The Information Commissioner v Amanda Hart [2025] UKFTT 509 (GRC)

[2025] UKFTT 00509 (GRC)Appeal Number: FT/EA/2024/0060
First-Tier Tribunal
(General Regulatory Chamber)
Information Rights
The Cabinet OfficeAppellant:The Information CommissionerFirst Respondent:Amanda HartSecond Respondent:Date and type of Hearing: Various dates and adjournments from 13 January 2025 with Case Management Directions and oral Submissions culminating in panel deliberations and decision on 02 May 2025.Panel: Judge Kennedy KC , and Specialist Members Kerry Pepperell and Naomi MatthewsDate of Final Decision: 03 May 2025.The Appellant: Oliver Towle, GLD and Fraser Campbell of Counsel.The First Respondent: Christian Davies, Nicholas Martin of the ICO.
Between
The Cabinet OfficeAppellantThe Information CommissionerRespondentAmanda HartRespondentDate and type of Hearing: Various dates and adjournments from 13 January 2025 with Case Management Directions and oral Submissions culminating in panel deliberations and decision on 02 May 2025.RespondentPanel: Judge Kennedy KC , and Specialist Members Kerry Pepperell and Naomi MatthewsRespondentDate of Final Decision: 03 May 2025.Respondent for Second Respondent: Amanda Hart as a Litigant in Person.The Tribunal have received voluminous papers and submissions in this appeal most of which are contained in Authorities Bunldles (“AB”), Open Bundles (“OB”) and a Closed Bundle (“CB”)Result: –The Tribunal allow the Appeal.REASONSDate 2025-05-09

Introduction:

[1]This is an appeal by the Cabinet Office (“CO”) against a Decision Notice (“DN”) of the Information Commissioner (“IC”) dated 22 January 2024.[2]The DN was made in respect of a request by Ms Amanda Hart (“the Second Respondent”), for the job titles of staff members working in Downing Street who have been fined by the Metropolitan Police Service (“the police”) for breaking lockdown regulations. The basis for the request was the allegation that some penalty notices may have been sent to Government email addresses.[3]In the DN, the IC concluded on the balance of probabilities that the Cabinet Office held information within the scope of the request for the purposes of s.3(2)(a) of the Freedom of Information Act 2000 (“FOIA”).[4]The appeal has to be understood in two parts and that is the IC’s position prior to the DN and at a later stage after further inquiries and investigations by the CO resulting in the IC withdrawing their support for the appeal in an e-mail dated 23 September 2024. The Tribunal feel it is important to understand the reasons for the distinct change in the IC’s position before and after the CO’s further investigation made post the DN.[5]The CO appeal against the DN on the grounds that the IC erred in its application of s. 3(2)(a) of FOIA to the true facts and the CO submits as the IC’s decision proceeded on the basis that the CO had confirmed (in error) it held the requested information in the form of emails held on its servers and that it may have required its employees to disclose if they had received fixed penalty notices when it seems in fact it did not. On the contrary, it is now argued the CO advised its employees to provide the police with a personal email address if they so wished, and gave its employees various express assurances that the receipt of a fixed penalty notice (“FPN”) was a private matter which they would not be required to disclose and which would not form the basis of any internal disciplinary process and as a consequence, and in any event, the IC failed properly to apply the law on:(i) when an employee’s private emails which are held on a public authority’s servers are “held” by the authority for the purposes of s. 3(2)(a); and(ii) the reasonable expectation of privacy attaching to (a) private correspondence and (b) police investigations pre-charge.[6]The CO now submit the actual position is that, if the police sent any fines by email to the CO employees’ Government email addresses, such that they are ‘physically held’ by the CO on its email servers, those emails are its employees’ private correspondence which are not held by the Cabinet Office for the purposes of s.3(2)(a).[7]Furthermore, the CO submit it never required its employees to disclose if they had received a fine. The CO therefore maintains it does not hold the requested information for the purposes of FOIA.

Background to the Requested Information:

[8]Under regulation 10(1) of the Health Protection (Coronavirus, Restrictions) (England) Regulations 2020 (“the Regulations”), an authorised person could issue an FPN to anyone in England that they reasonably believed had committed an offence under the Regulations.[9]Regulation 10(2) of the Regulations provides that an FPN is a notice offering the person to whom it is issued the opportunity of discharging any liability to conviction for the offence by payment of a fixed penalty to an authority specified in the notice.[10]A FPN is a civil penalty, not a criminal conviction or a finding of guilt. FPNs do not appear on a basic or standard disclosure and barring service check because they are not a conviction, caution, reprimand or final warning.[11]On 31 March 2022, the Second Respondent wrote to the CO and requested the following information: “From available records, please kindly provide the job titles of staff members working in Downing Street who have been fined by the MPS [Metropolitan Police Service] for breaking the lockdown regulations to-date”.[12]The CO responded on 3 May 2022, denying that it held the information. Following an internal review, the CO wrote to the Second Respondent maintaining its position. The Second Respondent complained to the IC.[13]The respective positions of the CO and the Second Respondent are recorded in the DN.

The Appellants Submissions:

[14]The CO has summarised the positions in that the Second Respondent drew attention to an extract from the the-Second Permanent Secretary’s report into alleged gatherings on government premises during Covid restrictions, which stated (DN,para.19):
“It does not follow that any of those I have referred to in this report, named or otherwise have received an FPN, or that any inference or assumption can be made about the outcome of the police investigation in any individual case. As I have set out above, I have not been informed by the Metropolitan Police of these matters.”
[15]The Second Respondent nevertheless argued that the report “does not negate the fact that the Cabinet Office could possess the job titles of the fined individuals based on the fines being delivered to government email addresses”, and asserted that it had been widely reported that fines were delivered to government email addresses (DN, paras. 23-24).[16]The DN records at footnote 5 that:
“Although the complainant did not provide evidence to support that claim, the Commissioner is aware from his own research of the following; https://www.dailymail.co.uk/news/article-10680383/Downing-Street-staffmissed-Partygatefines- sent-junk-email-folders.html.”
[17]The Daily Mail article to which the DN refers is dated 3 April 2022 and titled “Downing Street staff missed their Partygate fines – as they were sent to junk email folders”. It stated, so far as material, “Downing Street staff initially missed their 'Partygate' fines – because they landed in their email junk folders… insiders said workers are now frantically checking their spam mail to see if they've been found in breach of the laws.” The article did not state that the email addresses to which the fines were sent were Government email addresses, but only refers generically to “junk email folders”; “email junk folders” and “spam mail”.[18]The article also recorded, relevantly and accurately, that “Police are issuing fines directly to staff and so far they have not been required by No10 or the Cabinet Office to reveal they received them.” The Second Respondent further argued, the CO may hold the requested information as a result of internal investigations, through its HR functions taking action to address any legal issues its employees might face, or because “learning from past incidents is crucial in preventing similar violations in the future” (DN, para. 26). The CO’s position is recorded in its letter to the IC dated 20 November 2023, aspects of which are recorded inaccurately in the DN wherein the CO indicated that it does not gather information about which officials receive civil penalties (20 November 2023 - letter, p. 2) and in relation to the Second Respondent’s suggestion that FPNs may have been delivered by email to the work email addresses of CO employees, the CO explained that, even if hypothetically that had been the case, no such information “would be held for its own purposes within the scope of the request” (p. 3). The CO’s arguments on s.3(2)(a) of FOIA were expressly premised on addressing a hypothetical scenario in which FPN’s had been delivered to its employees’ work email addresses, such that the CO held that information on its servers. As to s. 3(2)(a) of FOIA, the CO argue that even if information about FPNs was on its systems, it had no use for, or legitimate interest in, private emails received by its employees on their work email accounts. The CO would merely be providing storage for private emails received by its employees. The receipt of private emails to work email accounts was permissible under CO guidance. The CO did not require its staff to disclose if they had received FPN’s, nor any other civil fine. The receipt of an FPN from the police was, therefore, a purely private matter for the person affected. The DN at para.38 proceeded straight to the application of s. 3(2)(a), because it proceeded on the mistaken premise that the CO had confirmed that it physically held the requested information and stated at para. 43: “…the Commissioner finds it implausible that the Cabinet Office would have no use for, or legitimate interest in, the information in the scope of the request which it confirmed it holds."[19]The CO submit this error stems from the fact that the CO, in its submissions to the IC, addressed the argument that if, hypothetically, FPNs had been sent to the work email addresses of CO employees, such information would not be held by the CO for the purposes of s.3(2)(a)of FOIA.[20]The DN’s conclusions (at paras. 53-54 DN) repeated the same error. The IC’s conclusions referred only to the CO not being entitled to conclude that the information “was not held for the purposes of FOIA”. It wrongly assumed that the CO had confirmed that it physically held the information.[21]The CO submit no such confirmation had been given by the CO, and as well as being erroneous in that regard, it appears the DN did not reflect any account having been taken of the facts that:(i) the Requester had sought information from available records on 31 March 2022; but(ii) the police had only announced the relevant investigation on 25 January 2022; and(iii) as at the end of March 2022, press reports were speculating that FPN’s might be imminent but did not claim that any had actually been issued to their recipients, and nor had the police indicated that any had yet been issued. Accordingly the CO now submit simply from a timing perspective and leaving aside further issues, there were no grounds for the speculation in the DN that, by the time of the request, FPNs might have been disclosed to the CO.[22]The IC (at paras. 44-47 DN) addressed various matters which appear either to have been speculation as to why the CO may have a legitimate interest in information contained in its employees’ private emails, or as to means by which it might otherwise have subsequently acquired such information. The two are not clearly distinguished. At para. 44 DN, the IC stated that it found it “highly unlikely” that where FPN’s related to offences committed on government premises, the CO would not have an interest in that information to any extent.[23]In the DN, the IC stated that it “would expect that”, in light of media attention, the CO would take action such as “initial HR enquiries, providing support and advice to those concerned, considering whether any disciplinary action was warranted and reviewing lessons learned given that some events led to fines and some did not” (see para. 45DN).[24]The IC found it was “not implausible” (see para. 46DN) that the CO would require its staff to inform them if they received a fine (para. 46DN), and any such follow-up action would constitute an appropriate connection with the role and functions of the CO as a public authority (para. 47DN).[25]The IC then referred (see paras. 48-52DN), to oral evidence provided by the Cabinet Secretary to the Public Administration and Constitutional Affairs Committee (“PACAC”) on 28 June 2022, which the IC stated “both informs and supports his decision about whether the information is ‘held’ in the context and circumstances of the request”. The CO submit is unclear if the purpose of this reference is to assert that the CO has a legitimate interest in information contained in its employees’ private emails, or to suggest that it might have otherwise acquired such information.[26]The IC referred (at para. 52 DN) to an answer by the Cabinet Secretary in which he stated CO employees “will be considered against a number of different criteria” as part of the disciplinary process. From this, the IC infers that:
“It is reasonable to conclude that the requested information would have formed part of this.”
However, there is nothing in the quoted passage to suggest that the CO holds information on employees who received FPNs.[27]The IC concluded by stating that he could not be satisfied that the CO does not hold any information within the scope of the request for its own purposes in addition to any other purpose that it is held for (para. 53DN), and therefore: “the CO was not entitled to conclude that the information was not held for the purposes of FOIA” (para. 54DN).[28]The Legal Framework is that when information is “held” by a public authority for the purposes of FOIA, S. 3(2)(a) of FOIA provides that information is held for the purposes of FOIA if “it is held by the authority, otherwise than on behalf of another person”.[29]In the DN the following factors were “useful matters to consider”, but not “definitive tests”: and describes whether the public authority was able to “(i) manage and control that information, (ii) edit and delete the information without the owner’s consent, (iii) have unrestricted access to the information; (iv) apply its own policies and procedures to the information, and (v) decide whom to send it to or whom to withhold it from” (para. 49DN).[30]The IC’s guidance on s. 3(2)(a) provides its own version of these factors, which are said to derive from BUAV v Information Commissioner [2010] UKFTT 525 (GRC), which decision the UT upheld on appeal at [2011] UKUT 185. They are:(i) the extent to which the public authority has access to the information;(ii) the degree of control the authority has over the information, including controlling who has access to it and how it is used;(iii) the extent to which the authority uses it for its own purposes, regardless of whether it was created by a third party;(iv) the extent to which the authority had an input in its creation or alteration;(v) the extent to which the authority retains ultimate responsibility over the management of the information, including its retention and deletion; and(vi) whether the authority is merely providing storage, either on its physical premises or on its electronic and cloud systems.[31]In Voyias v Information Commissioner and London Borough of Camden EA/2012/0096, the applicant requested a copy of all correspondence sent and received by a named councillor on their official email account on a particular day. The FTT held that the council did not hold the councillor’s private correspondence. At para.

(c) it stated:

“The requested information that relates purely to private correspondence is not held on behalf of the authority even though it has been sent to the councillor’s work email address. This is because there is not a sufficient nexus between the information and the authority. The information is not work-related and did not arrive at the council server by virtue of the councillor’s work as a councillor or any job he performs for the Council. The fact that the emails are in some way on local authority premises is incidental to the local authority itself. This is similar to a council employee receiving a birthday card in his office and leaving it in his office desk. (In response to the Appellant’s concern, we would note that we agree that simply labelling information as ‘private’ would not be sufficient to avoid the application of FOIA to it. We have considered the particular emails, and are satisfied that they are purely private in their substance or quality.)”
[32]The CO observes, that the requested information is not confined to FPN’s related to offences committed on government premises, but extends to any FPN’s received by any of its employees for breach of the Regulations.

Reasonable expectation of privacy:

[33]The CO submits first, an employee may have a reasonable expectation of privacy in relation to private emails held on their employers’ email servers: Brake v Guy [2022] EWCA Civ 235 and the cases cited therein. In that case the Court of Appeal regarded as “highly significant” the distinction between emails held on a general enquiries account to which other employees had access, in respect of which there was on the facts no reasonable expectation of privacy, and an account in the employee’s own name, in respect of which the “obvious inference” is that there was such an expectation (para. 61).[34]Second, the “starting point”, for persons under investigation by the police is that they have a reasonable expectation of privacy in respect of the fact and details of that investigation up until the moment of charge; and, if they are not charged, the reasonable expectation of privacy continues: ZXC v Bloomberg LP [2022] UKSC 5, [2022] AC 1158, para. 146 and the cases cited therein.[35]In their detailed submissions to this Tribunal the CO have provided a detailed and compelling analysis of the key facts correcting the inaccuracies and inacurate assumptions on which they argue the DN was based.

The Second Respondents Submissions:

[36]The Second Respondent have set out their understanding of the CO position suggesting the CO contends it does not 'hold' the requested information within the Freedom of Information Act (FOIA) framework, arguing that the information, if it exists in the form of emails about fixed penalty notices (FPN’s) on its servers, is considered private correspondence of the employees and is not held by the CO for FOIA purposes.[37]The Second Respondent argue that given the CO's legal obligations under the Health and Safety at Work etc. Act 1974, the Employment Rights Act 1996, and adherence to the Civil Service Code, there is an undeniable legal and operational necessity for the CO to be informed about any fines issued to its staff for lockdown breaches occurring on its premises. This imperative arises, they submit, from the need to maintain a safe working environment, uphold the integrity and ethical standards expected of public service, and manage the consequences of employees' actions, particularly those that contravene public health guidelines.[38]The Second Respondent contends the assertion that the CO would not have an interest in such matters contradicts its responsibility as an employer to ensure workplace safety, manage disciplinary actions appropriately, and maintain public trust. Moreover, the argument that these emails, should they exist, represent purely private correspondence overlooks the fact that the content directly pertains to professional conduct and compliance with legal obligations within the workplace. Therefore, the distinction the CO attempts to make between the information being 'held' for FOIA purposes and its operational interest in such information is, they argue, flawed. The Second Respondent contends legal framework and operational realities dictate that the CO must, out of necessity, be interested in fines issued for lockdown breaches. This interest further necessitates that such emails, if they exist, are indeed 'held' within the FOIA context, as their content directly impacts the CO's duty to uphold legal, health, and ethical standards.[39]Therfore, the Second Responsdent asserts this request explicitly sought the "job titles of staff members working in Downing Street who have been fined by the MPS for breaking the lockdown regulations to-date," in order to highlight a clear distinction between seeking personal correspondence and requesting information relevant to the CO's public duties and responsibilities. The Second Respondent’s submissions to the IC prior to the DN also provided a long and detailed argument as to why job titles of CO staff cannot be regarded as personal information.[40]The reason the Second Respondent requested this information for the job titles of individuals involved in the breaches at the CO stems from the dedication to transparency and accountability that the Second Respondent aims to achieve in seeking this information, is to bring to light the specific areas within the CO where lapses in judgment by staff persisted without intervention until information was leaked, ultimately resulting in the imposition of fines.[41]The Second Respondent contends, it is vital to underscore that this request exclusively pertains to job titles and does not intend to identify specific individuals. By gaining insight into the job titles of those involved, the public can evaluate the specific areas of the organisation that may have experienced ineffective leadership, leading to a failure to prevent these individuals from breaking the law. The Second Respondents also acknowledge that individuals involved bear responsibility for their actions, and this request places focus on the broader context of accountability within the CO. It is the Second Respondents belief that this incident has highlighted a more extensive issue where staff may have felt empowered to act without proper oversight. The Second Respondent submits, the CO’s appeal lacks merit when considering the legal obligations and operational imperatives that necessitate awareness and action regarding FPN’s issued to its staff. The information sought is not only pertinent to maintaining public trust and legal compliance but is also critical for ensuring the health, safety, and ethical conduct within the CO, thereby affirming that the requested information is 'held' for the purposes of the FOIA.

The Appellants Further Submissions:

[42]The Tribunal have received a “Final Hearing Skeleton Argument” from the CO dated 12 November 2024, which contains comprehensive and compelling submissions arising since the DN was issued, and submit there have since been several important developments in the positions of the parties to this appeal.[43]The DN was based inter-alia on the perceived likelihood of emails relating to FPNs having been received by staff members of the CO through their work email accounts. Following the DN, and despite opposing its findings, and as a result of further to case management directions from the Tribunal, the CO carried out several additional searches in an effort to narrow the factual dispute between the parties, and provided further factual clarifications. See in particular the witness statement by Helen Lederer CBE, Director of Corporate Services at No 10 Downing Street [OB/10/C6, para. 24f].[44]The witness explains inter-alia that:(i) internal disciplinary proceedings and police actions were consistently and expressly kept separate from each other;(ii) no list of individual staff members who received fines was available on 31 March 2022, when the request was made, or indeed has been generated since the request [OB/10/C6, para. 19(f)].[45]In response to this explanation, the IC in an email dated 23 September 2024 at 11:53am confirmed it would concede this appeal:
“The Commissioner has reviewed his position based on the submissions and evidence filed by the Cabinet Office on appeal, which were not before the Commissioner during his investigation. Having done so the Commissioner can confirm that he concedes this appeal … on the basis that the Commissioner is satisfied that no information was held within the scope of the request at the time of the request (the two emails identified by the Cabinet Office being outside the scope of the request in the Commissioner’s view). The Commissioner has reached this decision based on the further details and evidence provided during the course of the appeal, and particularly given factors such as the timing of the request, the separation of the criminal and disciplinary proceedings, the fact that most staff did not use their Cabinet Office email addresses, and the searches that have been undertaken.”
[46]On 23 September 2024, the Second Respondent wrote to the Tribunal explaining that they would continue to contest the CO’s appeal on the basis that it is believed the CO holds a list of all staff members who received fines, or other information from which a list might be created.[47]In light of these developments, the CO now submits that there are two relevant issues in dispute flowing from the DN, namely whether:(i) the CO possesses information in the scope of Second Respondents request at all (which is denied); and(ii) if so, whether any emails sent to individuals are “held” by the CO under section 3(2)(a) FOIA.[48]The CO submit firstly, it did not possess any information within the scope of the request at the time of the request, including the Emails and secondly, and in any event, those emails are not “held” by the CO for the purposes of section 3(2)(a) FOIA.[49]Under regulation 10(1) of the Health Protection (Coronavirus, Restrictions) (England) Regulations 2020 (“the Regulations”), an authorised person could issue an FPN to anyone in England that they reasonably believed had committed an offence under the Regulations. An FPN offers the recipient the opportunity to discharge any criminal liability for the alleged offence through the payment of a fixed penalty.[50]In early 2022, there was press reporting in relation to gatherings that took place in Downing Street during the Covid-19 pandemic. Sometime in February 2022, the police announced that they were investigating potential breaches of the Regulations by participants in these gatherings. Towards the end of March 2022 there was somereporting that FPNs were to be issued to, inter alia, staff members of the CO.[51]On 31 March 2022, the Second Respondent wrote to the CO and requested the following information:“From available records, please kindly provide the job titles of staff members working in Downing Street who have been fined by the MPS [Metropolitan Police Service] for breaking the lockdown regulations to-date”.[52]The full background to this appeal is set out in the Grounds of Appeal attached to the CO’s Notice of Appeal on 19 February 2024 [OB/2/A25, paras.6-21].[53]The legal framework at Section 1(1) FOIA establishes a general right of access to information held by a public authority. As clarified in section 1(4) FOIA, ‘information’ under section 1(1) refers to “information…held at the time when the request is received”. The CO submits there are now two legal issues in respect of the general right of access to information relevant to this appeal.[54]Findings of fact about the existence of information mean the IC and the Tribunal are entitled to make findings of fact as to whether information requested pursuant to FOIA is in fact held by the relevant public authority. When making such a finding the relevant threshold is “not certainty but the balance of probabilities”: see Preston v Information Commissioner and CC West Yorkshire Police [2022] UKUT 344 (AAC)[29], endorsing Bromley v Information Commissioner and The Environment Agency (EA/2026/0072 [13].[55]In making this decision, the Tribunal should have regard, inter alia, to “the scope of the search” conducted by the public authority: Bromley [13]. Importantly, the “issue for the Tribunal is not what should have been recorded and retained but what was recorded and retained”: Preston [30]. When information is “held” by public authorities under FOIA Section 3(2)(a) FOIA clarifies that information is “held” by public authorities if “it is held by the authority, otherwise than on behalf of another person”. The leading case on whether information belonging to another person is “held” under section 3(2)(a) is BUAV v Information Commissioner [2010] UKFTT 525 (GRC) [48], which was approved by the UT on appeal ([2011] UKUT 185 (AAC) [27]). This clarifies that: FOIA “would not apply merely because information is contained in a document that happens to be physically on the authority’s premises: there must be an appropriate connection between the information and the authority, so that it can properly be said that the information is held by the authority”. For example, “an employee of the authority may have his own personal information on a document in his pocket while at work, or in the drawer of his office desk: that does not mean that the information is held by the authority” ([48]).[56]The following factors were “useful matters to consider”, but not “definitive tests”: whether the public authority was able to “(i) manage and control that information, (ii) edit and delete the information without the owner’s consent, (iii) have unrestricted access to the information; (iv) apply its own policies and procedures to the information, and (v) decide whom to send it to or whom to withhold it from” ([49]).[57]In Voyias v Information Commissioner and London Borough of Camden EA/2012/0096, the applicant requested a copy of all correspondence sent and received by a named councillor on their official email account on a particular day. The FTT held that the council did not hold the councillor’s private correspondence. It stated that: “The requested information that relates purely to private correspondence is not held on behalf of the authority even though it has been sent to the councillor’s work email address. This is because there is not a sufficient nexus between the information and the authority. The information is not work-related and did not arrive at the council server by virtue of the councillor’s work as a councillor or any job he performs for the Council” ([23](c)).[58]As a more recent example, the Tribunal in Farfan v Information Commissioner and Governing Body of the University of Central Lancashire [2024] UKFTT 896 (GRC) held that correspondence sent by a University Vice-Chancellor was not “held” by the University because the emails were not sent by him in his capacity as Vice-Chancellor and he was entitled to use his email account for other purposes: see in particular at [67].[59]By way of further context, the law is that an employee may have a reasonable expectation of privacy in relation to private emails held on their employer e-mail servers: Brake v Guy [2022] EWCA Civ 235 and the cases cited therein. In that case the Court of Appeal found that there was an “obvious inference” of privacy in respect of an account in the employee’s own name ([61]). This expectation of privacy also applies in the context of criminal investigation. The “starting point”, for persons under investigation by the police, is that they have a reasonable expectation of privacy in respect of the fact and details of that investigation up until the moment of charge; and, if they are not charged, the reasonable expectation of privacy continues: ZXC v Bloomberg LP [2022] UKSC 5, [2022] AC 1158 [146] and the cases cited therein.[60]The DN in this appeal is addressed in detail in the CO’s Grounds of Appeal, [OB/2/A28, paras. 22-25]. In summary, the IC made two findings. Firstly, the IC found that, on the balance of probabilities, the CO was in control of the requested information. The IC “expected” that, in light of the media attention surrounding the issuing of FPN’s to Government officials, the CO would have information in relation to, for example, human resources enquiries, welfare reports or disciplinary action falling within the scope of the request [OB/1/A8, para. 45]. Further, “it was not implausible” that the CO would require its staff to declare that they received an FPN [OB/1/A8, para. 46]. Secondly, the IC found that the CO “held” this information for the purposes of FOIA. The IC considered it “implausible” that the CO did not have a “legitimate interest” in the information within the scope of the request [OB/1/A8, para.43]. Further, the IC considered that because there was evidence to suggest that the conferral of an FPN triggered disciplinary proceedings against individual staff members, such information was “held” for the purpose of FOIA [OB/1/A9, paras. 48-49 and 51].[61]The CO submit there are consequently two issues for consideration by the Tribunal under this appeal. Firstly, whether on the balance of probabilities the CO is in possession of the requested information.Secondly, whether the Emails are “held” by CO under section 3(2)(a)FOIA. Does the CO have further information within the scope of the request? The Second Respondent requested a list of the job titles of staff members of the CO who had been fined under the Regulations. As a matter of analysis, this information could take one of two forms.The CO could have access to primary information about staff members who have received FPNs in the form of an email to a staff member’s work account. However, it is important to note that the request relates specifically to “staff members…who have been fined”. It was open to the staff members to refuse any subsequently issued FPN, in which event their case could be determined by a court no sooner than 28 days after the date of notice (regulation 10(4)).[62]Additionally or alternatively, the CO could have secondary information on staff members who received fines, in the form of documents referring to these fines and identifying individuals. For example, the IC considered it possible that the CO held human resources, welfare or disciplinary records in respect of fined individuals [OB/1/A8, para. 45]. Similarly, while the Second Respondent suggests that there may exist meeting notes and internal communications (her email dated 19 July 2024) as well as health and safety reports (see email dated 22 July 2024) identifying certain individuals who had been fined. However, the existence of secondary information necessarily depends on staff members having received FPNs on or before 31 March 2022; but there is no reason to believe that any did so. Further, as set out in the witness statement of Ms Lederer; - Firstly, information as to the names of individuals who received FPNs was never provided by the police to the CO. While the police had contacted the CO’s ‘Liaison Unit’ to ask for the contact details of certain CO staff, the police did not provide a list of individuals who received FPNs [OB/10/C5, para. 18]. This has been confirmed by the CO’s search through all physical records of the Liaison Unit [OB/10/C8,para.24(d)]. Further, no such information was ever published by the police, as far as the CO is aware [OB/10/C6, para. 19(c)]. Secondly, the CO expressly did not require its staff members to disclose whether they had received an FPN [OB/10/C6, para. 19(a)], contrary to the assumption of the IC [OB/1/A8, 46]. While staff members were welcome to seek support from the CO and employee support functions in relation to the police’s investigation, staff were not required to disclose if they had received an FPN [OB/10/C6, para. 19(b)]. Thirdly, no staff member in fact chose to volunteer the fact that they had received an FPN, either before or after the date of the request [OB/10/C6,para.19(e)]. Fourthly, while the identities of the two individuals who received the Emails regarding FPN’s to their work accounts, whjile they could in theory have been identified, theywere not in fact identified. The CO did not search work emails untilafter the IC’s DN on 22 January 2024 [OB/10/C8, para. 24(d)], long after the request for information on 31 March 12022. Fifthly, the Emails were expressly irrelevant to any internal disciplinary proceedings. Decisions on whether proceedings were to be initiated gainst any individual member of staff were made based on the of subjects of police investigation with regards to the facts and details of those investigations, prior to charge.[63]Receipt of an FPN does not constitute being charged. The general expectation of privacy is amplified in this specific case because of express assurances given by the CO to staff members that they were not required to disclose FPNs, and could choose to provide the police with a pureoypersonal e-mail address 9OB/10/C6, Para.

(a) ]

[64]Information gathered by the Second Permanent Secretary in the course of her investigation [OB/10/C5, para. 22]. This investigation was entirely separate from the work of the Liaison Unit which had been cooperating with the police [OB/10/C5, para. 22], and the Second Permanent Secretary had not received any information about who had received FPNs: [OB/1/A4, para. 21]. The IC was therefore incorrect to assume in the DN that the existence of disciplinary proceedings meant that the CO held a list of staff members who had received FPNs [OB/1/A8, paras. 49 and 52]. While the IC may have believed that such information should exist, this does not mean that it did exist : Preston [30]: For these reasons, the CO does not hold and has never held a list of staff members who received FPNs [OB/10/C6, para. 19(f)] or relevant information from which a list could be created. This was acknowledged by the IC in its concession of this appeal by e-mail date 23 September 2024.[65]Consequently,the CO submit, the DN was wrong to conclude that on the balance of probabilities the CO held the requested information.[66]Were the Emails “held” by the CO for the purposes of section 3(2)(a) FOIA? The second issue relates only to the two Emails received by staff members informing them that the police had reasonable grounds to suspect that they had committed anoffence under the Regulations. If the Tribunal considers that these fell within the scope of the request, contrary to the CO’s submissions and the revised position of the IC, the CO submit that the emails were in any event not “held” by the CO for the purposes of section 3(2)(a) FOIA. The facts relevant to this issue are set out in the CO’s Grounds of Appeal [OB/2/A32,paras.32-35].[67]The relevant test for determining whether information is “held” under FOIA is whether there is an “appropriate connection” between the contents of the emails and the CO (BUAV [48]), and not whether the CO has a “legitimate interest” in the information in these contents, as considered by the IC in the DN [OB/1/A8, para, 43]. The CO submits it did not hold this information. Firstly mere access to the emails is insufficient for them to be “held” for the purposes of section 3(2)(a) FOIA. Applying the guidance in BUAV, the CO did not:
“edit and delete the information without the owner’s consent…have unrestricted access to the information…, [or]…decide whom to send it to or whom to withhold it from”
. Instead, the CO’s express guidance was that “staff can make occasional and reasonable personal use of their work…email”: [OB/10/C8, para. 27]. Secondly, the fact that the FPN’s received by the staff members may have been in relation to activities carried out in the workplace does not establish an “appropriate connection”. In the DN, the IC’s decision as to the existence of an “appropriate connection” was based on the assumption of a link between an FPN and disciplinary proceedings [OB/1/A9, para. 51] which, as explained above, was incorrect. The CO engaged in its own internal review into workplace gatherings during Covid-19 through the investigation of the Second Permanent Secretary, which looked into individual conduct as well as wider administrative decision-making in the CO [OB/10/C7, paras. 22-23]. This investigation provided the CO with a basis to engage in disciplinary proceedings against individual staff members, without consideration of FPNs, and therefore displaced any “appropriate connection” between the e-mails and the CO. Thirdly, and in any event, the emails contain private information that cannot be held by the CO: Voiyas: - An expectation of privacy applies in this respect.

The Second Responents Further Submissions:

[68]By way of response to the above sumisssions on behalf on behalf of the Appellant, the Second Respondent repeats their earlier submissions and further submits that given the CO's legal obligations under the Health and Safety at Work etc. Act 1974, the Employment Rights Act 1996, and adherence to the Civil Service Code, there's an undeniable legal and operational necessity for the CO to be informed about any fines issued to its staff for lockdown breaches occurring on its premises. This imperative arises from the need to maintain a safe working environment, uphold the integrity and ethical standards expected of public service, and manage the consequences of employees' actions, particularly those that contravene public health guidelines.[69]The assertion that the CO would not have an interest in such matters contradicts its responsibility as an employer to ensure workplace safety, manage disciplinary actions appropriately, and maintain public trust.[70]Moreover, the argument that these emails, should they exist, represent purely private correspondence overlooks the fact that the content directly pertains to professional conduct and compliance with legal obligations within the workplace.[71]Therefore, they argue, the distinction the CO attempts to make between the information being 'held' for FOIA purposes and its operational interest in such information is flawed. The legal framework and operational realities dictate that the CO must, out of necessity, be interested in fines issued for lockdown breaches. This interest further necessitates that such emails, if they exist, are indeed 'held' within the FOIA context, as their content directly impacts the CO's duty to uphold legal, health, and ethical standards. The request explicitly sought the "job titles of staff members working in Downing Street who have been fined by the MPS forbreaking the lockdown regulations to-date," highlighting a clear distinction between seeking personal correspondence and requesting information relevant to the CO's public duties and responsibilities. (The Second Respondent submissions to the ICO prior to the DN also provided a long and detailed argument as to why job titles of CO staff cannot be regarded as personal information).[72]They argue, the reason for the request for the job titles of individuals involved in the breaches at the CO stems from dedication to transparency and accountability. The aim in seeking this information is to bring to light the specific areas within the CO where lapses in judgment by staff persisted without intervention until information was leaked, ultimately resulting in the imposition of fines. It is vital to underscore that this request exclusively pertains to job titles and does not intend to identify specific individuals.[73]The Second Respondent maintain that by gaining insight into the job titles of those involved, the public can evaluate the specific areas of the organisation that may have experienced ineffective leadership, leading to a failure to prevent these individuals from breaking the law. While they also acknowledge that individuals involved bear responsibility for their actions, and this request places focus on the broader context of accountability within the CO, the Second Respondert believe that this incident has highlighted a more extensive issue where staff may have felt empowered to act without proper oversight.[74]The Second Respondent submits, this appeal lacks merit when considering the legal obligations and operational imperatives that necessitate awareness and action regarding FPN’s issued to its staff. The information sought is not only pertinent to maintaining public trust and legal compliance but is also critical for ensuring the health, safety, and ethical conduct within the CO thereby affirming that the requested information is 'held' for the purposes of FOIA[75]In relation to the belated withdrawal from the by the IC, the Second Respondent submits the following; a) The IC’s consent to the order is premature.The IC is consenting to the withdrawal of the appeal without any independent verification of the CO’s claim that it does not hold the requested information. As detailed in an earlier response the Second Respondent asserts this claim remains unsupported by concrete evidence. Additionally, the late presentation of new evidence by the CO underscores the necessity of an independent review to ensure full transparency and accountability. b) The IC’s position disregards the public interest: The IC’s willingness to consent to the withdrawal of the appeal does not reflect the substantial public interest in confirming whether the CO holds records regarding staff fined for breaching lockdown regulations. Legal obligationsunderhealth and safety lawsmust be thoroughly examined before any consent order can be accepted. c) The seriousness of the legal implications, previously outlined in submissions in that the failure to maintain or disclose this information could have criminal implications for the CO. The IC’s revised stance, made without a full and independent review of the evidence, does not reflect the gravity of the legal and ethical issues involved. Given the late stage of these proceedings and the ongoing inconsistencies in the CO’s handling of this matter, the Second Respondent respectfully ask the Tribunal to consider the IC’s position in light of these concerns. d) The CO’s refusal to disclose the requested information—or their claim that they do not hold it—constitutes a serious admission of legal failings. This appeal must continue to expose procedural and accountability failures within the CO. The Tribunal has a duty to rule on whether the information exists and whether a more thorough search must take place. To allow the CO to evade its legal responsibilitieswould set a dangerous precedent for government transparency and accountability, and it would deprive the public and staff of recourse in future cases. Should the Tribunal find that the information does not exist, it would open the door to criminal liability for gross negligence in protecting the safety of staff. e) The Tribunal’s role in ensuring transparency and accountability is paramount when the IC has consented to the withdrawal without resolving the key issues at the heart of this appeal. f) The Second Respondent respectfully submits that the Tribunal should not allow the withdrawal of this appeal without first ordering an independent search or conducting a thorough investigation into whether the CO holds the information requested. The public interest demandsthat this matter is fully examined and the Second Respondent trust the Tribunal will carefully consider the implications of its ruling.

Discussion:

[76]The Tribunal reminds itself and the parties of Rule 2 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 and Overriding objective and parties' obligation to co-operate with the tribunal using any special expertise of the Tribunal effectively.[77]Pariament expressed the importance of the delicate balances sought in issues arsing under the FOIA with extensive safeguards in the use of exemptions. Precious rights, including privacy, confidentiality and freedom of speech all have to be balanced carefully with the desired outcome for transparency and accountability. The Tribunal are acutely aware of the fine balance to be achieved on hre issues herein and have ultimately been satisfied in all the circumstacnes that the appeal should be allowed. We have been persuaded on this by the Appellants submissions as set out above.[78]In this appeal none of the Parties deny the importance of engaging the exemption relied upon and of the significant interest by members of the public. However the Tribunal and the parties must not confuse the interest that members of the public may have in any particular case with the public interest in the disclosure to the world at large in the subject matter of a request under the FOIA. The Public Interest in the fair and proper applcation of the many exemptions when appropriate is what is of parmount importance. In some cases the interest the public may have in the subject matter can outweigh the fair, proper and proportionate assessment of the applcation of exemptions and what can or cannot be held to be in the Public Interest in disclosure to the world at large. Furthermore it is often the case that the public seem to believe the powers of this Tribunal enable much more drastic action than actually exists. This appeal exemplifies both these tensions.[79]Having considered all the available evidence the Tribunal are now satisfied that the searches undertaken by the CO were adequate as is evidenced by two further searches which have revealed two emails that were not within the scope of the request.[80]Through the information in the CB this Tribunal are aware that the closed material indicated that FPN’s would be sent out via email from ACRO, and we are not aware of, and cannot assume any other search terms which could or would have been available or invoked.[81]We note the search terms considered on A66 OB “… The email accounts of Cabinet Office employees based in No 10 Downing Street were searched up to and including the date of the request (i.e. 31 March 2022) for emails:(i) containing the phrase “operation hillman” (i.e. the name of the relevant Metropolitan Police investigation);(ii) from the domain “met.police”;(iii) containing the expression “FPN”;(iv) from ACRO Criminal Records Office (i.e. the body that sends out Covid-19 FPNs on behalf of the Metropolitan Police); and/or(v) containing the phrase “reasonable grounds to believe” and we further observe at 3.2. “Emails responsive to any of those search terms were reviewed.” And at 3.3. “The only potentially relevant emails found were two emails from the Metropolitan Police, each notifying a different staff member, and the staff member alone, that their details were to be passed to ACRO so that ACRO could invite them to accept a FPN and thereby discharge any liability to conviction forthe offence.”[82]The date is significant as para 5 of A66 in the OB where it stated; “It is possible that the Cabinet Office holds information post-dating the date of the request that reveals the identities of those who received FPNs, but searches have not been conducted because they would be outside the terms of the request as well as expensive and time-consuming.”.[83]The Tribunal recognise the relevance of the initial lack of proper searches (as noted by the IC, “the sort of diligent response to be expected of the CO”) and the contrast of those undertaknen belatedly after the DN and as a result of our case management directions as referred to above. However we note again (and repeat for the sake of emphasis) that the IC has reviewed his position based on the submissions and evidence filed by the CO in the course of this appeal and which were not before the IC during his investigation. Having done so the IC confirms that he concedes this appeal on the basis that the IC is now satisfied that no information was held within the scope of the request at the time of the request (the two emails identified by the CO being outside the scope of the request in the IC’s view). The IC has reached his decision based on the further details and evidence provided during the course of this appeal, and particularly given factors such as the timing of the request, the separation of the criminal and disciplinary proceedings, the fact that most staff did not use their CO email addresses, and the searches that have been seen to have been undertaken.[84]The Tribunal also welcome the essential and determinative task undertaken by the CO in reviewing their position and ultimately providing clarity as set out above herein and we accept and adopt the above material comprehensive and compelling submissions including the helpful references to the appropriate authorities cited, made on behalf of the Appellant in particular as set out at paras. 42 m- 61 above.

Conclusion:

[85]Accordingly hearing this matter afresh in all the circumstances and for all of the above reasons, the Tribunal are not persuaded on the balance of probabilities the Cabinet Office is in possession of the information requested by the Second Respondent and are not persuaded that at the time of the request the CO “held” information within the scope of the request for the purposes of s.3(2)(a) of the Freedom of Information Act 2000 (“FOIA”) and accordingly we must allow the Appeal.[86]No further action is required of the Second Respondent. Brian Kennedy KC. Decision given on date: 9 May 2025.