not consented to disclosure and found that it would be likely to cause them harm and distress. He said that Mr Stead was pursuing a purely private concern and unrestricted disclosure of the personal data to the general public was disproportionate. He concluded that disclosure would not be lawful and the University was entitled to withhold the information under section 40(2).

Grounds of appeal

[17]The Grounds of Appeal are, in essence: 17.1. The Commissioner was wrong to conclude that there was no legitimate public interest in disclosure. Mr Stead states that it is in the public interest to understand if and how the University were influenced externally in the processing of the FOI request and whether this was proper. 17.2. The Commissioner was wrong to conclude that the data subjects would not have foreseen their data being disclosed. The individuals are senior and public facing. 17.3. The Commissioner was wrong to conclude that disclosure would be likely to cause harm and distress.

The Commissioner’s response

[18]In essence the Commissioner stood by his decision notice.

Mr Stead’s reply

[19]Mr Stead reiterated his submission that a number of CIISA staff likely mentioned in the redacted materials are or were senior and public facing. He submitted that they also have decades of experience in various connected fields, surely knew that Universities are subject to FOIA and that there would be huge interest in a new standards authority for the creative industries affecting many people and surely communicated in their professional capacity. He provided screenshots from the CIISA website showing the CIISA team photos and biographies. Legal Framework Personal data

Legal Framework

[20]The relevant parts of section 40 of FOIA provide:(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) It constitutes personal data which does not fall within subsection (1), and (b) either the first, second or the third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act - would contravene any of the data protection principles, or…[21]Personal data is defined in section 3 of the Data Protection Act 2018 (DPA): (2) ‘Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to—(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.[22]The definition of "personal data" consists of two limbs: i) Whether the data in question "relate to" a living individual and ii) Whether the individual is identified or identifiable, directly or indirectly, from those data.[23]The tribunal is assisted in identifying ‘personal data’ by the cases of Ittahadieh v Cheyne Gardens Ltd[2017] EWCA Civ 121;Durant v FSA[2003] EWCA Civ 1746and Edem v Information Commissioner[2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.[24]In Durant, Auld LJ, giving the leading judgment said at [28]:
“Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.”
[25]In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:
“It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.”
[26]The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 at paragraph 57 held, whilst acknowledging the Durant test, that a Court should also consider:
“(2) Does the data "relate" to an individual in the sense that it is "about" that individual because of its: (i) "Content" in referring to the identity, characteristics or behaviour of the individual? (ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated? (iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)? (3) Are any of the 8 questions provided by the TGN [Commissioner’s Technical Guidance Note on personal data] are applicable? These questions are as follows: (i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller? (ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession? (iii) Is the data 'obviously about' a particular individual? (iv) Is the data 'linked to' an individual so that it provides particular information about that individual? (v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual? (vi) Does the data have any biographical significance in relation to the individual? (vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event? (viii) Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)? Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?”
These questions are as follows:[27]The data protection principles are set out Article 5(1) of the UKGDPR and s 34(1) DPA. Article 5(1)(a) UKGDPR provides: that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1) UKGDPR provides that processing shall be lawful only if and to the extent that at least one of the lawful bases for processing listed in the Article applies.[28]The only potentially relevant basis here is article 6(1)(f):
“Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.”
[29]The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows 29.1. Is the data controller or a third party pursuing a legitimate interest or interests? 29.2. Is the processing involved necessary for the purposes of those interests? 29.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[30]Lady Hale said the following in South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421 about article 6(f)’s slightly differently worded predecessor: “27. ... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “[31]Section 40(3A) is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The role of the tribunal

[32]The tribunal’s remit is governed by section 58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether he should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

List of issues

[33]The issues for the tribunal are: 33.1. Is any of the withheld information the appellant’s personal data? If so, it is exempt under section 40(1). 33.2. Is any of the withheld information the personal of data of third parties, i.e. does it relate to an identifiable individual? 33.3. If so: 33.3.1. Is the requestor pursuing a legitimate interest or interests? 33.3.2. Is the processing involved necessary for the purposes of those interests? 33.3.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

Evidence

[34]We read an open and a closed bundle.[35]The closed bundle consists of: 35.1. An unredacted version of a letter from the University to the Commissioner dated 15 August 2024 which refers to the content of the withheld information. 35.2. An unredacted version of the information provided to Mr Stead with the withheld information highlighted.[36]The tribunal was satisfied that it was necessary to withhold this information under rule 14. Discussion and conclusions Is some of the withheld information personal data of the appellant?

Discussion and conclusions

[37]Some of the withheld information consists of the appellant’s name and email address. That information is the appellant’s personal data and is exempt under section 40(1) FOIA. The appeal is dismissed in relation to this part of the withheld information.

Is the remainder of the withheld information personal data of third parties?

[38]We find that the remainder of the withheld information relates to identifiable individuals.[39]One piece of information is the name of the Chief Operating Officer which is evidently information relating to an identifiable individual.[40]The remainder of the withheld information relates to other individuals. One of those individuals is identifiable. The information that relates to that individual cannot be separated out from the information relating to the other individual(s). All the remaining information, as a whole, relates to the identifiable individual. It is biographical in a significant sense and is focussed on that individual. On that basis we conclude that the remainder of the withheld information is the personal data of a third party.[41]There is additional reasoning on this issue in the closed annex.

Is disclosure reasonably necessary for the purposes of a legitimate interest?

[42]We accept that Mr Stead is pursuing a legitimate interest. The legitimate interest is understanding how the University reached its decision on its response to his freedom of information request. It is often appropriate for a public body to consult with and/or take account of the views of other bodies when considering how to respond to a FOIA request. However, we accept that there is a public interest in transparency in relation to the decision making of all public bodies and in relation to how they incorporate the views of other bodies into their decision making on FOIA requests.[43]In relation to the name of the Chief Operating Officer at CIISA we accept that processing is reasonably necessary for the purposes of those interests. The names of the senior individuals involved are an important part of transparency.[44]In relation to the remainder of the personal information, we find that disclosure would not serve the legitimate interests identified by Mr Stead. This conclusion is based on the content of the withheld information and is explained further in closed. We do not accept that disclosure of the remainder of the personal information is reasonably necessary for the purposes of the legitimate interests that we have identified, nor indeed for any of the reasons put forward by Mr Stead as justifying disclosure. The appeal is dismissed in relation to this part of the withheld information. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[45]In relation to the name of the Chief Operating Officer of CIISA, we note that this is an outward-facing position, and from the screenshots provided by Mr Stead we can see that this individual is identified by name and photograph on the organisation’s website. For that reason we do not consider that there is any legitimate expectation of privacy in this context, and the individual’s name is already public. We do not accept that any distress would be caused by disclosure. For those reasons we do not accept, in relation to the name, that the above interests are overridden by the fundamental rights and freedoms of the data subject. The appeal succeeds to this extent.[46]Having concluded that disclosure of the remainder of the withheld personal data is not reasonably necessary for the purposes of the legitimate interests we do not have to consider this question to dispose of the appeal. However, for the reasons set out in closed, given the content of the information, had we had to determine this issue we would have concluded that the interests were outweighed by the fundamental rights and freedoms of the data subjects. The data subject would have had a legitimate expectation of privacy in relation to that information and disclosure would lead to a real risk of distress. Signed Date: Sophie Buckley 3 March 2025

Cited in 1 later judgment