Ganesh Sittampalam v Information Commissioner [2025] UKFTT 79 (GRC)

[2025] UKFTT 00079 (GRC)

Case Reference: FT/EA/2024/0238

First-tier Tribunal

(General Regulatory Chamber)

Date 29 January 2025

Information Rights

Heard: Determined on the papers

16 December 2024

Before

TRIBUNAL JUDGE MORNINGTON

TRIBUNAL JUDGE HUGHES

TRIBUNAL MEMBER PALMER-DUNK

Between

Ganesh SITTampalamAppellant

INFORMATION COMMISSIONERRespondent

Decision: The appeal is Dismissed.

1.The Appeal was decided without a hearing as agreed by the parties and allowed by the Tribunal by rule 32(1) Tribunal Procedure (First -Tier Tribunal) (General Regulatory Chamber) Rules 2009

REASONS

Background to Appeal

[1]This Appeal dated 19 June 2024 and made by Mr Arjuna Ganesh Sittampalam (the “Appellant”). Mr Sittampalam had made a report of a vehicle being parked on a grass verge next to zig-zag lines to Cambridgeshire Police Constabulary and had submitted dash cam footage in support of his report.

[2]The Appeal arises following a request for information (the “Request”) made by the Appellant to Cambridgeshire Constabulary (“the Constabulary”) on 15 November 2023 in the following terms:

“Hi, Please could you send me any records you have about this report I made about an [sic] car parked on a verge next to zig-zag lines? (from the subject line it appears to have the reference number 966-25542-23-2525-VE02). Regards Ganesh Sittampalam”

Regards Ganesh Sittampalam”

Regards

[3]The Constabulary responded, also on 15 November 2023, to the Appellant’s request in the following terms:

“Good afternoon and many thanks for your email. Please be advised personal data is exempt under Section 40 of the FOI Act you will therefore need to submit a subject access request under Data Protection Act 2018 to dataprotection@beds.police.uk to request this information. Please see the following guidance on how to submit this request. Applications are free of charge and requests will be processed (once we have been able to verify your identity) within one month which is in accordance with the DPA18. You are only entitled to access your own personal data through a SAR. We cannot provide third party information; any names of suspect/offender or witnesses and their accounts will be exempted and redacted. You will be required to provide scanned copies of identification that confirms your name, date of birth and current address. If you are applying for media, we will also require a scanned copy of photographic identification so that we can identify you in the footage. If we are not able to identify you then we cannot release the media. Please also note this is a collaborated unit that processes requests from Beds, Cambs and Herts Police.”

[4]The Appellant was not satisfied with the response of the Constabulary and sent a further email as detailed below:

“Hi, Thanks for your reply. Please could you carry out an internal review under the FOI act? - I don't agree that s40 would apply to everything I've requested. I don't think that your assessment of the report I made using information observable in public is my personal data and to the extent that it is the personal data of the owner of the vehicle I photographed, I think there's a clear interest in providing any basic details of how you have handled this report that would override their privacy rights - You haven't provided a compliant refusal notice that specifies which parts of s40 you are applying to which information and why it applies. As I made the report to Cambridgeshire police about something that happened in the county I believe that anything held by another force or a joint unit would be held on your behalf.”

[5]The Constabulary responded to the Appellant’s further email, this time by way of letterheaded paper, to confirm the following:

“Dear Ganesh Sittampalam REQUEST UNDER THE FREEDOM OF INFORMATION ACT 2000 Ref No: FOI2023/07814 REQUEST UNDER THE FREEDOM OF INFORMATION ACT 2000 Ref No: FOI2023/07814 I write in connection with your request for information received on 15th November. I note you seek access to the following information: Please could you send me any records you have about this report I made about an car parked on a verge next to Please could you send me any records you have about this report I made about an car parked on a verge next to zig-zag lines? (from the subject line it appears to have reference number 966-25542-23-3535-VE02). zig-zag lines? (from the subject line it appears to have reference number 966-25542-23-3535-VE02). I am required by the Freedom of Information Act 2000 (The Act) to handle all requests in a manner that is blind to the identity of the requestor. Any information released in response to a request is regarded as being published and therefore, in the public domain without caveat. Response - Following enquiries with Cambridgeshire Constabulary please see our response below. Cambridgeshire Constabulary can confirm that it holds information in relation to your request however, I am not obliged to supply the information you have requested. Such information is exempt under the following exemption/s: Section 40(2) – Personal Information Section The Section 40 exemption is a class based absolute exemption. This means that the legislators have identified that there would be harm in disclosure and there is no need to evidence this or carry out a public interest test. Should you have any further enquiries concerning this matter please do not hesitate to contact me quoting the above reference number. Should you have any further enquiries concerning this matter please do not hesitate to contact me quoting the above reference number. Yours sincerely”

Section 40(2) – Personal Information Section Yours sincerely”

Section 40(2) – Personal Information Section

[6]Still dissatisfied with the response, the Appellant responded to the Constabulary once more, by way of email, on 13 December 2023 to request a further internal review of his request:

“Hi, I would still like an internal review of this based on the reasons set out in my email of 15th November, which have not been addressed at all. s(40)(2) is an absolute exemption but you still need to show that release would be unfair for the exemption to apply. I would particularly highlight that the evidence is public information that anybody could have observed. In addition a basic assessment of whether any offence has been committed in the circumstances disclosed would apply to any car parked in similar circumstances and therefore it is not clear that it is personal data at all. Given the generic nature of your response I also do not believe you have responded promptly, as required by the legislation. Regards, Ganesh Sittampalam”

Ganesh Sittampalam”

[7]The Constabulary sent a final correspondence to the Applicant on 11 January 2024, one more refusing to deal with the request, citing s.40(2) Freedom of Information Act 2000:

“Dear Ganesh Sittampalam REQUEST UNDER THE FREEDOM OF INFORMATION ACT 2000 Ref No: IR2023/08439 I write in response to your request for an internal review of the handling of your information request. I have considered the scope of your request, the response sent to you and the specific points you have raised. Your request was considered under Section 1(1) of the Freedom of Information Act 2000(FOIA) which entitles you to be provided with a copy of any information ‘held’ by a public authority unless an appropriate exemption applies. You have requested: I would still like an internal review of this based on the reasons set out in my email of 15th November, which have not been addressed at all. s(40)(2) is an absolute exemption but you still need to show that release would be unfair for the exemption to apply. I would particularly highlight that the evidence is public information that anybody could have observed. In addition a basic assessment of whether any offence has been committed in the circumstances disclosed would apply to any car parked in similar circumstances and therefore it is not clear that it is personal data at all. Given the generic nature of your response I also do not believe you have responded promptly, as required by the legislation. Following our response to your application under the Freedom of Information Act 2000 (FOIA), you expressed dissatisfaction and requested an Internal Review of our decision on 13th December 2023. Original Request Received on 15th November 2023: Please could you send me any records you have about this report I made about an car parked on a verge next to zig-zag lines? (from the subject line it appears to have reference number 966-25542-23-3535-VE02). Response A response was provided to the original request under FOIA on 13th December 2023, in compliance with section 10(1) FOIA. The initial response was refused in full by virtue of the exemption at Section 40 (2) Personal Information. Conclusion Having undertaken a fair and thorough review of the procedures and decisions taken in relation to FOIA when responding to your Freedom of Information request and considered your reason for an Internal Review. I am satisfied that the exemption was appropriately applied and our position to not disclose the information is unchanged. If you are still dissatisfied with the decision, you may make an application to the Information Commissioner. For information on how to make a complaint please visit their website at ....”

REQUEST UNDER THE FREEDOM OF INFORMATION ACT 2000 Ref No: IR2023/08439 You have requested:

Original Request

[8]It was following this correspondence sent by the Constabulary on 11 January 2024 that the Appellant made a complaint to the Information Commissioner (“IC”).

Reasons for Commissioner’s Decision

[9]The matter was referred to the Information Commissioner's Office on 11 February 2024 and, after an investigation, the IC wrote to the Appellant and the Constabulary on 14 May 2024.

[10]In both correspondences, the IC suggested that the Constabulary reconsider their approach in handling the Appellant’s request before the IC issued its Decision Notice (“DN”). The IC was not satisfied that the Constabulary had properly considered whether all of the withheld information was personal data, nor had the Constabulary properly addressed why the s.40(2) FOIA exemption applied or how providing the requested information would breach the Data Protection Principles as set out in the UK General Data Protection Regulations (“UK GDPR”).

[11]On 7 June 2024, the Constabulary responded to the IC’s request for clarity. The Tribunal notes that the IC refers to the Constabulary’s responses in the DN as being unsatisfactory in that the Constabulary fell short of the IC expectation that public authorities provide full responses to all investigation questions posed by the IC.

[12]In a Decision notice dated 17 June 2024, the IC confirmed that the commissioner considered that the Constabulary ought to have applied s.40(5A) FOIA, to neither confirm nor deny whether the requested information was held and accordingly the Commissioner proactively applied this exemption.

[13]In summary, the IC’s Decision was that although the Constabulary relied on s40(2) FOIA to withhold the information, the Appellant’s request was primarily for his own personal data and accordingly, would be exempt information under section 40(5A). The Commissioner, after proactively applying s.40(5A) decided that any information held which relates to third parties is exempt under s.40(5B) of FOIA.

[14]Notably the IC stated:

“in merely confirming that it held any information within the scope of the request, the public authority would also, by definition, be confirming, to the world at large (which is what FOIA requires) whether the complainant had made a report about an alleged incident.”

[15]The IC suggested that the Appellant make a subject access request to obtain any information which includes his personal data.

The Appeal

[16]The appeal relates to the application of the Freedom of Information Act 2000.

[17]The Appellant appealed the Decision Notice on the following grounds:a. The IC did not provide any legal basis for proactively applying s40(5A) and s40(5B) of FOIA;

b. There is no obligation on any authority to apply any exemption under FOIA;

c. The Constabulary have only provided the Appellant with the report he had submitted and no extra information;

d. Other Police forces routinely make this information available;

e. The IC has assumed that the Appellant has not made a Subject Access Request but has not confirmed this with the Appellant;

f. The Constabulary has not provided a formal refusal notice;

g. The Constabulary were not prompt in their response and is in breach of s17 FOIA.

The Commissioner’s Response

[18]The Commissioner’s response to the appeal maintains that the Decision Notice is correct.

[19]The Commissioner considers that he is able to find that the section 40(5) exemption is engaged even when a public authority has not considered this exemption. The Commissioner relies upon the Upper Tribunal decisions in Information Commissioner v Malnick and the Advisory Committee on Business Appointments (

[2018] UKUT 72 (AAC)

, James McLaren v Information Commissioner (EA/2021/0240) and Joe Naulls v Information Commissioner and NMC (EA/2018/0022, 8 October 2018).

[20]The Commissioner considers that even if a different public authority may decide to disclose information which is similar or even the same as information withheld by another public authority does not preclude the successful withholding of that information given that each case is to be considered on its own merits and circumstances.

[21]The Commissioner accepts that the Constabulary are in breach of section 17(1)(c) FOIA in that neither of the communications sent to the Appellant clearly states why section 40(2) applies. The Commissioner invites the tribunal to substitute his DN to reflect this.

[22]However, the IC does not accept that there is a breach of section 17(7) as the Constabulary’s correspondence clearly sets out the procedure for review of a decision made by the Constabulary.

[23]Moreover, the IC does not accept there has been a breach of section 17(1) as this section applies to the obligations of a public authority relating to the duty to confirm or deny. The obligations do not extend to the IC proactively applying an exemption.

The Appellant’s Reply to the Commissioner’s Response

[24]The Appellant replied to the IC response to the Appeal. In summary, the Appellant sets out that he accepts that the report of which he is already in possession is refused to be released under FOIA.

[25]The Appellant withdraws his challenge to the Commissioner’s entitlement to proactively apply exemptions.

[26]The Appellant takes issue with any “extra information” which he has no information upon as to whether it is held by the Constabulary or not. The Appellant claims that although the fact of him making a report is his personal data, the subject of the report was publicly available information and affects him to the same extent as it affects any other member of the public living in the same area. He claims that any “extra information” which does not include any unique identifiers ought to be released as he is aware that this is the approach taken by a different Police force nearby.

[27]The Appellant accepts that there is no breach is section 17(7) FOIA.

[28]The Appellant claims that although the Constabulary replied within the statutory period of 20 working days of the request, they were in a position to reply sooner within the 15 November 2023 response rather than the 13 December 2023 response and accordingly, their response was not prompt as required by section 10(1) FOI.

Documents

[29]The Tribunal read and took account of an 88-page open bundle of documents alongside a closed bundle provided by the Constabulary.

Applicable Law

[30]The relevant provisions of FOIA are as follows: 1. General right of access to information held by public authorities. (1) Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.

[2]Effect of the exemptions in Part II. (1) Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either— (a) the provision confers absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.

[40]Personal information(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a)would contravene any of the data protection principles (4A) The third condition is that— (a) on a request under Article 15(1) of the UK GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under .... Schedule 2 to the Data Protection Act 2018. (5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1). (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles, (d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

[58]Determination of appeals.(1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based. 31. The relevant provisions of the UK GDPR are: Article 5 (1) Personal data shall be: (a). processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness, transparency’) Article 6 (1) (f). processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Discussion and Conclusions

[32]In accordance with section 58 FOIA, the issue for the Tribunal to decide upon is whether the IC’s Decision Notice was in accordance with the law and whether the IC was correct in proactively applying section 40(5A) and 40(5B) of FOIA.

[33]Under section 58(2) FOIA, the Tribunal is able to review any finding of fact upon which the Decision Notice was based, consider all of the evidence before it and reach its own decision.

[34]The Tribunal has considered the bundles of documents and the overall circumstances of the case.

[35]Under section 1(1)(a) FOIA, a public authority is obliged to tell an applicant whether or not it holds the information requested. There are however exemptions from this duty.

[36]Section 40(5A) FOIA provides that he duty to confirm nor deny does not arise in relation to a request for information which is exempt information as it constitutes personal data of which the applicant is the data subject.

[37]As the Appellant requested information including his own personal data, s40(5A) is engaged and the duty to confirm or deny does not arise. The IC is correct at paragraph 18 of his DN that “in merely confirming that it held any information within the scope of the request, the public authority would also, by definition, be confirming, to the world at large (which is what FOIA requires) whether the complainant had made a report about an alleged incident”.

[38]The Appellant has been advised that should he wish to obtain information containing his own personal data then the making of a subject access request (‘SAR’) would be the appropriate course of action. The Tribunal is aware from the email exchanges between the Constabulary and the Appellant on 11 December 2023 that such SAR had been made, and that the Constabulary had provided the Appellant with his personal data by 11 December 2023. The original FOIA request was made on 15 November 2023 and the Constabulary responded to the FOIA request also on 15 November 2023. There was a further response provided by the Constabulary on 13 December 2023. At some point between 15 November 2023 and 11 December 2023, the Appellant made a SAR, and the Constabulary duly responded to the SAR.

[39]The Tribunal congratulates the Constabulary for responding promptly to the SAR and whilst the Appellant takes issue with the IC’s presumption that he had not made an SAR, the IC would not have been aware of the SAR being made and simply took the standard and helpful step of advising the Appellant to request his own data in the proper way.

[40]Section 40(5B)(a)(i) FOIA provides that the duty to confirm or deny does not arise if doing so would contravene any of the principles relating to the processing of personal data set out in Article 5 of the UK General Data Protection Regulation (UK GDPR). The Tribunal agrees with the IC that to the extent that confirming or denying information is held discloses information about other people then the exception under s40(5B) applies.

[41]Personal data is defined as ‘any information relating to an identified or identifiable living individual’, by s.3(2) Data Protection Act 2018 (DPA), and the ‘processing’ of such information includes ‘disclosure by transmission, dissemination or otherwise making available’: see (s.3(4)(d) DPA); including by confirming or denying that such personal information is held..

[42]The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be ‘processed lawfully, fairly and in a transparent manner in relation to the data subject’. Confirmation or denial that the information is held can therefore only be made if to do so would be lawful, (which means it would meet one of the conditions of lawful processing listed in Article 6(1) UK GDPR), and be fair, and transparent.

[43]The condition most applicable on the facts of the present case would be that contained in Article 6(1)(f) UK GDPR which provides as follows:- “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”

[44]It is accepted that the information requested by the Appellant all relates to an investigation into the actions of a particular individual who parked their vehicle on a grass verge, and indeed that is what the Appellant is interested in, and that to confirm or deny whether the information requested or held would reveal information that is personal information relating to that individual and any investigation that they might or might not have been subjected to. Therefore, for the purposes of s40(5B)(a)(i) FOIA the duty to state whether or not the information is held for the purposes of s1(1)(a) FOIA does not apply if to do so would breach any of the data protection principles.

[45]As explained above the first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be ‘processed lawfully, fairly and in a transparent manner in relation to the data subject’. Accordingly, confirmation or denial that the information is held can only be made if to do so would be lawful.

[46]This means that the confirmation or denial would have to meet one of the conditions of lawful processing listed in Article 6(1) UK GDPR, and then be fair, and transparent. As set out above the condition most applicable on the facts of the present case would be that contained in Article 6(1)(f) UK GDPR.

[47]The Tribunal accepts that the Appellant has a legitimate interest in obtaining the confirmation or denial that he has requested in that he seeks to understand how his report was handled by the Constabulary t. Accordingly, confirmation or denial as to whether the information is held is necessary to meet the Appellant’s interest. However, the Tribunal considers that any third-party to whom the request for information relates would reasonably expect that their personal data would not be disclosed to the world at large under FOIA. It is the Tribunal’s view that revelation as to whether or not a person is subject to police investigation is a serious interference with a person’s right to privacy, and that the Appellant’s interests do not, in the Tribunal’s view, override the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

[48]It follows, therefore, that the Tribunal accepts that the IC was correct in proactively applying the exemptions to neither confirm nor deny whether the requested information is held under s40(5A) and s40(5B) FOIA.

[49]Notwithstanding the Appellant’s claims regarding a nearby Police Force, if Police Forces and Constabularies routinely released information relating to reports made by the public and their subsequent investigation, it would likely discourage the public from making helpful reports to the police for fear of being identified as the reporter. Whilst this may seem nonsensical to the Applicant given that he is aware that it was himself who made the report in this case, it is the correct approach to neither confirm nor deny the existence of a report to the police as disclosure under FOIA is effectively disclosure to the circa 8 billion inhabitants of the World.

[50]The Constabulary provided their response within the statutory period of 20 days and, whilst the Appellant may feel that the Constabulary was in a position to respond sooner or include further information within the initial response of 15 November 2023, promptness is often dependant on the workload and capacity of those within the Constabulary. In any event, the Appellant received a response within the statutory time frame and in the circumstances, the Tribunal do not consider that the response was not prompt.

[51]The Tribunal substitutes the Commissioner’s Decision Notice to include that the Constabulary were in breach of section 17(1)(c) FOIA in that there was no explanation by the Constabulary as to why they considered section 40(2) FOIA applies. The Tribunal finds that the remainder of the Decision is correct in law.

[52]The Tribunal dismisses the remainder of the appeal for the reasons given above. Signed Judge Peri Mornington Date: 24 January 2025