Fermanagh and Omagh District Council v The Information Commissioner & Anor [2025] UKFTT 712 (GRC)

[2025] UKFTT 00712 (GRC)Case Reference: FT/EA/2024/0378
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 28 February 2025Date 18 June 2025
Information Rights
Heard by Cloud Video Platform
Before
JUDGE STEPHEN ROPERMEMBER KATE GAPLEVSKAJAMEMBER NAOMI MATTHEWSFERMANAGH AND OMAGH DISTRICT COUNCILCouncil
Between
THE INFORMATION COMMIsSIONERRespondentsMARTINA HOGGRespondentsRobin Hopkins of Counsel for Appellant for First Respondent: did not appear and was not represented for Second Respondent: in personDecision: The appeal is DismissedFermanagh and Omagh District Council must now disclose the information previously withheld by it in respect of the request for information made to it by Martina Hogg dated 21 January 2024, as referred to in the Information Commissioner’s decision notice dated 22 August 2024 (reference IC-296476-P2K0). Fermanagh and Omagh District Council must make such disclosure within 35 days of this decision being sent to it, or (if there is an application to appeal this decision) within 28 days after being notified of an unsuccessful outcome to such application or any resulting appeal.REASONS

Preliminary matters

[1]In this decision, we use the following terms to denote the meanings shown: Balancing Test: The last limb of the Legitimate Interests Test, as referred to in paragraph 41. Commissioner: The Information Commissioner (the First Respondent). Council: Fermanagh and Omagh District Council (the Appellant). Decision Notice: The Decision Notice of the Commissioner dated 22 August 2024, reference IC-296476-P2K0, relating to the Request. DPA: The Data Protection Act 2018. Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 30). FOIA: The Freedom of Information Act 2000. Inspection Scores: The inspection scores set out within the Withheld Information. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f), as set out in paragraph 38. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 40. Licence Holders: The licence holders which were the subject of the Request (and references to a ‘Licence Holder’ should be construed accordingly). Public Interest Test: The test, pursuant to section 2(2)(b) (set out in paragraph 33), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information. Request: The request for information made to the Council by the Second Respondent dated 21 January 2024, as set out in paragraph 7. Requested Information: The information which was requested by way of the Request. Second Respondent: Martina Hogg (the person who made the Request). UK GPDR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018. Withheld Information: The inspection reports for the two dog breeding establishments referred to in the Request.[2]Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:a. to numbered paragraphs are references to paragraphs of this decision so numbered;b. to any section are references to the applicable section of FOIA;c. to any Article are references to the applicable Article of the UK GDPR;d. to the Commissioner’s “investigation” mean the Commissioner’s investigation of the Council’s complaint, pursuant to section 50, relating to the Council’s response to the Request.[3]Nothing we say in this decision should be taken as an indication of any views regarding the merits or otherwise of dog breeding or inspections, nor as an indication of the Inspection Scores.

Introduction

[4]This was an appeal against the Decision Notice, which (in summary) decided that the Council was not entitled to rely on section 43(2) (commercial interests) to withhold some of the Requested Information.[5]We considered whether it was necessary for us to provide a closed decision. We concluded that it would not be necessary, on the basis that the reasoning behind this decision can be sufficiently understood without us needing to refer to the specific details of, or disclose any sensitive aspects of, the material in the closed bundle.

Background to the Appeal

[6]The background to the appeal is as follows.

The Request

[7]On 21 January 2024, the Second Respondent contacted the Council and requested information in the following terms:
“In respect of [name redacted] (licence holder 8) please provide 1. a copy of her most recent application for a dog breeding licence 2. any correspondence to or from the licence holder relating to the most recent application 3. a copy of the most recent inspection report for the breeding establishment In respect of [name redacted] (licence holder 1) please provide 1. a copy of his most recent application for a dog breeding licence 2. any correspondence to or from the licence holder relating to the most recent application 3. a copy of the most recent inspection report for the breeding establishment 3. [sic] a copy of the most recent licence…”
.

In respect of [name redacted] (licence holder 1) please provide

[8]The Council responded on 21 February 2024. It provided some of the Requested Information but it considered that the inspection reports for both of the premises referred to in the Request were exempt from disclosure, citing section 43(2) (commercial interests).[9]The Second Respondent contacted the Council on 23 February 2024, requesting an internal review. The Second Respondent considered that the copies of the inspection reports should be disclosed. She asked for details regarding the engagement of section 43 and of the associated Public Interest Test.[10]On 22 March 2024, the Council responded. It provided some details regarding the factors taken into account for the Public Interest Test and it upheld its previous decision.[11]The Second Respondent complained to the Commissioner about the Council’s response to the Request and the Commissioner subsequently issued the Decision Notice.

The Decision Notice

[12]The Commissioner considered that the scope of his investigation was to determine whether the Council was entitled to rely on section 43(2) in order to refuse to disclose the Withheld Information.[13]In the Decision Notice, the Commissioner concluded (in summary) that:a. the Council failed to demonstrate that the exemption in section 43(2) was engaged in respect of the Request; andb. the Council was therefore not entitled to rely on that exemption to refuse to disclose the Withheld Information.[14]Consequently, the Decision Notice required the Council to disclose the Withheld Information. The appeal The grounds of appeal

The appeal

[15]The Council’s grounds of appeal were, in essence, that:a. section 43(2) was engaged in respect of the Withheld Information and that, in respect of the Public Interest Test, the public interest favoured maintaining the exemption in that section, andb. the Withheld Information also constituted the personal data of the Licence Holders and section 40(2) was engaged on the basis that disclosure of such personal data would contravene Article 5(1)(a).[16]The latter was raised as a new exemption not previously relied on by the Council during the Commissioner’s investigation.

The Tribunal’s powers and role

[17]The powers of the Tribunal in determining this appeal are set out in section 58, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[18]In summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).

Mode of hearing

[19]The proceedings were held by the cloud video platform. The Tribunal Panel, Mr Hopkins (for the Council) and the Second Respondent joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way. The Commissioner did not appear and was not represented.[20]There were no interruptions of note during the hearing.

The evidence and submissions

[21]The Tribunal read and took account of open bundles of evidence and pleadings (which had been split across various separate bundles), as well as a closed bundle. We also had separate written submissions from the Second Respondent together with appendices.[22]The open bundles included two witness statements on behalf of the Council. The first witness’s statement was given in their capacity as the Council’s former Principal Environmental Health Officer and former Principal Officer (Animal Welfare & Dog Control). It is not necessary for us to identify this witness personally in this decision - therefore we merely refer to them as “the first witness” and we mean no disrespect to them in doing so. The first witness also give evidence orally at the hearing.[23]The second witness’s statement was given in their capacity as a Dog Warden employed by the Council. Again, it is not necessary for us to identify this witness personally in this decision. This witness statement merely attached the personal statements provided by the Licence Holders referred to in paragraph 24.[24]The closed bundle contained:a. the Withheld Information (the original inspection reports, as well as a typed-up version of them);b. informal statements from each of the Licence Holders setting out their views in connection with the potential disclosure of the Withheld Information; andc. material in support of the personal statement of one of the Licence Holders, particularly extracts of comments from members of the public on social media relating to their establishment, which they considered to be defamatory.[25]We heard oral submissions from Mr Hopkins on behalf of the Council and from the Second Respondent.[26]During the hearing, the Tribunal held a closed session (which excluded the Second Respondent). A gist of the closed session, approved by Mr. Hopkins during it, was provided to the Second Respondent at the resumed open hearing. The gist was to the effect that the first witness had been questioned regarding:a. the nature of the Withheld Information with reference to the Inspection Scores;b. how the scoring system works and how they felt that this prejudiced the commercial interests of the Licence Holders;c. their concerns in respect of certain media reports about attacks on dog breeding establishments, in the context of the Withheld Information and in connection with potential disclosure of the Withheld Information;d. their views on personal data contained within the Withheld Information; ande. the evidence of the particular scores being withheld and whether the concerns about the prejudice to the Licence Holders would apply regardless of the actual scores awarded.[27]The closed session also briefly touched on the potential application of section 38, but this was addressed at the resumed open hearing.[28]The Second Respondent was mistakenly readmitted to the cloud video platform just as the closed session was being concluded. However, we were satisfied that the Second Respondent did not hear the discussions regarding the content of the Withheld Information or any other senstive matters.[29]All of the contents of the bundles, including all of the submissions of the parties (as well as the submissions of Mr Hopkins and the Second Respondent during the hearing), were taken into account, even if not directly referred to in this decision. The relevant statutory framework General principles

The relevant statutory framework

[30]Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[31]In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[32]Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.[33]Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[34]The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). Section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied. Section 43(2) and section 38(1) are not included in that list.[35]Accordingly, in summary:a. the exemption to the Duty to Disclose in section 40(2) is an absolute exemption only in cases where that first condition is satisfied, otherwise the exemption is subject to the Public Interest Test;b. the exemptions to the Duty to Disclose in section 43(2) and section 38(1) are subject to the Public Interest Test.

Section 40 – personal information

[36]So far as is relevant for the purposes of the appeal, section 40 provides: “…(2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles…”.[37]Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. Section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA.b. The “data protection principles” are those set out in Article 5(1) and section 34(1) of the DPA.c. The first data protection principle, in Article 5(1)(a), is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”.d. A “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”.[38]To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1). One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f)).[39]Article 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.

The Legitimate Interests Test

[40]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[41]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[42]It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.[43]The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb (the Balancing Test) can be considered.[44]For the purposes of the second limb of the Legitimate Interests Test, case law has established that the term “necessary” means something which is more than desirable but less than indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive” means of achieving the legitimate interest in question).

Section 38 - health and safety

[45]Section 38(1) provides:
“Information is exempt information if its disclosure under this Act would, or would be likely to— (a) endanger the physical or mental health of any individual, or (b) endanger the safety of any individual.”
.

Section 43 – commercial interests

[46]Section 43(2) provides:
“Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it).”
.

Discussion and findings

[47]The primary issues for the Tribunal to determine (in respect of the Council’s grounds of appeal) were whether the Commissioner was correct to determine in the Decision Notice that the Council was not entitled to rely on section 43(2) to withhold the Withheld Information, and whether the Inspection Scores were exempt under section 40(2).[48]As we have noted, the potential application of section 40(2) was not relied on by the Council during the Commissioner’s investigation but raised by the Council during the appeal proceedings. The Second Respondent commented that this exemption had not been raised at any stage previously. However, case law has established that a public authority is entitled to rely on new exemptions in an appeal before the First-tier Tribunal. This is so even if those exemptions have not been raised by the public authority at an earlier stage (whether in its response to a request for information under FOIA, any subsequent review of that response or in its subsequent dealings with the Commissioner when the Commissioner is investigating a complaint relating to that request).

Whether section 43(2) was engaged

[49]The exemption under section 43(2) uses the terms ‘would’ and ‘would be likely to’ prejudice the commercial interests of a person. This means that the prejudice in question is more probable than not, or that there is a real and significant risk of it happening.[50]For such exemption to apply, there must be some causative link between the potential disclosure of the relevant information and the prejudice to the commercial interests of a person (which may include the public authority in question). The prejudice must also be real, actual or of substance and it must relate to the interests protected by the exemption.[51]In his response to the appeal, the Commissioner generally relied on the Decision Notice as setting out his findings and the reasons for those findings in respect of the engagement of section 43(2). In summary, the Commissioner stated that he remained unconvinced that the prejudice envisaged to the commercial interests of the Licence Holders would, or would be likely to, arise for the reasons given in the Decision Notice.[52]We agree with the view of the Commissioner (in paragraph 15 of the Decision Notice) that dog breeding is a commercial activity, in that breeders generally sell puppies with the aim of making a profit. Based on the evidence before us, we find that the Licence Holders were conducting a business involved in such activity.[53]The first witness stated that granting of licences for the breeding of dogs is governed by the Welfare of Animals (Dog Breeding Establishments and Miscellaneous Amendments) Regulations (NI) 2013, made under the Welfare of Animals Act (Northern Ireland) 2011 and that licensing authorities (such as the Council) are required to inspect breeding establishments in accordance with guidance produced by the Department of Agriculture & Rural Affairs (DAERA) and District Councils (the NI Dog Advisory Group).[54]The Council argued that disclosure of the Withheld Information would compromise the commercial interests of the Licence Holders. Its reasons related mainly to the scoring used in inspection reports such as those contained in the Withheld Information.[55]A blank proforma template for the Council’s inspection reports (which is issued by DAERA) was exhibited to the first witness’s statement, together with an explanation regarding the scoring requirements. The first witness explained that, using that template, an inspection requires a score of 1 to 3 for each subsection of the template, which covers different items/criteria for inspection, totalling 39 individual scores (of 1 to 3 each). We refer to the scoring basis in paragraph 67.[56]It may be helpful to note that the first witness commented that dog breeding is an issue which “attracts a significant degree of debate and controversy in Northern Ireland”. They explained that it can be a very emotive issue for some, with some very trenchant criticisms and that there had, on occasion, been instances of criminal violence perpetrated at dog breeders’ premises (including arson attacks).[57]The Council’s position was that if an inspection report had lower scoring, it may be misunderstood and misconstrued, because the public do not know the context of the inspection and the methodology of the scoring. The Council considered that disclosing the Inspection Scores would not add to the public understanding of the inspection regime. The Council stated, in correspondence with the Commissioner relating to his investigation, that the information contains “a report of the circumstances at the time of the inspection, businesses have an opportunity to make changes after the inspection, if needed”.[58]The Council’s view, in essence, was that disclosure of the Withheld Information could be used against an establishment. Its concern was that there could be publication of views resulting in negative publicity and in turn this could encourage protests at an establishment, which could cause reputational damage and potential loss of business. The Council also pointed out that some establishments were also home addresses, creating an additional concern regarding protests at those locations. Further, the Decision Notice recorded that the Council had reported to the Commissioner that establishments had been targeted in the past, including one dog breeder’s outbuilding being subjected to an arson attack.[59]The Commissioner stated in the Decision Notice that the Council had not consulted with the Licence Holders, in the context of the Commissioner seeking evidence that their commercial interests would, or would be likely to, be prejudiced. The Commissioner found that the Council had failed to demonstrate such prejudice. In essence, the Commissioner considered that there was potential for such prejudice but the Council had merely demonstrated that disclosure of the Withheld Information could prejudice the Licence Holders’ commercial interests, rather than ‘would’ or ‘would be likely to’.[60]The first witness gave evidence to the effect that inspection reports relating to dog breeding establishments had previously been publicly disclosed by the Council. They stated, in essence, that Council had previously been given legal advice that inspection reports could be disclosed but that circumstances change.[61]As we have noted, the closed bundle included statements from the Licence Holders. These statements included comments on their past experiences as dog breeders and their concerns regarding potential future attacks on their premises. We understand and sympathise with the concerns expressed by the Licence Holders. However, our role was to assess matters with regard specifically to the potential disclosure of the Withheld Information.[62]We find that the concerns expressed by the Licence Holders’ broadly related to the public knowledge of their existence as licensed dog breeders, rather than with specific reference to the disclosure of the inspection reports constituting the Withheld Information. In particular, their statements did not address why they considered that disclosure of the Withheld Information specifically would harm their commercial interests. Rather, the statements addressed concerns more generically about the release of any information relating to their businesses. We address the issue of their personal data in the section below but, with regard to the alleged prejudice to the Licence Holders’ commercial interests, we find that there was insufficient evidence to demonstrate such prejudice in the context of disclosure of the Withheld Information.[63]In particular, it is already public knowledge that the Licence Holders own or operate licensed dog breeding establishments. Their names and the addresses of their establishments were included in their respective applications for a dog breeding licence, which were disclosed in response to the Request (although in the case of one of the Licence Holders their residential address was different and therefore this had been redacted from the disclosed information).[64]Further, the evidence before us showed that both Licence Holders had publicly available profiles published online by the Licence Holders themselves. Included in the evidence was details regarding a website for the business of one of the Licence Holders and, whilst we accept that the website did not publish their address, it had a photograph and the first name of the Licence Holder prominently displayed. The statement from the other Licence Holder referred to the use of their website to promote their business and gather feedback from customers. There was also evidence before us (based on publicly available information) that the latter Licence Holder was also involved in an organisation, which also has a website, representing dog breeders in Northern Ireland.[65]We consider that the publicly available information, particularly that published by the Licence Holders themselves, could not be reconciled with their statements expressing concerns about any information being made publicly available about their respective businesses. As we have noted, there is already information in the public domain with the names of the Licence Holders as having a dog breeding licence, together with a connected address for each of them. Having regard to the Withheld Information, we do not see that disclosure of it would, or would be likely to, prejudice the Licence Holders’ commercial interests.[66]As we have noted, the Council argued that lack of understanding about how the inspections were scored could mean that the Withheld Information might be misconstrued and that this could lead to negative publicity and adverse consequences for the Licence Holders. However, the first witness gave evidence to the effect that there was some guidance publicly available regarding the scoring system, and this was also included in the open bundles. In oral evidence, the first witness initially stated that there was an element of individual judgement by an inspector when making an inspection, but they also later accepted that this was probably consistent with the published guidance.[67]Also, whilst the guidance does not set out details of how to apply scoring to the different items/criteria for inspection, the template inspection report does address this. It shows that a score of 1 means “does not meet the minimum requirements”, a score of 2 means “meets minimum standard with limitations” and a score of 3 means “meets the minimum standard”. Consequently, whilst we accept that the inspector will exercise a degree of individual judgement, we consider that there is little scope to misunderstand the scoring system. We therefore find that little weight should be afforded to the argument that the scoring of inspection reports would be misunderstood by the public. Also, as we have noted, the Council had previously made disclosure of inspection reports.[68]In any event, it is already in the public domain that a dog breeder holding a licence would be subjected to inspections in connection with the holding of their licence. We recognise the Council’s arguments that any score other than a score of 3 could lead to concerns that any given establishment needs to improve and, consequently, could be perceived as being below an appropriate standard and could therefore be targeted by some members of the public with malevolent intent. However, the test for the purposes of section 43(2) is whether a person’s commercial interests would, or would be likely to, be prejudiced – not whether they could be. As we have noted, there was insufficient evidence to support the argument that section 43(2) was engaged.[69]The Council’s position (reflected in the first witness’s statement) was that disclosure of the Withheld Information would be likely to result in “unfair and distressing personal attacks” on the Licence Holders. However, it is their commercial interests which is relevant for the purposes of section 43(2). We appreciate that there could be harm to their commercial interests if there were such attacks, but whether there ‘could’ be such harm is not the applicable test to be met. We also recognise the first witness’s view that there would be harm caused to the commercial interests of the Licence Holders if they were to suffer reputational attacks which caused some people to avoid going to their businesses. That view of the harm which would be caused is predicated on the hypothetical scenario that the Licence Holders were to suffer reputational attacks, which again does not meet the required test.[70]Fundamentally, we find that the Council’s position (and the first witness’s views) were based on conjecture as to what might happen, given other incidents which have historically occurred. Importantly, there was no evidence that such historical incidents were connected with any previous disclosure of inspection reports.[71]For all of the above reasons, we find that there was no evidence to demonstrate that the alleged prejudice to the Licence Holders’ commercial interests was ‘more probable than not’ or that there was a real and significant risk of such prejudice.[72]We therefore find that section 43(2) was not engaged in respect of the Withheld Information. It is therefore not necessary for us to go on to consider the associated Public Interest Test.

Whether section 40(2) was engaged

[73]The Council’s position was that the relevant issue was the Inspection Scores, given that it had disclosed template inspection reports, and that the Inspection Scores were the personal data of the respective Licence Holders.[74]The Second Respondent argued that the Inspection Scores could not be the Licence Holders’ personal data on the basis that they were an assessment of set criteria by the Council which applies to all licensed dog breeders. She also referred to the previous disclosure by the Council of inspection reports.[75]Another argument of the Second Respondent related to the possibility of one of Licence Holders as an employee of the licensed dog breeding business, such that the Inspection Scores would relate to the business and not the individual.[76]In order to determine whether or not the Inspection Scores constitute the personal data of the Licence Holders, having regard to the potential engagement of section 40(2), it is not appropriate for us to address issues regarding the previous disclosure of inspection reports by the Council. Rather, for the purposes of the appeal, it was necessary for us to assess whether or not the Inspection Scores were the personal data of the Licence Holders, regardless of any previous disclosure of inspection reports.[77]We find that the Inspection Scores do constitute the personal data of the Licence Holders. This is because (having regard to the meaning of ‘personal data’ set out in paragraph 37):a. based on the evidence before us, even where is a separate dog breeding business, the associated licence is issued to and held by a named individual (hence we disagree with the Second Respondent’s argument that the Inspection Scores would relate to the business);b. the Licence Holders are the named individuals (and this is reflected in the Withheld Information);c. the Inspection Scores relate to them, as the applicable licence holders for the dog breeding businesses.[78]As we have noted, the ‘processing’ of personal data includes disclosure under FOIA. The Council’s position was that the disclosure of the Inspection Scores would contravene the first data protection principle requiring personal data to be processed lawfully, fairly and in a transparent manner. The main premise in support of that position was that the Licence Holders have a reasonable expectation of privacy in respect of the Inspection Scores. In particular, this was because the Licence Holders’ inspection reports had not been previously disclosed and, even though the inspection reports of others had been disclosed previously, the Council’s practice at the time of the Request was not to disclose inspection reports.[79]The Council’s submissions in connection with its view that disclosure of the Inspection Scores would contravene the first data protection principle included:a. The Inspection Scores might be misconstrued (as referred to above), which would give rise to “misinterpretations and unfair characterisations” about the Licence Holders and therefore expose them to public criticism and other associated risks.b. The public interest in transparency about the Licence Holders’ dog breeding licences was already adequately served, including by the disclosure of the Licence Holders’ licence application documentation and their licences and the template inspection reports, and therefore the publication of the Inspection Scores would be unnecessary and disproportionate.[80]The Council accordingly argued that the disclosure of the Inspection Scores would constitute the unfair processing of the Licence Holders’ personal data. The Council also submitted that such disclosure would also constitute unlawful processing, because there would be no applicable basis for lawful processing set out in Article 6(1). The Council contended that the Legitimate Interests Basis would not apply because, even if the disclosure would be relevant to a legitimate interest, it would not be reasonably necessary and proportionate for the meeting of that interest. Consequently, the Council argued that the second limb of the Legitimate Interests Test would not be met (see paragraph 44). The Council further submitted that, in any event, the need for disclosure would (for the reasons referred to) be overridden by the interests or fundamental rights and freedoms of the Licence Holders for the purposes of the Balancing Test.[81]It may be helpful to reiterate the Legitimate Interests Basis at this juncture. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
. Translating that language to the context of the appeal: a. the disclosure of the Withheld Information/the Inspection Scores would be ‘processing’; b. the Second Respondent is the ‘third party’; and c. the Licence Holders (as the individuals to which the Inspection Scores relate) are the ‘data subjects’.[82]Given our finding that the Inspection Scores constitute the personal data of the Licence Holders, the first limb of section 40(2) is satisfied – namely the information in question constitutes personal data which is not the personal data of the person making the Request (the Second Respondent), as specified in section 40(2)(a).[83]Turning to the second limb of section 40(2) – namely, section 40(2)(b) - in order for the Withheld Information/Inspection Scores to be exempt from disclosure, the first, second or third condition referred to in that subsection must be satisfied. We consider that the first condition is relevant for the purposes of the appeal and that the most relevant data protection principle is the first data protection principle we have referred to. In considering whether the processing of the personal data in question is lawful, in our view the most applicable lawful basis for processing is the Legitimate Interests Basis. Consequently, the Legitimate Interests Test is applicable, which we now address.[84]In respect of the first limb of the Legitimate Interests Test, we find that the Second Respondent’s aims in seeking the Withheld Information were, in essence, to assure the public that dog breeders meet regulatory requirements (particularly regarding standards for dog welfare), to help inform consumer choice (including having regard to the standards being met by dog breeders) and to assure the public that the Council had undertaken its regulatory functions adequately in respect of inspecting dog breeders. We find that such aims are legitimate and accordingly that there were legitimate interests being pursued by the Second Respondent by way of the Request.[85]We accept the first witness’s evidence regarding the controversial and highly competitive nature of dog breeding in Northern Ireland. We consider that those are factors favouring disclosure of the scores awarded to individual breeding establishments (including the Licence Holders). We appreciate that the first witness had stated that the scoring in inspection reports was not intended for consumer purposes, but we consider that that is a separate issue to what the Second Respondent’s aims were in seeking the Requested Information. Further, whilst that might not be the intended purpose, we consider that disclosure of scoring for individual breeding establishments would nevertheless aid consumer awareness and choice and we consider that this is important given the wider context of an industry which is controversial and competitive. We also appreciate that the witness stated that the inspection reports were a mere snapshot in time and that, if an establishment was awarded lower scores at the time of an inspection, that could be improved on at another time/inspection, but we consider that such as snapshot is still pertinent to consumer choice.[86]The second limb of the Legitimate Interests Test involves ascertaining whether the relevant processing is necessary for the purposes of those legitimate interests. As we have noted, this test of ‘reasonable necessity’ must be met before the Balancing Test can be considered.[87]We find that the relevant processing is reasonably necessary and proportionate for the purposes of the legitimate interests being pursued by the Second Respondent, on the basis that there is no other, lesser, means of achieving those legitimate interests. We acknowledge the arguments of the Council that the public interest in transparency about the Licence Holders’ dog breeding licences was already adequately served, but in our view that does not address all aspects of the legitimate interests in question. In particular, the disclosure of the Licence Holders’ licence application documentation, their licences and the template inspection reports does not sufficiently demonstrate that the Council had undertaken its regulatory functions adequately (because there is no detail of the assessment and the scoring in question for each of the Licence Holders) and does not aid consumer choice or awareness in respect of standards achieved by the Licence Holders.[88]We therefore turn to the Balancing Test. We recognise that, when considering potential disclosure of personal data under FOIA, the guiding principle (as confirmed by case law) is the protection of privacy with respect to the processing of personal data. However, there is a balancing exercise to be undertaken regarding the rights of a data subject and the need to process the personal data in question.[89]We have referred to the Council’s position regarding the Licence Holders’ expectations of privacy and why the Council considered that it was unnecessary and disproportionate to disclose the Inspection Scores. We accept that the Licence Holders, by way of their statements contained in the closed bundle, have objected to the disclosure of the Withheld Information. However, as we have noted, their objections were not focused on the Inspection Scores but to the disclosure of any information relating to them/their businesses, even though they had themselves put such information in the public domain. Consequently, we consider that we cannot afford much weight to those objections for current purposes.[90]Moreover, there was little other evidence before us regarding the Licence Holders’ expectations as to what would and would not be done with the Inspection Scores. In particular, the Council did not adduce evidence in respect of its privacy policy which would have been applicable in respect of the processing of the Licence Holders’ personal data. We asked the first witness about this during the hearing, but they were unable to outline what the privacy policy stated.[91]The Commissioner submitted, in essence, that it is arguable that a commercial dog breeder should understand the potential disclosure, especially given the length of time that “the FOIA access regime” has been in place. We consider that there is some force behind that argument, particularly given the fact that other personal data had been disclosed in respect of the Licence Holders, including that contained in their respective licence application documentation.[92]In short, we find that that Licence Holders cannot have had a reasonable expectation of privacy, taking into account the circumstances and the specific nature of the Withheld Information. This is particularly because, in summary, there was already disclosure of their personal data related to their dog breeding businesses, they had already themselves published information about them and their business and there was insufficient evidence of their expectation of privacy (including with regard to the applicable privacy policy).[93]For all of the above reasons, we find that section 40(2) was not engaged in respect of the Withheld Information and accordingly that the Council cannot rely on it to refuse to disclose the Withheld Information.

Submissions regarding section 38(1)

[94]As part of our ‘full merits review’ of the appeal, we raised the question in the hearing about the possible application of section 38(1) to the Withheld Information. Mr Hopkins submitted that the Council did not wish to rely on section 38(1); the Council’s position was not that the health or safety of any person would, or would be likely to, be endangered. Similarly, the Council did not adduce any evidence relevant to the potential engagement of section 38(1).[95]Accordingly, we find that section 38(1) was also not engaged in respect of the Withheld Information and it is therefore not necessary for us to go on to consider the associated Public Interest Test.

Final conclusions

[96]For all of the reasons we have given, we find that:a. the Decision Notice was correct to conclude that section 43(2) was not engaged in respect of the Withheld Information; andb. the Council is not entitled to rely on section 40(2) or section 38(1) to refuse to disclose the Withheld Information.[97]We therefore dismiss the appeal.