Peter Stead v The Information Commissioner [2025] UKFTT 334 (GRC)

[2025] UKFTT 00334 (GRC)Case Reference: FT/EA/2024/0159
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 29 November 2024Date 17 March 2025
Information Rights
Heard by Cloud Video Platform
Before
JUDGE STEPHEN ROPERMEMBER AIMÉE GASSTONMEMBER EMMA YATES
Between
PETER STEADAppellantTHE INFORMATION COMMISSIONERRespondentin person for Appellantdid not appear and was not represented for RespondentDecision: The appeal is AllowedSubstituted Decision Notice:The Tribunal’s Decision Notice in case reference FT/EA/2024/0159, set out below, is substituted for Commissioner’s Decision Notice reference IC-267857-G3Z6, dated 23 April 2024, with regard to the request for information made to the British Film Institute by Peter Stead dated 29 August 2023.Substituted Decision Notice
[1]The British Film Institute must make a fresh response to the request for information made to it by Peter Stead dated 29 August 2023.[2]The fresh response must disclose all the information which is held within the scope of that request, or claim any relevant exemptions to disclosure pursuant to the Freedom of Information Act 2000.[3]The British Film Institute must issue the fresh response within 35 days of this decision being sent to it in accordance with the directions below, or (if there is an application to appeal this decision) within 28 days after being notified of an unsuccessful outcome to such application or any resulting appeal.[4]The fresh response will be subject to the rights given under section 50 of the Freedom of Information Act 2000 to make a new complaint to the Information Commissioner.[5]Failure to comply with this decision may result in the Tribunal making written certification of this fact pursuant to section 61 of the Freedom of Information Act 2000 and may be dealt with as a contempt of court. Directions The Information Commissioner is directed to send a copy of this decision to the British Film Institute within 14 days of its promulgation. REASONS

Preliminary matters

[1]In this decision, we use the following terms to denote the meanings shown: Appellant: Peter Stead. BFI: The British Film Institute. Commissioner: The Information Commissioner (the Respondent). Decision Notice: The Decision Notice of the Commissioner dated 23 April 2024, reference IC-267857-G3Z6, relating to the Request. Disclosed Information: Information which was disclosed by the BFI on 26 September 2023 in response to the Request (as included in the open bundle in the appeal). DPA: The Data Protection Act 2018. Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 21). FOIA: The Freedom of Information Act 2000. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f) of the UK GDPR, as set out in paragraph 31. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 33. Previous Decision Notice: The previous decision notice of the Commissioner, reference IC-235054-Z1S1, in respect of the Previous Request. Previous Request: The request for information made to the BFI by the Appellant dated 14 March 2023. Public Interest Test: The test, pursuant to section 2(2)(b) (set out in paragraph 24), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information. QPO: A qualified person’s opinion for the purposes of section 36. Request: The request for information made to the BFI by the Appellant dated 29 August 2023, as set out in paragraph 5. Requested Information: The information which was requested by way of the Request. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.[2]Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:a. to numbered paragraphs are references to paragraphs of this decision so numbered;b. to any section are references to the applicable section of FOIA.

Introduction

[3]This was an appeal against the Decision Notice, which (in summary) decided that the BFI could rely on section 40(2) to redact certain personal data from the information it disclosed in response to the Request and that, on the balance of probabilities, the BFI does not hold any further information within the scope of the Request. The Decision Notice did not require the BFI to take any steps.

Background to the Appeal

[4]The background to the appeal is as follows.

The Request

[5]On 29 August 2023, the Appellant sent an email to the BFI requesting information, as follows:
“I request the following information under the Freedom of Information Act: All the materials you hold related to my previous FOI request, your reference 2022-062, ICO reference of same IC-235054-Z1S1. Please note that this is not a repeat of the above request, it is about the above request. This is sometimes referred to as a ‘meta request’. … I am especially (therefore not only) interested in obtaining the following: A) The date of the qualified person’s opinion (QPO) B) A copy of the QPO C) All the submissions passed to the qualified person for the purpose of determining the opinion, and connected documentation. Even though Section 36 was not ultimately relied on in the decision notice, a QPO did take place, so please send me the info I request on it, plus all the other material I allude to above.”
. I am especially (therefore not only) interested in obtaining the following: B) A copy of the QPO C) All the submissions passed to the qualified person for the purpose of determining the opinion, and connected documentation.

I am especially (therefore not only) interested in obtaining the following:

[6]The BFI responded on 26 September 2023 and provided what it described as “all” the information it held, in a redacted form. Parts of the information were withheld under section 40(2) and section 36(2)(b)(ii).[7]On 27 September 2023 the Appellant requested an internal review, considering that he had not been provided with all the Requested Information, including the QPO referred to in the Request.[8]The BFI refused to conduct an internal review, stating in its email to the Appellant, dated 25 October 2023 (with reference to the Previous Decision Notice):
“As per the ICO decision of 23rd August 2023, wherein they found, in relation to the information requested in your original request, ‘none of the information in scope is caught by FOIA’. They also stated that ‘BFI chose to provide the complainant with information it was holding on behalf of another person, voluntarily and outside FOIA. And BFI chose to withhold some of the information. BFI is entitled to do both.’ Therefore as the FOIA does not apply we will not being undertaking a review of any materials previously supplied in relation to your original request.”
[9]On 27 October 2023, the Appellant contacted the Commissioner to complain about the way the Request had been handled by the BFI.

The Commissioner’s investigation

[10]To provide some relevant context, it is helpful to quote the following from paragraphs 10 to 15 (inclusive) of the Decision Notice regarding matters which emerged during the Commissioner’s investigation:
“10. Subsequent correspondence and a Teams meeting on 12 March 2024 with the BFI determined that there had been some misunderstanding over the request. The BFI had apparently assumed that it could respond in the same way as it had for the previous request and that, ultimately, the ICO’s determination that the information relating to IC-235054-Z1S1 fell outside the FOIA meant that the same would apply to this request. The Commissioner explained that this request was for information held that had been generated by the previous request. This would encompass the QPO and associated information but excluded the information that had been withheld on the previous request. 11. What emerged from this meeting was that the QPO had not been sought for this request, only for the earlier request. To clarify, this means that a QPO was not sought as to whether the earlier QPO could be released or not. The BFI accepted that this was the case and that section 36 of FOIA could not therefore apply to the request that is the subject of this decision. Another factor that emerged was that the requested information had already been provided on 26 September 2023 and prior to that on IC-23504-Z1S1 [sic] as part of that disclosure. 12. It was also agreed during the meeting that the BFI would respond and either provide the information (minus personal data and the withheld information from the previous case) or explain that the complainant had already been given everything it held, with the exception of the ICO side of the correspondence. 13. The BFI sent a further response to the complainant on 23 March 2024 and provided the same file as it had previously given them on IC-235054-Z1S1 (7 August 2023) and on 26 September 2023. The BFI’s view is that this file contains the requested information – the QPO and the remainder of the information that fell within scope. However, it asked if the complainant required the correspondence between the ICO and the BFI in the course of investigating that complaint and offered to provide it. 14. On 25 March 2024 the Commissioner wrote to the complainant and outlined his initial view. In a later series of emails the complainant confirmed to the Commissioner that they did not require the ICO/BFI correspondence as it was already in their possession. They also confirmed that they did not expect to receive the information that had been withheld on the earlier case. However, the complainant did not accept that some personal data should have been redacted or that the QPO and submissions to the QP had been provided. 15. The Commissioner explained to the complainant that he can only consider whether the BFI has located all the information falling within scope of the request. He cannot analyse that opinion as an earlier decision had been made regarding it and that decision stated that the information fell outside of the FOIA. The complainant has said that they are not trying to reopen the previous investigation but queried whether pp 89-93 of the file of information contains the information they requested.”
[11]The Commissioner’s view, therefore, was that the scope of his investigation was to consider whether the redactions which the BFI made, under section 40(2), to the information disclosed in response to the Request were appropriate and whether the BFI holds any further information beyond what it already provided.

The Decision Notice

[12]In the Decision Notice, the Commissioner decided that:a. the BFI’s redactions of certain personal data (to which we refer in paragraph 55) pursuant to section 40(2) was appropriate, on the basis that that disclosure of that data was not necessary to meet the Appellant’s legitimate interests;b. on the balance of probabilities, and in light of the BFI’s detailed responses to his questions and explanations about the searches made, there was no further information held by the BFI beyond what had already been provided, other than information identified as being exempt. The appeal The grounds of appeal

The appeal

[13]The Appellant’s grounds of appeal were, in essence, as follows:a. Further information must be held within the scope of the Request. This was on the basis that it was irrelevant that the Previous Decision Notice held that the information requested by way of the Previous Request could be withheld under FOIA and that section 36 was ultimately not relied on. The Appellant considered that the potential application of section 36 to the Previous Request was still cited in respect of the Previous Request and therefore that there must be some materials relating to that within the scope of the Request. Related to that, the Appellant also considered that the information which was provided to him by the BFI as being the qualified person’s opinion was not actually a QPO.b. In disclosing information in respect of the Request, the BFI wrongly redacted some aspects based on the section 36 exemption which was applied in respect of the Previous Request. Related to this, the Decision Notice did not address why those redactions were permitted, including whether the redactions were based on a new reliance on the exemption in section 36 or any other exemptions. The Appellant acknowledged, however, the contents of paragraph 11 of the Decision Notice (which we quoted above) – which stated that the BFI had confirmed that a QPO had not been sought in respect of the Request as to whether the QPO in the Previous Request could be disclosed (and consequently that the BFI accepted that section 36 could not apply to the Request).c. Information disclosed in respect of the Request also erroneously contained redactions based on section 40(2). The Appellant referred to his arguments previously cited to the Commissioner in this regard - essentially, the Appellant was content for the names of certain junior staff to be redacted but not others.d. The BFI appeared to have wrongly made redactions relating to commercially sensitive information whilst not citing section 43.

The Tribunal’s powers and role

[14]The powers of the Tribunal in determining the appeal are set out in section 58, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[15]In summary, therefore, the Tribunal’s remit for the purposes of the appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).[16]We should perhaps emphasise that the appeal did not relate to the Previous Decision Notice and that we had no jurisdiction to consider matters relating to the Previous Request.

Mode of hearing

[17]The proceedings were held by the cloud video platform. The Tribunal Panel and the Appellant joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way. The Commissioner did not appear and was not represented.[18]At one point in the hearing, the Appellant’s video connection was lagging slightly. The Appellant switched off his camera to compensate for the connection problem and the hearing continued on that basis. At another point, the Appellant’s connection was lost and the Tribunal waited for a few minutes for him to reconnect. The Tribunal was satisfied that nothing was missed during the hearing as a result of the Appellant’s connection difficulties. There were no other interruptions of note during the hearing.

The evidence and submissions

[19]The Tribunal read and considered an open bundle of evidence and pleadings. We also heard oral evidence and submissions from the Appellant during the hearing.[20]All of the contents of the bundle and all such oral evidence and submissions were taken into account, even if not directly referred to in this decision. The relevant statutory framework General principles

The relevant statutory framework

[21]Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[22]In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[23]Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.[24]Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[25]The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). Section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied.[26]Accordingly, in summary, the relevant exemption to the Duty to Disclose in section 40(2) is an absolute exemption only in cases where that first condition is satisfied, otherwise the exemption is subject to the Public Interest Test.

Section 36 – prejudice to effective conduct of public affairs

[27]Amongst other things, section 36(2) contains an exemption to the Duty to Disclose where, in the reasonable opinion of a “qualified person”, disclosure of information:a. would, or would be likely to, inhibit the free and frank exchange of views for the purposes of deliberation; orb. would otherwise prejudice, or would be likely otherwise to prejudice, the effective conduct of public affairs.[28]Section 36(5) defines who is a “qualified person” for the purposes of section 36(2).

Section 40 – personal information

[29]So far as is relevant for the purposes of the appeal, section 40 provides: “…(2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles…”.[30]Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. Section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA.b. The “data protection principles” are those set out in Article 5(1) of the UK GDPR and section 34(1) of the DPA.c. The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”.d. A “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”.[31]To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1) of the UK GDPR. One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f) of the UK GDPR).[32]Article 6(1) of the UK GDPR goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information by a public authority under FOIA.

The Legitimate Interests Test

[33]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) of the UK GDPR which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[34]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[35]It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.[36]The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb can be considered.[37]For the purposes of the second limb of the Legitimate Interests Test, the term “necessary” means something which is more than desirable but less than indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive” means of achieving the legitimate interest).

Discussion and findings

[38]For convenience, we set out our comments below under sub-headings related to the points raised by the Appellant in his grounds of appeal.

Was further information held within the scope of the Request?

[39]As we have noted, the main concern raised by the Appellant in his grounds of appeal was that further information must be held by the BFI within the scope of the Request because there was a QPO relied on (at one point) in respect of the Previous Request and therefore a QPO must exist, which had not been provided to him. In the hearing, however, the Appellant stated that he was content not to pursue this ground.[40]The Appellant had considered that what had been disclosed to him in respect of the Request could not constitute a QPO. This appeared to be on the basis that what was disclosed comprised submissions to the relevant qualified person and an email in reply to that stating that they did not have any ‘questions’.[41]In our view, that issue was therefore more about the merits or legitimacy of the QPO given in respect of the Previous Request, rather than whether or not any additional information was held in respect of it. This is because the Appellant considered that what was provided could not amount to a QPO if it was to be relied on for the purposes of section 36 (in respect of the Previous Request). Therefore, even if the Appellant had wished to pursue this ground of appeal, this would not be something we could address as it would relate to the validity of the QPO for the purposes of the Previous Request.[42]For completeness, we would add that there was nothing before us to suggest that any further information is held by the BFI relating to the QPO relied on in respect of the Previous Request.

Were redactions erroneously made in respect of section 36?

[43]During the Commissioner’s section 50 investigation, the BFI withdrew its reliance on section 36 in respect of information disclosed in response to the Request. This was recorded in paragraph 1 of the Decision Notice. Paragraph 11 of the Decision Notice (which we quoted above) also stated that the BFI accepted that section 36 could not apply to the Request.[44]The Commissioner’s position, in his response to the appeal, was that the scope of his investigation (which we referred to in paragraph 11) was correct. The Commissioner therefore considered that the Decision Notice correctly focussed on only section 40(2), as opposed to any other potential exemptions. The Commissioner also confirmed his view that the BFI did not rely on the exemption in section 36 in relation to the Request.[45]However, as we noted in paragraph 6, the BFI’s response to the Request withheld information under section 40(2) and section 36(2)(b)(ii). This was confirmed in its covering email of 26 September 2023 providing the Disclosed Information. Aspects of the Disclosed Information were therefore redacted in reliance on those sections. There also appeared to be redactions in the Disclosed Information based on further potential exemptions, which we refer to below.[46]Where the redactions occurred in the Disclosed Information, the redacted text was replaced with text in highlighting, or in a different colour font, which referred to the basis on which the relevant redaction had been made. For example, some redacted text was replaced with highlighted text stating “redacted – section 36”.[47]The Commissioner therefore appears to be wrong in his view that the BFI had not relied on section 36 in respect of the Request, based on the stated redactions. In any event, there was no evidence that the Commissioner had considered, other than in respect of section 40(2), why the redactions had been made in the Disclosed Information.[48]Moreover, whilst the BFI’s email of 26 September 2023 stated that it had made redactions to the Disclosed Information in reliance on the exemptions under section 40(2) and section 36(2), redactions also appear to have been made in respect of other exemptions. For example, there were redactions where text was replaced with highlighted text stating “redacted – ministerial process”.[49]The Appellant explained during the hearing that the emails contained within the Disclosed Information were not provided in response to the Previous Request, but were disclosed for the first time in response to the Request. Consequently the Appellant stated that paragraph 5 of the Decision Notice was incorrect in suggesting that the Disclosed Information was the same as the information disclosed in respect of the Previous Request. We also note that paragraph 11 of the Decision Notice was more forthright, stating without qualification that that the Requested Information had already been provided in connection with the Previous Decision Notice.[50]There was nothing before us which conflicted with the Appellant’s evidence that the emails contained within the Disclosed Information had not been previously disclosed and therefore we accept his assertion. It follows that the Decision Notice erroneously recorded that the Requested Information had been previously disclosed.[51]Of more pertinence is that the Decision Notice was therefore wrong to conclude that the BFI had not relied on any exemptions other than pursuant to section 40(2), given that the Disclosed Information appeared to contain redactions relying on other exemptions and that this had not been taken into account by the Commissioner.

Were redactions erroneously made in respect of section 40(2)?

[52]As we have noted, the Appellant did not dispute the redaction of ‘junior names’ in the Disclosed Information. Also, it was common ground between the parties that the names of individuals contained within the Disclosed Information would constitute personal data, on the basis that it would relate to an identified or identifiable living individual.[53]The issue before us was therefore whether or not the BFI was entitled to redact the names of others (not ‘junior’ people) pursuant to section 40(2).[54]The Commissioner’s position was, however, that all personal data (regardless of seniority of the individuals concerned) should be withheld from disclosure pursuant to section 40(2).[55]Also, the BFI had stated to the Commissioner during his investigation (and as recorded in paragraph 35 of the Decision Notice) that the personal data it withheld, in the Disclosed Information, comprised “the names of anyone who was not a senior member of staff, unless it was someone with whom the requestor had already corresponded, or members of staff from third party organisations as we did not have their consent to release their personal details”. Putting this another way, the BFI’s position was that it only withheld the personal data of:(a) junior staff members of the BFI, unless the Appellant had already corresponded with them;(b) individuals working for organisations other than the BFI.[56]It was clear from the Disclosed Information that a number of individuals’ names were indeed not redacted. We were not, however, in a position to determine the status (junior or otherwise) of the individuals whose names had been redacted (which we comment on further below).[57]In respect of his view that the BFI would be entitled to withhold personal data pursuant to section 40(2), the Commissioner considered that the first condition set out in section 40(3A) applied and that the applicable data protection principle was that set out in Article 5(1)(a) of the UK GDPR requiring personal data to be processed lawfully, fairly and in a transparent manner. The Commissioner also considered that the applicable lawful basis of processing was the Legitimate Interests Basis.[58]The Decision Notice addressed the Legitimate Interests Test. In short, the Commissioner concluded in the Decision Notice that disclosure of the relevant personal data was not necessary (with regard to the second limb of the Legitimate Interests Test) and therefore that disclosure of the personal data would be unlawful, in breach of the first data protection principle. Accordingly, the Commissioner did not go on to consider the third limb of the Legitimate Interests Test.[59]The Appellant also did not dispute the Commissioner’s view on the application of the first condition in section 40(3A) or the Legitimate Interests Basis as the applicable lawful basis for the processing of the applicable personal data. Likewise, there was no dispute regarding the relevance of the Legitimate Interests Test. However, the Appellant did dispute the Commissioner’s findings regarding the outcome of the Legitimate Interests Test. The Appellant considered, essentially, that disclosure was necessary (regarding the second limb of the Legitimate Interests Test) and that (regarding the third limb of the Legitimate Interests Test) the legitimate interests he was pursuing overrode the rights and freedoms of the relevant data subjects, justifying disclosure of the relevant personal data.[60]The Decision Notice recorded the Commissioner’s view as to why disclosure was not necessary in respect of the second limb of the Legitimate Interests Test. He concluded that the names of senior staff at the BFI had been disclosed to the Appellant and he stated (in paragraph 48 of the Decision Notice) that he “is not persuaded that there is a necessity to disclose the names of junior BFI members of staff or external individuals beyond the complainant’s desire to see them”.[61]The Appellant was particularly interested to ascertain the names of two individuals with regard to the personal data redactions in the Disclosed Information. This was linked to his concerns about potential collusion between the BFI and other agencies and his views about the public interest in knowing their identity. The wider context of the Appellant’s concerns related to the proposed establishment of a new standards authority, as a non-statutory regulator, for the creative industries (the Creative Industries Independent Standards Authority) and his views regarding the need for transparency regarding this, including which bodies would be funding it. A specific concern of the Appellant was that the Disclosed Information included, in connection with the Previous Request, an email from someone at Creative UK stating that the view of Creative UK regarding the discussions that had been held about the establishment of the Creative Industries Independent Standards Authority were “private and sensitive” and that it had insufficient resources to redact relevant material. The Appellant considered that it was in the public interest to understand who was seeking to block disclosure of the relevant information.[62]We did not have before us a closed bundle containing an unredacted version of the Disclosed Information, or any other supporting evidence, in order to determine the status (junior or otherwise) of the individuals whose names had been redacted in the Disclosed Information.[63]We find (for the purposes of the second limb of the Legitimate Interests Test) that there were legitimate interests being pursued by the Appellant by way of the Request. In our view, there is some merit in the Appellant’s arguments regarding the need to know the name of the individual involved at Creative UK who had suggested that information requested by way of the Previous Request should be withheld. In part, this relates to the public interest in transparency regarding connections between the relevant organisations (including the individuals involved); not only with regard to the Appellant’s concerns about who was seeking to block disclosure of the relevant information, but his wider concerns about the establishment of the Creative Industries Independent Standards Authority. The other aspect relates to knowing whether the individual who sent the email was senior or not. We do not know the status of the individual, because we did not have unredacted versions of the Disclosed Information - and this was not ascertained by the Commissioner, linked to his view that all personal data of external individuals could be withheld.[64]We believe that it is likely that the sender of the email from Creative UK which we have referred to will be someone senior, but if they are junior then we consider that there is a legitimate interest in knowing that someone junior may have been involved in decisions regarding the disclosure of relevant information. If they are senior then we consider, having regard to the third limb of the Legitimate Interests Test, that further analysis is required in order to establish whether or not their identity could be disclosed. That might also be relevant even if the individual involved is junior, given that potential involvement. However, we did not have the necessary evidence or submissions in order to make any such assessment ourselves.[65]We should stress that there is not necessarily anything untoward about that email from Creative UK; it could be perfectly legitimate for the relevant organisations to liaise regarding a response to a request for information pursuant to FOIA. Indeed, depending on the circumstances and the information which has been requested, it can be necessary for a public authority to check with a relevant third party about whether or not disclosure can be made or whether any particular exemptions are applicable. However, we make no findings regarding the nature of the interactions involving Creative UK. We do, however, consider that there is public interest in transparency regarding the relationship between relevant organisations, given the proposed establishment of the Creative Industries Independent Standards Authority, which is relevant also to our finding that the Appellant was pursuing legitimate interests. We are also of the view that the Appellant had a legitimate interest in understanding that the Previous Request was handled properly.[66]Consequently, we do not agree with the Commissioner’s view, in paragraph 48 of the Decision Notice, that it was not necessary to disclose the names of external individuals other than the Appellant’s ‘desire’ to see them. Whilst the Decision Notice recorded the Appellant’s concern about understanding if there had been co-ordination between the BFI and other agencies in respect of the Previous Request and whether it had been handled properly, we consider that the Commissioner erred in concluding that there was simply a private interest on the part of the Appellant in understanding the names of the individuals, as opposed to the wider legitimate interests which were being pursued.[67]Based on the information available to us, we could see no basis on which those legitimate interests could be met by other, lesser, means other than disclosure via FOIA. We therefore find that disclosure of personal data was necessary, for the purposes of the second limb of the Legitimate Interests Test.[68]As we have noted, the Commissioner did not consider the third limb of the Legitimate Interests Test for the purposes of the Decision Notice. We also did not have any submissions from the Commissioner regarding that limb, nor any evidence regarding matters such as the expectations of the relevant individuals. Therefore we have not been able to form a view as to the outcome of that limb. However, it is sufficient for current purposes to find that the Commissioner erred in the Decision Notice by concluding that the BFI could rely on section 40(2) to redact the personal data of individuals outside of the BFI contained in the Disclosed Information.

Were redactions erroneously made in respect of section 43?

[69]As we noted in paragraph 48, various redactions appear to have been made in the Disclosed Information in respect of exemptions other than those which the Decision Notice concluded could be relied on by the BFI. Apart from the example we gave in that paragraph, there were also instances where the Disclosed Information contained text in red font stating “Redacted Reveals Funding”. It was these apparent redactions which formed the basis of the Appellant’s grounds of appeal regarding the BFI making redactions relating to commercially sensitive information whilst not citing section 43.[70]Again, without the benefit of a closed bundle containing an unredacted version of the Disclosed Information or any other supporting evidence, we were unable to ascertain whether or not section 43 would be an appropriate exemption which the BFI could rely on in order to withhold the relevant information. However, given that the Decision Notice only addressed the applicability of section 40(2) in respect of the Disclosed Information, it is self-evident that the Commissioner erred in not also considering other exemptions, such as section 43, when the Disclosed Information appeared to contain redactions based on other exemptions.[71]We would also note that the Appellant raised his concerns about these redactions and the potential application of section 43 in correspondence with the Commissioner dated 19 February 2024. Notwithstanding this, the Commissioner did not address these redactions in the Decision Notice (or, indeed, any of the other apparent redactions in the Disclosed Information which we have referred to, other than in respect of section 40(2)).[72]For those reasons, we find that the Decision Notice involved an error of law in not addressing other potential exemptions in respect of the information which was withheld by the BFI in the Disclosed Information.

Other points

[73]For completeness, we briefly turn to one other point from the Appellant’s grounds of appeal.[74]The Appellant asserted in his grounds of appeal that the Commissioner’s case officer did not have a “proper grasp” of the complaint leading to the Decision Notice and at one point (in correspondence with the Appellant dated 25 March 2024 regarding the complaint) had purported to close the case with no decision notice. Whilst it was incumbent on the Commissioner to issue a decision notice pursuant to section 50 (and ultimately the Decision Notice was issued, of course), we have no jurisdiction to assess or determine whether or not there was any irregularity or other deficiency in the Commissioner’s investigation.[75]As we noted in paragraph 14 (and summarised in paragraph 15), the scope of the Tribunal’s jurisdiction relates to the lawfulness of the Decision Notice. Any other issues are beyond the Tribunal’s powers to determine and fall outside of the scope of the appeal. Accordingly, the Tribunal’s jurisdiction does not extend to any matters regarding the conduct of the Commissioner’s investigation prior to the issue of a decision notice under section 50 of FOIA. Put another way, the Tribunal does not conduct a judicial review of the Commissioner’s activities. It is therefore outside of our remit to make any finding in respect of the Commissioner’s conduct of his investigation leading to the Decision Notice.[76]However, as part of the Tribunal’s remit, we may review any relevant findings of fact in the Decision Notice and may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned). That is what we have done.

Final conclusions

[77]For all of the reasons we have given, we find that the Decision Notice involved an error of law in concluding that personal data could be withheld from the Disclosed Information pursuant to section 40(2). We also find that the Decision Notice involved an error of law in not addressing the apparent withholding of information in the Disclosed Information in purported reliance on other potential exemptions.[78]We therefore allow the appeal and we make the Substituted Decision Notice as set out above.