Ian Driver v The Information Commissioner & Anor [2025] UKFTT 61 (GRC)

[2025] UKFTT 00061 (GRC)Case Reference: EA/2023/0185
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 11 January 2024Date 24 January 2025
Information Rights
Heard: By Cloud Video Platform
Deliberation: 11 January 2024
30 June 2024
25 November 2024
Before
TRIBUNAL JUDGE FOSSTRIBUNAL MEMBER MURPHYTRIBUNAL MEMBER SCOTT
Between
IAN DRIVERAppellantTHE INFORMATION COMMISSIONERRespondentTHANET DISTRICT COUNCILRespondentthe Appellant appeared in person. for Appellant for First Respondent: the First Respondent did not appear. for Second Respondent: the Second Respondent was represented by Rupert Beloff, Counsel.Decision: The appeal is Dismissed.REASONS

Introduction to the Appeal

[1]This appeal concerns the Appellant’s request for a report (“the Report”) commissioned by Thanet District Council (“the Council”) into matters relating to the conduct of certain senior executives from around 2019. The Council commissioned the Report in December 2021 after certain recommendations were made by its auditors on 12 October 2021 pursuant to s24 and Schedule 7 of the Local Audit and Accountability Act 2014.[2]This is an appeal against the Commissioner’s Decision Notice ReferenceIC-195534-T1F7 dated 28 February 2023 (“the Decision Notice”), wherein he concluded that the Council was entitled to rely on s40(2) FOIA to withhold the full Report.

The Request

[3]The Report, dated 13 April 2022, was prepared by an Independent Monitoring Officer (the “IMO”).[4]On 24 April 2022, the Appellant requested the following information from the Council (“the Request”):
“Please provide me with a full unredacted copy of the REPORT FROM THE INDEPENDENT MONITORING OFFICER which will be discussed at a meeting of TDC’s [the Council’s] General Purposes Committee on 27 April 2022. It is my opinion that the public interest in the disclosure of the full unredacted version of this report far outweighs the public interest in its non-disclosure.”
[5]The IMO also prepared, and the Council published on 19 May 2022, a “Lessons Learnt Paper – Public Summary” dated 16 May 2022 (“the Public Summary”).[6]In the Public Summary, the IMO(1) summarised deficiencies in governance in the Council in dealing with grievances, whistle-blower complaints and disciplinary proceedings, and(2) described the emergence in 2019 of a serious breakdown in the relationships between the four, senior officers comprising the Council’s Corporate Management team (“the CMT”). He identified those four officers by name. He concluded that the matters described at (1) had been a factor in causing or aggravating the matter described at (2). He listed key areas of concern, identified the cause of disfunction in the CMT, identified in broad terms the causes of problems in relationships between the relevant senior officers, and between those officers and Councillors, summarised the mishandling of grievances, whistleblower complaints and disciplinary matters, addressed deficiencies in the availability of adequate Human Resources support and advice, and enumerated multiple recommendations as a starting point for improvement.

Refusal of the Request

[7]On 23 May 2022, the Council refused the Request, citing s44(1) of the Freedom of Information Act 2000 (“FOIA”) (prohibitions on disclosure). The Council said that the applicable statutory bar was that set out in Paragraph 1 of Schedule 12A Part 1 of the Local Government Act 1972 (information relating to any individual).

Internal Review

[8]On 24 May 2022, the Appellant requested an internal review of the Council’s refusal.[9]On 9 June 2022, following its internal review, the Council relied instead on s40(2) FOIA (personal data) to refuse the Request.[10]On 5 October 2022, the Appellant complained to the Information Commissioner (“the Commissioner”). The Commissioner investigated.

The Decision Notice

[11]By his Decision Notice, the Commissioner upheld the Council’s position. He found, in summary, that the information requested both related to and identified either current or former employees of the Council or third parties and constituted personal data within the meaning of s3(2) of the Data Protection Act 2018.[12]In assessing whether disclosure would contravene principle (a) of the Data Protection principles, namely that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject, he identified that for the processing to be lawful, one of the lawful bases listed in Article 6(1) of the UK GDPR must apply (and that it must be generally lawful).

(f) which states:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
[13]He identified the following three-part test to establish the application of Article 6(1)(f):a. legitimate interest test: whether a legitimate interest was being pursued in the request for information;b. necessity test: whether disclosure of the information was necessary to meet the legitimate interest in question;c. balancing test: whether the above interests overrode the legitimate interest(s) or fundamental rights and freedoms of the data subject.[14]There was, as he put it, “a number of legitimate interests” in disclosure of the requested information, although he did not identify which of such interests advanced by the Appellant he accepted: detecting or exposing crime or the threat of crime, disclosing a person’s or organisation's failure or likely failure to comply with any obligation to which they are subject, and raising or contributing to a matter of public debate, including serious cases of impropriety, unethical conduct or incompetence concerning the public.[15]He noted that the Council recognised that there was a legitimate interest in the disclosure of the Report as follows:
“The Council recognises that there is a legitimate interest in the conduct of its staff, particularly at its most senior level where there has been particular interest due to the excessive costs triggered by the historical disagreements amongst most senior four staff. Disclosure of such information supports transparency and accountability and enables the public to hold highly paid senior officers to account for their conduct in office and question the diversion of public money to deal with costly and drawn out employment disputes that could have been avoided if individuals conducted themselves appropriately.”
[16]He identified that “necessary "means more than desirable but less than indispensable or absolutely necessary; the test was one of reasonable necessity and involved consideration of alternative measures which might make disclosure of the requested information unnecessary; disclosure under FOIA must be the least intrusive means of achieving the legitimate aim in question.[17]Having reviewed the Report, he concluded that the Public Summary and accompanying recommendations were sufficient to meet the legitimate interests in this case; disclosure of the Report in its entirety would “grossly exceed ”the purpose limitation principle (UK GDPR, Article 5(1)(b)): it was not necessary to publish the Report to fulfil the purpose of holding senior staff in public office to account, and disclosure of all the personal data in the Report – relating to both former and current officers of the Council – went beyond what was necessary to meet any public interest argument.[18]Given his conclusion that disclosure was not necessary to meet the legitimate interest test, he did not go on to conduct the balancing test. If disclosure was not necessary, disclosing the data would be unlawful. On that basis, he concluded that the Council was entitled to withhold the requested information pursuant to s40(2) FOIA, by way of s40(3A)(a) FOIA.

The Notice of Appeal

[19]By his Notice of Appeal dated 29 May 2023, the Appellant submitted that in reaching his decision, the Commissioner had:a. failed to give sufficient weight to a pressing social need for transparency, accountability, value for money and democracy, which would be met by disclosure of the Report.b. failed to conclude that disclosure of the Report was a proportionate interference with the relevant data subjects’ rights to privacy and protection of their personal data in the circumstances.c. wrongly taken into account the distress likely to be felt by officials who had been found to engage in misconduct and wrongly concluded that they had a reasonable expectation of privacy in relation to the Report.d. failed to take into account information already in the public domain about alleged and proven wrongdoing of a serious nature by senior Council officials. The Commissioner’s Response to the Appeal[20]The Commissioner’s Response to the Appeal dated 1 August 2023, may be summarised as follows:a. the Commissioner and the Council had expressly acknowledged that disclosure of the Report would serve a number of legitimate interests.b. noting that the Public Summary had already been published by the Council when it refused the Request, the Commissioner had given careful consideration as to whether disclosure of the Report would be proportionate. Bearing in mind that the key legitimate interest in disclosure was to hold senior staff in public office to account, he was satisfied that disclosure of the Report was not necessary to achieve that aim, and that disclosure would, in fact, grossly exceed the purpose limitation principle under Article 5(1)(b) GDPR.c. the Commissioner had considered the Appellant’s submission that the names of junior officials who would have a greater expectation of confidentiality could be redacted but concluded that the Report contained not only the personal data of the most senior Council officials whose conduct was at issue but also former and current officers, as well as a number of councillors, officers, external partners and external lawyers. Additionally, the Report concerned allegations of mishandling of grievances, whistleblowers and disciplinary proceedings, and consequently “ample details” of grievances and whistleblower reports. Having concluded that the Public Summary was sufficient to meet the legitimate interests in disclosure for the purposes of Article 6(1)(f) UK GDPR, it was not necessary for the Commissioner to address himself to the question of whether the full Report could also be published.d. the Commissioner had not, in fact, referred to the possibility of senior officials experiencing distress as a result of disclosure. Rather he had regard to the fact the full Report contained not just the personal data of the most senior Council officials but also former and current Council officers as well as the data of third parties. It was in that respect that the Commissioner found that disclosure of the full Report would not be necessary to meet the legitimate interests in this case, including that of holding senior officials to account. Moreover, the personal data of the four most senior Council officials was already contained in the Public Summary. It was the personal data of other persons identified in the full Report which gave rise to the greatest sensitivity.e. the Commissioner was entitled to conclude that the amount of information already in the public domain, in the form of the Public Summary, was sufficient to meet the legitimate interests in disclosure. Indeed, given the amount of information already made public, the Commissioner found that disclosure of the full Report would be grossly excessive.

The Appellant’s Reply to the Council’s Response to the Appeal

[21]By submissions dated 8 August 2023, the Appellant replied to the Commissioner’s Response to the Appeal as follows:a. he would respond substantively to the Commissioner’s Response in his submissions at the hearing of the appeal.b. in the interim, he had identified that the Report should have been, but wrongly was not, made public by the Council at the time it was presented to and discussed by elected Councillors, pursuant to provisions of the Local Audit and Accountability Act 2014, the Local Government Act 1972, and the Public Bodies (Admissions to Meetings) Act 1960; the Council was obliged to ensure that the Report was open to inspection at a Council meeting, where it was to be discussed. In essence, he argued, the requirement under this legislation to make the Report public, meant that processing of personal data within it would be lawful. Appellant’s Reply to

The Commissioner’s Response to the Appeal

[22]By response to the Appellant’s Reply, dated 10 August 2023, the Commissioner submitted as follows:a. the Tribunal is tasked with determining whether the Council were entitled to withhold the Report from disclosure pursuant to s40(2) FOIA. It is not within the Tribunal’s jurisdiction to determine the Council’s compliance or otherwise with the legislation identified by the Appellant.b. the only lawful bases for processing personal data under FOIA were Article 6(1)(a) (consent of the data subject) and Article 6(1)(f) (legitimate interests). In disclosing the Report under FOIA, the Council would be processing personal data/disclosing the Report under FOIA, not to comply with a legal obligation for the purposes of Article 6(1)(c) GDPR (to ensure that the Report was open to inspection by the public at Council meetings in accordance with the Local Government Act 1972).

The hearing

[23]The hearing of this appeal took place on 11 January 2024. The Appellant represented himself. The Commissioner did not appear. The Council was represented by Counsel.[24]We had before us an OPEN bundle and a CLOSED Bundle.[25]The OPEN bundle contained the Request and associated correspondence, the pleadings and submissions in the appeal, the Commissioner’s investigation correspondence, Tribunal directions, and three witness statements: one from a former Council employee dated 29 September 2023, whom we do not identify in this decision for reasons which will become apparent, and two from Catherine Curtis, Information Governance and Equality Manager and Data Protection Officer for the Council. Her first statement was dated 6 October 2023, and her second was dated 3 January 2024. Her second statement summarised an earlier witness statement she had made on 16 June 2023, which was not in the OPEN bundle but was in the CLOSED bundle.[26]The CLOSED bundle contained: the unredacted Report, Ms Curtis’ witness statement of 16 June 2023, a document dated 19 May 2023 called “Bullying and Misconduct Secret Council Report by Ian Driver”, and two appendices to the unredacted Report.[27]We heard oral submissions from the Appellant and from the Council’s Counsel in OPEN sessions, and oral submissions from the Council’s Counsel in CLOSED session.[28]The Council called its former employee and Ms Curtis to give evidence. The Appellant cross-examined both.[29]Ms Curtis’ OPEN statements addressed:a. the fact that at some point the Appellant had, by means unidentified, already obtained and published on his blog a copy of what appeared to be a version of the Report albeit not a true replica of it, the Appellant’s version containing for example different formatting, missing bullet points, and some additional or extraneous material.b. certain of the Appellant’s and the Council’s previous dealings with each other.[30]We did not find that Ms Curtis’ evidence assisted us in determining any of the issues before us, and we do not address it further in this decision.[31]The Council gave the following, oral gist of the CLOSED session to the Appellant in OPEN session after the CLOSED session:a. the Council had impressed upon the Tribunal the need to have regard to the positions of Council employees other than senior management.b. the Tribunal had explored with the Council whether it might be possible for the Council to redact the Report, and the Council had submitted that even with the names of certain people redacted, there remained other information in the Report which might be effective to disclose the identity of those persons.c. there was other material in the public domain e.g. relating to the Council processes and structures which might enable identification of those individuals, even with their names redacted from the Report.d. there was no legitimate interest in disclosure of data relating to junior Council employees.

After the hearing on 11 January 2024

[32]After the hearing, the Tribunal received a series of applications and email correspondence from the parties concerning further submissions or evidence which the parties wished to place before the Tribunal, as to which the Tribunal has given directions. It is not necessary to rehearse those here other than to address briefly a few, specific matters.[33]On 24 January 2024, the Appellant applied to the Tribunal for permission to publish the witness statements filed on behalf of the Council. On 16 February 2024, the Tribunal directed, with reasons, that the Appellant be prohibited from publishing any part of those statements to any party, but that he might renew his application upon issue of the Tribunal’s decision in this appeal.[34]On 21 March 2024, the Appellant served and filed further written submissions and annexes.[35]On 1 July 2024, the Council elected to provide a substantially but not wholly unredacted version of the Report to the Appellant, inviting him to withdraw his appeal. The Appellant declined.[36]On 22 July 2024, the Council filed material with the Tribunal, applying for it to be held pursuant to Rule 14(6) of the Tribunal Rules, on the basis that the material included(1) contained a list of the personal data within the Report,(2) documents which form the evidential basis for the Council’s contention that the data is personal data and why redaction of the Report would not be effective to prevent its disclosure and(3) information relating to other tribunal cases which it described as confidential and highly sensitive. The witness statement accompanying that application made by the Council’s Head of legal and Democracy & Monitoring Officer had not been signed or dated. The Tribunal sought a signed, dated copy which was provided on 12 September 2024. On 13 December 2024, the Tribunal directed that the material filed by the Council's application of 22 July 2024 be held pursuant to Rule 14(6) of the Tribunal Rules. In the event, none of that material assisted us in determining any of the issues before us.[37]The Tribunal reconvened on 25 November 2024 to consider all the parties’ submissions and evidence.[38]We have not found it necessary to issue a separate, CLOSED judgment addressing any of the CLOSED material filed with the Tribunal. It is sufficient for us to give our reasons in this single, OPEN judgment.

The Legal Framework

[39]Section 1 FOIA provides a right of access to recorded information held by public authorities. It is subject to a number of exemptions, of which s40 FOIA is one, reading relevantly as follows:
“(2) Any information to which a request for information relates is ... exempt information if-(a) it constitutes personal data ..., and(b) ... the first ... condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of public otherwise than under this Act- (a) would contravene any of the data protection principles, ...” (a) would contravene any of the data protection principles, ...”
[40]“Personal data” is defined by s3(2) of the Data Protection Act 2018 (“DPA”) as “any information relating to an identified or identifiable living individual.”[41]“Identifiable living individual” is defined by s3(3) DPA as: “a living individual who can be identified, directly or indirectly, in particular by reference to-(a) an identifier such as a name, an identification number, location data or an online identifier, or(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify to the individual.” 42. “Processing” is defined by s3(4) DPA in a number of ways, relevantly for current purposes as “disclosure by transmission, dissemination or otherwise making available” (s3(4)(d) DPA).[43]Article 5 GDPR provides the data protection principles. Relevant for current purposes is Article 5(1)(a) which provides that “personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”[44]Article 6 GDPR provides for specific circumstances in which processing of personal data is lawful.[45]Article 6(1)(a)) provides that processing shall be lawful if the data subject has given consent to the processing of their data for one or more specific purposes. As at the date of refusal of the Request, we understand that no relevant consent was obtained. Article 6(1)(a) is, therefore, of no application.[46]Of the remaining provisions for lawful processing, the following two are in issue between the parties: a. Article 6(1)(f), which provides a lawful basis for processing personal data if “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” b.

Article 6(1)(f) - legitimate interests

(f) - legitimate interests

[47]The substantive arguments in the appeal focused on the application of Article 6(1)(f).[48]To determine the application of Article 6(1)(f), it is necessary to determine:(1) the legitimate interest of the Request(2) whether disclosure of the Report (including the personal data in it) was necessary for the purposes of meeting that interest, and(3) (assuming that disclosure of the Report was necessary for the purposes of meeting that interest) whether that interest outweighed the interests or rights of the affected data subjects.

Legitimate Interest of the Request

[49]The essence of the Appellant’s submissions was that there was a pressing social need for disclosure of the Report, in the interests of transparency, accountability, value for money and the health of democracy, which effectively outweighed the rights and freedoms of individuals whose personal data would, by disclosure of the Report, be published.[50]He developed his submissions at the hearing as follows:a. there was a legitimate interest in transparency around the accountability of the Council’s most senior executives in a context of alleged bullying, intimidation and harassment by those concerned, at substantial cost to the taxpayer, matters which went to the heart of the greatest failure of corporate governance. The relevant behaviours were not one-off mistakes but constituted a well-established, prolonged pattern of misconduct. They were not trivial or inconsequential.b. an overwhelming public interest in transparency around the relevant matters outweighed the rights of individuals.c. the personal data of “innocent” persons or “victims” referred to in the Report could be redacted.d. the elapse of time since the events in question and the publication of the Public Summary meant that media interest in the subject matter of the Report would now be diminished.e. there must be an expectation on the part of persons referred in the Report that, given the interest in the underlying issues which have become so important, there is a likelihood of their being in the limelight.f. the Tribunal’s role is to weigh up and ensure that the names of people who perpetrated horrendous acts and profited, are in the public domain and held to account; if “lesser persons” are involved, that is a necessary “trade-off”.[51]We remind ourselves at the outset that the circumstances against which we must assess the circumstances which prevailed at the date of refusal of the Request: 23 May 2022.[52]The Report had been issued on 13 April 2022. The Public Summary was published five weeks later, on 16 May 2022., a week before the Council refused the Request.[53]To the extent that the Appellant submitted, inter alia, that the passing of time and subsequent media coverage meant that as at the date of his appeal or the hearing of his appeal, the public interest in the subject matter of the Report was diminished, that is irrelevant. We must consider the position as at 23 May 2022.[54]The Appellant has referred us to multiple reports published online about the Council’s problems, several of them authored and published by him. We do not consider that multiple press reports on such matters are, themselves, necessarily a measure of a legitimate public interest in such matters. They may merely reflect public curiosity or be the expression of a dedicated, specific interest by particular journalists but neither of those is sufficient to constitute a legitimate interest.[55]The Report was the ultimate product of recommendations made by the Council’s auditors, Grant Thornton UK LLP, (“Grant Thornton”) on 12 October 2021, pursuant to s24 and Schedule 7 of the Local Audit and Accountability Act 2014 (“LAA”), which provides that: “1(1) A local auditor of the accounts of a relevant authority must consider whether, in the public interest, the auditor should make a report on any matter coming to the auditor's notice during the audit and relating to the authority or an entity connected with the authority, so it can be considered in accordance with this Schedule or brought to the public's attention.(2) A report under sub-paragraph (1) is referred to in this Act as a public interest report. ...” (2) A report under sub-paragraph (1) is referred to in this Act as a public interest report.[56]Grant Thornton justified its recommendations “due to inadequate arrangements in governance in responding to whistleblowing, grievances and disciplinary procedures with the direct financial costs adding further pressure to a fragile financial position.”[57]Those recommendations included the commission of an experienced IMO from a large local authority to report to the Council’s General Purposes Committee on:a. a risk assessment of the current employment tribunal claims and proposals for actions to safeguard the Council’s best interests including a detailed financial analysis of the options available to the Councilb. an assessment of the status of all outstanding grievances, alleged whistleblowing complaints and any continuing suspensions and proposals for a plan of action to address them.c. a lessons learnt report collating themes and recommendations from all externally commissioned reports and any other appropriate evidence.[58]Obedient to that recommendation, the Council engaged the IMO two months later (12 December 2021) and approved his implementation plan for his investigation and report one week later (18 December 2021).[59]The resulting Report and the Public Summary make clear beyond doubt that the management, governance and culture of the Council, particularly in the senior echelons, was, in the material period or periods covered by the Report, in a very sorry state.[60]The Public Summary referred to multiple internal and external investigations, including investigations of a disciplinary nature, which on their face engaged direct consideration of the Council’s management, governance and culture resting on concerns as to the conduct of non-elected senior officials in the Council, internecine strife in the CMT, the potential impact of a falling-short in officials’ conduct on the delivery of public services, and the significant costs met by the taxpayer, associated with investigating and resolving the issues arising therefrom.[61]Given that the Report was the product of a recommendation by the Council’s auditors, and given the content of the Report as we have described it, we are satisfied that there was a broad legitimate interest in transparency, accountability, value for money and the health of democracy, as the Appellant put it, in relation to the discharge of the Council’s functions.

Was disclosure of the Report necessary to meet the legitimate interest of the Request?

[62]In determining this issue, we have conducted a close and careful comparison of the Report, section by section, with the Public Summary.[63]The main body of the Report is 26 pages long. The Public Summary is 10 pages long. The Public Summary referred to there having been eight reports into Council affairs by six external independent reviewers undertaken in two and a half years preceding the Report. It described the IMO as having reviewed investigation reports and legal advice, minutes of Council meetings, internal policy documents and email correspondence, as well as having met with Officers, Councillors and other stakeholders to obtain first-hand observations regarding recent events at the Council.[64]The Report appended six appendices of which three were appended to the Public Summary:(1) Grant Thornton’s s.24 LAA Report,(2) Resolution of the Council of 2 November 2021 approving and responding to Grant Thornton’s recommendations,(3) the IMO s.24 Implementation Plan. The three appendices to the Report which were not attached to the Public Summary consisted of a List of reports of investigations, an internal Council email, and a key to abbreviations/initials used throughout the Report. We are satisfied that each of those three appendices contained personal data, and that it was not necessary for them to be included with the Public Summary for the reader fully to comprehend the Public Summary.[65]The Public Summary contained the same Summary of Governance Review as the Report, save that it omitted therefrom a brief reference to a single grievance by a named individual. Notably, it did replicate from that part of the Report, the names of the four most senior officers comprising the CMT, between whom both the Report and the Public Summary described the serious breakdown in relationships as giving rise to the Report’s headline concerns.[66]The Public Summary replicated the very great majority of the Report’s list of the following Key Areas of Concern; only item f. below did not feature as a standalone section in the Public Summary, albeit the Public Summary did refer to “a number of interlinked instances of whistleblowing and grievances which in some case were without adequate or in some cases, any, supporting evidence”. The Key Areas of Concern were as follows:a. Disfunction within the Corporate Management Teamb. Relationship between the Leader and Chief Executivec. Relationships between Officers and Councillorsd. Access for councillors to information and supporte. Mishandling of grievance and whistleblower complaintsf. Serious allegations by senior officers without adequate supporting evidenceg. Adequacy of HR support and adviceh. A Council project called the Berth 4/5 project.[67]We have considered the Key Areas of Concern, and their subject matter generally, as presented in the Report and then in the Public Summary. We find that both across the board, and in relation to substantive, individual sections of the Report, the Public Summary is a close and generous replication of the Report, indeed, in our view, strikingly so.[68]We find that the fundamental purpose of the Report was to assist the Council in improving the Council’s operations, of which culture and governance were bedrocks found to be wanting. The Report, both in its narrative of past events and its recommendations, was forward-looking; the specific conduct of any particular individual on any particular occasion in an historic context was not a feature of primary importance.[69]The Public Summary, in extracting as fulsomely as it did from the Report, was no less damning in its thrust or detail than the Report. We are confirmed in that view both by our close comparison of individual sections of the two documents, and by our “stand-back” impression of them.[70]Looking at matters in the round, we are satisfied that the Council was entitled to conclude that disclosure of the Report including personal data was not necessary to meet the legitimate interests of the Request, including that of holding senior employees to account, when the Public Summary had been published in such detail as it had, including the names of the four most senior employees in the CMT.[71]On that basis, it is not necessary for us to go on to determine whether the legitimate interest pursued by the Request outweighed the interests or rights of the affected data subjects. If, however, we are wrong in our conclusion as to necessity, we address the issue of the interests and rights of individuals in broad terms, for completeness.

The interests and rights of individuals

[72]To the extent that the legitimate interest of the Request required scrutiny of the conduct of senior individuals tasked with significant responsibility in public office, in our view, the Public Summary achieved that: it identified by name and role the four senior Council officers between whom there had been a critical break-down in working relationships, and against whom the most serious criticisms were levelled: the Chief Executive Officer, the Director of Finance, the Director of Operations and the Director of Law & Monitoring Officer. It gave a sufficient flavour, in our view, of those officers’ relevant conduct, even if it did not provide the full details of that as set out in the Report.[73]The Report was not, however, itself the product of an investigation into each of the grievance matters and associated examples described therein. Those matters appear to have been the subject of their own separate, detailed investigations, in some cases by external investigators. The extracts from those investigation reports included in the Report were not sufficient to tell the whole story about the individual cases. It seems to us that publication of at least those aspects of the Report, and the associated personal data, would have been misleading for their incompleteness, and consequently unfair, and potentially damaging, to the individuals concerned.[74]The Public Summary did not disclose the identities of Council employees referred to in the Report (other than the four members of the CMT), Councillors, investigators or external lawyers.[75]In his submissions, the Appellant evinced a clear interest in disclosure of the names of Council personnel referred to in the Report other than four most senior Council officers named.[76]The Council called one of those personnel to give evidence at the hearing of this appeal. They gave evidence that they had assisted the IMO in his investigation. They had not expected to be mentioned in the Report and were not shown a copy of the Report in draft or given an opportunity to comment on it before it was finalised. They were most concerned that if the Report were to be published, the Appellant would use it to attack and attempt to discredit them (as well as others referred to in the Report), damaging their professional profile, well-being and happiness.[77]We do not doubt the sincerity of that witness’ evidence. They seemed to us to be genuinely distressed at the prospect of disclosure of the Report, with a particular emphasis on the effect of disclosure on them now. However, we must consider the circumstances prevailing at the time the Request was refused. We are satisfied that the witness would still have been distressed by disclosure of the Report in May 2022, and justifiably so.[78]We do not consider that disclosure of that witness’ personal data by publication of the Report would have been a proportionate interference with their rights. Although the Appellant sought by his submissions and cross-examination of the witness to diminish the feared impact on the witness of disclosure of their personal data, it was clear that the witness believed, we consider justifiably, that disclosure might be damaging to them. We do not accept that disclosure of their personal data in May 2022 could have been justified to meet the broad legitimate interest of the Request.[79]We remind ourselves of the Appellant’s submission that there must be an expectation on the part of persons referred in the Report that, given the interest in the underlying issues which have become so important, there is a likelihood of their being in the limelight. Notably, the Appellant refers to current expectations, the fact that the underlying issues “have become” so important, and the current likelihood of persons referred to in the Report being in the limelight. Now is the wrong point in time at which to assess such matters. The correct point in time for such assessment is at the date of refusal of the Request, and, in our view should include an assessment of the actual or reasonable expectations of participants in the investigation at the time of the investigation and the creation of the Report.[80]The investigation started in December 2021. The Report was dated 13 April 2022. The Request was made on 24 April 2022. The Appellant told us that the Report was considered at the Council’s General Purposes meeting on 27 April 2022 from which the public and press were excluded. The Public Summary was published on 16 May 2022. The Appellant told us that the Report was also considered at a meeting of the full Council on 19 May 2022, from which the public and press were again excluded. The Request was refused on 23 May 2022.[81]Beyond evidence from the Council’s former employee that they were appalled to see the references to themselves in the Report at a point beyond which they felt, or were, able to make any representations to the IMO, we had no direct evidence as to any other participant’s expectations as to whether their personal data in the product of that investigation might be published, for example, any assurance which had been given to them at the point at which they were invited to assist the investigation. We can see that such expectations, and any associated concerns, would vary according to individuals’ roles, for example, whether they were a Council participant such as an employee or elected official, or a third party, such as an investigator, and according to the content and relevance of any person’s evidence.[82]On the basis of the material before us, and viewing matters in the round, we find that certainly after issue of the Public Summary on 16 May 2022, at the very least no Council participant in the investigation (the four CMT individuals aside), would or should have had any expectation that their personal data would be published. They would, understandably, have assumed that the Public Summary, depleted of personal data, was thought by the Council to be sufficient to meet any public interest in its subject matter. We consider it unlikely that any other affected individual would have expected publication of their personal data.[83]We do not find that the legitimate interest pursued by the Request, assuming disclosure of the Report was necessary to meet that interest, outweighed the interests or rights of the affected data subjects.[84]We have considered carefully whether the Council could have redacted personal data in the Report so that no individual would be identifiable. In so doing, we must assess whether a motivated intruder could identify those persons. A motivated intruder is to be considered as reasonably competent, with access to resources such as the internet, libraries and all public documents, and who would employ investigative techniques.[85]We are satisfied that no such redaction would have been effective. Embedded in the Report are not just individual names but information about individuals’ interactions with each other in a relatively small group context, job functions, reporting chains and line management. This information, taken together, would, in our view, enable the identification of individuals or in any event enable a motivated enquirer to piece together the available information and fill in the gaps to identify individuals by those means.[86]We find that s40(3A) FOIA was appropriately considered to be engaged because disclosure of the personal data would contravene Article 5(1)(a) GDPR; the processing of the personal data would not be lawful under Article 6(1)(f) in the circumstances of this case.

Article 6(1)(c) - compliance with a legal obligation

(c) - compliance with a legal obligation

[87]Article 6(1)(c) GDPR provides that processing of personal data is lawful if it is necessary for compliance with a legal obligation to which the controller, in this case, the Council, is subject.[88]The Appellant identified Article 6(1)(c) as a potentially relevant provision in his Reply of 8 August 2023 to the Commissioner’s Response to the Notice of Appeal. He presented it as “some new legal information which I have only just discovered and which, I believe, has an important bearing on the case. ... This new information shows that the requested information i.e. the unredacted version of [the Report] should have been made public by the council at the time it was presented to and discussed by elected councillors. However, the Council, whether deliberately or out of ignorance failed to do so.”[89]We take the Appellant to submit that the Commissioner should have considered the application of Article 6(1)(c) as well as Article 6(1)(f) in his decision.[90]In summary, the Appellant submits that the Council had a legal obligation to make the Report, unredacted of personal data, available to the public. On that basis, as we understand it, he says that disclosure of the personal data, otherwise than under FOIA, was lawful, such that the requirement for lawful processing was met.[91]The statutory route by which the Appellant constructs his submission is as follows: a. paragraph 1 of Schedule 7 to the LAA (Reports and recommendations) provides as follows:
“Public Interest Reports (1) A local auditor of the accounts of a relevant authority must consider whether, in the public interest, the auditor should make a report on any matter coming to the auditor's notice during the audit and relating to the authority or an entity connected with the authority, so it can be considered in accordance with this Schedule or brought to the public's attention. (2) A report under sub-paragraph (1) is referred to in this Act as a public interest report.” (2) A report under sub-paragraph (1) is referred to in this Act as a public interest report.” b. paragraph 9(8) of Schedule 7 to the LAA provides as follows: “(8) References in this paragraph to a public interest report or a recommendation include any report on the report or recommendation.” c. the Report was, in the Appellant’s words, a “report on the recommendation” i.e. a report based on the recommendations made by Grant Thornton. d. consequently, the Report was subject to the requirements of paragraph 9(1), (3), (4), (5), (6) and (7) of Schedule 7 to the LAA, which provide as follows: “(1) Where a public interest report or a recommendation is to be considered under paragraph 5 by a relevant authority to which the Public Bodies (Admission to Meetings) Act 1960 applies, the report or recommendation is not to be excluded from the matter supplied under section 1(4)(b) of that Act (supply of agenda etc to newspapers). ... (3) Sub-paragraphs (4) to (6) apply in relation to the consideration under paragraph 5 or 6 of a public interest report or a recommendation by a relevant authority to which Part 5A (access to meetings and documents) of the Local Government Act 1972 applies. (4) Information contained in the report or recommendation is not to be treated as exempt information for the purposes of that Part. ... (5) The report or recommendation is not to be excluded— (a) from the documents open to inspection under section 100B(1) of that Act (public access to agenda and reports before meetings), or (b) from the matter supplied under section 100B(7) of that Act (supply of agenda etc to newspapers). (6) Part 5A of the Local Government Act 1972 has effect in relation to the report or recommendation as if section 100C(1)(d) of that Act (public access to copies of reports for six years after meeting) were not limited to so much of the report or recommendation as relates to an item during which the meeting was open to the public. (7) Information contained in a public interest report or a recommendation is not to be treated as exempt information for the purposes of any Act or instrument made under an Act that applies in relation to exempt information within the meaning of Part 5A of the Local Government Act 1972.” e. Paragraph 100(I) of Part 5A of the Local Government Act 1972 (Exempt information and power to vary Schedule 12A) provides: “In relation to principal councils in England the descriptions of information which are, for the purposes of this part, exempt information are those for the time being specified in Part I of Schedule 12A to this Act, but subject to any qualifications contained in Part II of that Schedule; ...” f. Part 1 (Descriptions of Exempt Information: England) of Schedule 12A (Access to Information: Exempt Information) of the Local Government Act 1972 identifies, relevantly for current purposes, information relating to any individual, and information which is likely to reveal the identity of an individual, as exempt information (paragraphs 1 and 2 of Part 1 respectively), subject to a qualification at paragraph 10 of Part II that it be exempt information “if and so long as, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”
[92]On 10 August 2023, the Commissioner made the following very brief responsive submissions by email to the Tribunal and the parties:a. the Council “would be processing/disclosing [the Report] in order to respond to the Appellant’s information request and not to comply with a legal obligation for the purposes of article 6(1)(c) GDPR e.g. to ensure that [the Report] is open for inspection by the public at Council meetings in accordance with the Local Government Act 1972.”b. if the Council were required to make the Report accessible at public meetings, the Appellant would have had an alternative means by which to access the Report outwith FOIA, with the result that disclosure would not be necessary under FOIA.c. it is not within the Tribunal’s jurisdiction to determine the Council’s compliance, or otherwise, with the legislation referred to by the Appellant.[93]The Council addressed the point in its skeleton argument of 22 December 2023 as follows:
“18. It is submitted that the Appellant’s attempts to rely upon a purported duty imposed on the Second Defendant by legislation specifically governing the actions of local authorities is wholly misguided within the ambit of the current appeal. 19. The First Respondent’s decision relates to the Appellant’s complaint that the Second Respondent had failed to comply with requirements imposed upon it by the provisions of FOIA and the Second Respondent’s response to a freedom of information request made to of it by the Appellant. It is that response that is the underlying subject of the appeal and, in particular, the Second Respondent’s decision to withhold the full specified report pursuant to section 40(2) of FOIA.”
[94]The Appellant responded to the Commissioner’s submissions on the point at the hearing. He submitted that the Council had failed to discharge its legal obligations by not holding a public meeting to discuss the Report and by not disclosing the Report, and that those were matters which were themselves of weighty legitimate interest, requiring the Tribunal’s consideration.[95]The Council submitted in response that the issue of whether the Report should have been disclosed by the Council under other legislation concerning local government was not something which weighed in the Commissioner’s decision which is under appeal; the Council did not accept that its conduct in this context was unlawful; the Commissioner could not consider the issue when he responded to the Appellant’s complaint; the issue was entirely outwith the ambit of FOIA.[96]The Tribunal has no general jurisdiction to adjudicate on the lawfulness of the Council’s conduct in holding or not holding a publicly accessible meeting to consider the Report or not otherwise disclosing the Report to the public. In any event, beyond the Appellant’s statement that the Council had wrongly excluded the public and press from two meetings to consider the Report (the Council’s General Purposes meeting on 27 April 2022 and at a meeting of the full Council on 19 May 2022), the Tribunal had next to no submissions or evidence before it about such matters, including, specifically, the basis for such exclusions.[97]The Tribunal’s jurisdiction under s58 FOIA as to whether the Decision Notice was or was not in accordance with the law must be viewed in the context of the Commissioner's task under s50 FOIA, which is to determine whether the Request was dealt with in accordance with Part 1 of FOIA.[98]Thus, it falls to the Tribunal to consider the application of Article 6(1)(c) in that context, which rests on the Appellant’s submission, as we understand it, that the Council had a legal obligation to publish the Report, equating to lawful processing of the personal data.[99]The first condition (s40(3A) FOIA) is that disclosure of the information to a member of the public otherwise than under FOIA would contravene any of the data protection principles. Put another way: but for any duty to disclose under FOIA, would it have been lawful for the Council to disclose personal data?[100]The Appellant’s answer to that is in the affirmative because he says that, by the statutory route he has demonstrated, the Council had a positive legal obligation to make the Report, including the personal data within it, accessible to the public and were not entitled to treat the personal data within it as exempt because, in short, the Report should be regarded effectively as a public interest report (paragraph 9(8) to Schedule 7 to the LAA).[101]We were not shown, and have not undertaken, analysis of the various statutory provisions which the Appellant indicates apply to the Council’s operations, and specifically, what the Council should or should not have disclosed at any public meeting or otherwise made publicly available. However, it seems to us that the essential foundation of the Appellant’s submission in this context is the characterisation of the Report as a public interest report within the meaning of Schedule 7 to the LAA.[102]We do not accept that the Report can be so characterised.[103]Self-evidently, the Report is not a report by the Council’s statutory auditor, Grant Thornton, and so it is not, per se, a public interest report.[104]Nor is it a report on Grant Thornton’s report or recommendations (which we understand were published in line with the requirements of Schedule 7 to the LAA).[105]Rather, the Report is the product of an activity undertaken by the Council, acting on one of several recommendations by Grant Thornton. The Report takes Grant Thornton’s recommendation as its stimulus and starting point, states that the contextual information in the background to Grant Thornton’s recommendations is a helpful indication of relevant matters, and it attaches Grant Thornton’s recommendations as an appendix. Thereafter, however, it flies free and unfettered by anything said by Grant Thornton in its recommendations, and is evidently its own creature, informed by the implementation plan prepared by the IMO and approved by the Council, and the IMO’s subsequent investigations. It reports no comment on, or analysis of, or answer to, Grant Thornton’s recommendations. It is not a report on, in the ordinary sense of that small word, Grant Thornton’s recommendations.[106]On that basis, we are unable to accept the Appellant’s extended submission, as we understand it, that the consequences of the Report being, as he would have it, effectively a public interest report, were that(a) the Council was not entitled to treat the personal data in the Report as exempt from disclosure, and(b) that the Council had a legal obligation to disclose the Report and the personal data within it, with the result that disclosure of that data otherwise than under FOIA was lawful.[107]We find that the processing of the personal data would not be lawful under Article 6(1)(c) in the circumstances of this case.

Conclusion

[108]For all the reasons we have given, we find that the Council was entitled to refuse disclosure of the Report in reliance on s40(2) FOIA.[109]We find that the Decision Notice was in accordance with the law.[110]The appeal must be dismissed. Signed: Judge Foss Dated:16 January 2025