Phil Flanagan v The Information Commissioner & Anor [2025] UKFTT 901 (GRC)

[2025] UKFTT 00901 (GRC)

Case Reference: FT/EA/2024/0392

First-tier Tribunal

(General Regulatory Chamber)

Hearing Heard on the papers: 2 April 2025

Date 29 July 2025

Information Rights

Before

TRIBUNAL JUDGE FOSS

TRIBUNAL MEMBER COSGRAVE

TRIBUNAL MEMBER SHAW

Between

PHIL FLANAGANAppellant

THE INFORMATION COMMISSIONERRespondent

FERMANAGH AND OMAGH DISTRICT COUNCILRespondent

unrepresented for Appellant

for First Respondent: Nicholas Martin, Solicitor, Information Commissioner

for Second Respondent: Robin Hopkins, Counsel

Decision:

The Appeal is Dismissed.

REASONS

Background

[1]This is an appeal against Decision Notice Reference: IC-295265-W9C5 dated 4 September 2024, in which the First Respondent (“the Commissioner”) decided that the Second Respondent (“the Council”) was entitled to rely on s40(2) of the Freedom of Information Act 2000 (“FOIA”) to withhold information requested by the Appellant (“the disputed information”).

[2]The parties were agreeable to the determination of the appeal on the papers, that is to say, without an oral hearing. We are satisfied, pursuant to Rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) rules 2009, that we can properly determine the issues without a hearing.

[3]We had before us an OPEN bundle, and a CLOSED bundle containing the disputed information.

[4]The Tribunal Administration brought to our attention that on 3 March 2025, the Council had applied to the Tribunal for a direction pursuant to Rule 14 of the Tribunal Rules that the material in the CLOSED bundle be held on a CLOSED basis, and not be made available to any party or person other than the Commissioner, because its disclosure would defeat the purpose of the appeal. Having reviewed the material, we agree. By a separate direction, the Tribunal has directed accordingly.

The Request

[5]On 28 November 2023 the Appellant made a request by multiple questions of the Council for information relating to the Council’s operation of its Strategic Capital Grants programme from July 2022 to October 2023.

[6]The programme was intended to provide financial assistance to the delivery of projects supporting the regeneration and development of communities within the purview of the Council’s Community Plan. Applications were invited by 8 July 2022, and scored against published criteria in a structured process, resulting in recommendations being made to the Council’s Grant Aid Panel, and then the Council’s Regeneration and Community Committee. On 30 March 2023, the Council informed five community organisations that they had been successful in securing funding. We understand that the total funding available was £1.2 million.

[7]The Council offered detailed feedback to unsuccessful applicants or the opportunity to appeal the outcome of their grant applications on specified grounds through a structured appeals process. On 31 July 2023, the Council’s Grant Aid Appeals Panel considered seven appeals, refused them all and upheld the original grant decisions.

[8]The Council disclosed some of the information requested by the Appellant but withheld other parts. For the purposes of this appeal, we are only concerned with one aspect of the Appellant’s request, namely:

“A list of all council officers involved at any stage in the assessment process, details of their involvement, and any information held by them in relation to the assessment process.”

[9]The Council's position, shared by the Commissioner, is that that the disputed information is exempt from disclosure under s40(2) FOIA: it is the personal data of the relevant Council employees, and publication of their personal data would contravene Article 5(1)(a) of the UK GDPR because it would be unfair and because no lawful processing condition from Article 6(1) of the UK GDPR would be satisfied.

The Council’s Response to the request

[10]On 4 January 2024, the Council responded to the request, supplying this information:

“Officer Assessment Panel: Funded Programmes Manager, Funded Programmes Co-ordinators x 2 and Rural Regeneration Officer. Officer Moderation: Head of Service Economic Development and Investment, Economic & Regeneration Manager, Funded Programmes Manager and Rural Regeneration Officer. All officers involved in this grants process are experienced in the assessment of grant applications. The staged assessment process contained in the attached Guidance Notes was adhered to by the assessing panel. Two conflicts of interest were declared during the assessment with the relevant officers removing themselves from the room during the relevant assessments.”

Internal Review

[11]On 22 November 2024, the Appellant sought an internal review. He said:

“No names of Council Officers have been provided. No details of those who declared Conflicts of Interests have been provided or where this information was recorded. A record of the meeting or notes held by attendees of the Officer Assessment Panel and the Officer Moderation would also fall under the original FOI request and has not been mentioned or provided.”

[12]On 15 March 2024, the Council responded. It explained that it had a duty to protect personal data; it had weighed the legitimate interest of disclosure against the rights of affected employees, and concluded that there was no legitimate interest in releasing the names of the people on the panels “as knowing their names will not add anything to the requests, and staff would feel uncomfortable sitting on Panels in the future if they were aware that there name could be released.” The Council confirmed that it was withholding the name of any relevant person below a Head of Service level pursuant to s40(2) FOIA, and it provided the name of one person who, we assume, was of Head of Service level grade or above.

Complaint to the Commissioner

[13]On 16 March 2024, the Appellant complained to the Commissioner. The Appellant identified that four people had been involved in the assessment process, two of whom had declared conflicts of interest, and that the Council was refusing to release details of that information to him. Specifically, he wanted to know the identities of the two persons who declared conflicts of interest and from which decisions they had removed themselves.

The Commissioner’s investigation

[14]The Commissioner investigated.

[15]During that investigation, the Appellant submitted to the Commissioner that knowing the identities of the relevant individuals and the nature of their conflicts was a legitimate request, and none of them would have a reasonable expectation that their identities would not be disclosed.

[16]In response, the Council explained to the Commissioner that conflicts of interest were declared at the start of the meeting, in line with normal Council process: “Two Officers declared an interest and removed themselves from decision making and award of funding; the two declarations were documented and are held on Council record.”.

[17]The Council went on to explain:

“Written declarations were recorded and retained. Officers considered the reasonable expectations of individuals, taking into account: their expectations both at the time the information was collected and at the time of the request; the nature of the information itself; and the Data Protection principle of lawfulness, fairness, and transparency. Officers did consider the weight of legitimate public interest in disclosure against the rights of employees and, in this case, feel there is no overwhelming legitimate interest in releasing the details of the declarations and who made them. Officers are withholding all the details under Section 40(2) of the Freedom of Information Act, and in particular Section 40(3A), where disclosure of the information would breach one or more of the Data Protection principles.”

[18]In response to the Appellant’s submission to the Commissioner that his request was a legitimate request, the Council said this: Please note in the response above, which was communicated to the Complainant, Officers did consider the weight of legitimate public interest in disclosure against the rights of employees and, in this case, feel there is no overwhelming legitimate interest in releasing the details of the declarations and who made them. Officers below Head of Service level were asked if they wished to waive their anonymity for their names and conflicts of interest to be released through an FOIA; all Officers raised concerns and indicated they would not be comfortable with their names and conflicts of interest being released.”

The Decision Notice

[19]By the Decision Notice, the Commissioner decided that:a. The names, contact details and information about conflicts of interest which individuals declared is information which identifies and relates to the individuals concerned, and was, therefore, personal data within the meaning of s3(2) of the Data Protection Act 2018 (“DPA”).

b. the Appellant’s need for transparency in relation to the information sought was a legitimate interest.

c. However, disclosure of the requested personal data was not reasonably necessary to meet that interest; disclosing the personal data “to the world” under FOIA would add no real value, and would not, as the Council had submitted to him, change the application or appeals process.

d. Given that disclosure was not necessary, there was no lawful basis for disclosure of the information, and the Council was entitled to withhold it.

The Appeal

[20]By Notice of Appeal dated 1 October 2024, the Appellant submits, in summary, that:a. To be satisfied as to the existence of a relevant conflict of interest, it is necessary to know who was involved in the process of scoring the competing projects. Although the scored application forms were made available to the Grant Aid Panel and the Grant Aid Appeals Panel, who are accountable for making the ultimate funding decision, they were not the persons who marked the applications.

b. Even if a conflicted individual recused themselves from a particular application, that conflict of interest may still be operative in relation to those applications in which they were involved where they had not declared a conflict of interest.

c. While the internal grant application process within the Council may be closed there are other mechanisms the Appellant might pursue, for example, making a complaint to the Local Government Auditor in the Northern Ireland Audit office or to the Northern Ireland Public Services Ombudsman. The release of this information is central to whether a complaint would be lodged with either body, which gives rise to a lawful basis for disclosure of the requested information.

d. Refusal to disclose the data sets a dangerous precedent: an inability to disclose whether conflicts have been appropriately declared.

e. A Council employee who sits on a panel to award £1.2 million is not a junior employee and they should have a reasonable expectation that their name would be disclosed as part of minute taking and disclosed, if requested.

f. The Council’s own appeal processes, of which the Appellant had attempted to avail himself, did not involve a review of the applications or their scoring, which indicates a lack of oversight and transparency.

g. The Appellant would be content with a restricted disclosure of the requested information to him, outwith FOIA.

[21]By his Response, dated 4 December 2024, the Commissioner submitted, in summary, that:a. It was not necessary to disclose the requested information because conflicted individuals declared their conflicts and removed themselves from the relevant decision making, scoring and award of funding.

b. There were other means of redress available to the Appellant, where the relevant bodies could investigate the Appellant’s concerns and make enquiries of the Council about the conflicts.

c. The Commissioner was satisfied that it was appropriate, for the reasons the Council had given him, for the Council to identify the job titles of officers involved in the assessment process together with the name of the Head of Service involved, but to withhold the names of officers below that grade.

d. The Head of Service retains accountability for matters so that disclosure of the requested information is not necessary. Additionally, there is public information available such as the Council’s Regeneration and Community Committee papers, with provides transparency over the process, together with that other information which the Council had already disclosed to the Appellant.

[22]By its Response, dated 17 December 2024, the Council submitted, in summary, that:a. It agrees with the Commissioner’s analysis on the facts of this case, namely that while the Appellant has a legitimate interest in the requested information, it is it not necessary for such information to be disclosed under FOIA.

b. The Council has already informed the Appellant that two conflicts of interest were declared, with the relevant individuals removing themselves from the relevant assessments, so that they played no role therein. Thus, there is no need for any further disclosure to satisfy any legitimate interest in transparency on this point. There is no basis (other than speculation) to conclude that any other individual had a conflict of interest, and so it is not necessary for their personal data to be disclosed either. Publication of the individuals’ personal data in these circumstances would contravene their reasonable expectations and would be unfair; it would also not be reasonably necessary for and/or proportionate to any legitimate interest.

c. It would have been impractical for the two conflicted individuals not to participate in assessment of those applications in respect of which they had no conflict of interest; wholescale withdrawal of officers from assessment of 28 eligible applications merely on grounds of one conflict of interest (each) in relation to one application (each) would be disproportionate in that the Council would forego the input of experienced officers in the process.

d. On an Open basis, the Council was prepared to confirm that the two declared conflicts were based on indirect connections which could conceivably lead to some persons being concerned about conflicts of interest. The individuals had no direct involvement with the relevant applicants. The conflicts were declared “out of an abundance of caution”.

e. The individuals who declared conflicts were below Head of Service level; this is relevant to the level of accountability which could reasonably be expected of them, and to their expectations as to the public disclosure of their personal data.

f. The relevant individuals have not consented to the disclosure of their personal data. Disclosure under FOIA is to be treated as disclosure to the public. Neither the Commissioner nor the Tribunal can order more limited disclosure, which the Council would oppose in any event because it considers that disclosure of the personal data of those individuals below Head of Service level would be likely to be upsetting to them in the circumstances.

g. The Council applied well-established policies and procedures both in respect of conflicts of interest and in respect of the process for awarding these grants, subject to oversight, not least by reports to the Council’s Grant Aid Panel (of elected Members), its Regeneration & Community Committee and to the full Council.

h. There is no real need for further transparency in this case. The Appellant does not need the personal data of these officers to progress any complaints he may wish to make about the grants process. The Council has already disclosed the job titles of the individuals involved together with the name of the relevant Head of Service. The Council has also reported on its decisions and offered feedback to unsuccessful applications. In all those circumstances there is no need for publication of the requested personal data. The Legal Framework

[23]The relevant provisions of FOIA are as follows: Section 1 General right of access to information held by public authorities. (1) Any person making a request for information to a public authority is entitled- (a) To be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) If that is the case, to have that information communicated to him.

[24]The general right of access, is, however, subject to certain exemptions set out in Part 2 of FOIA. Relevant to this appeal is s40 FOIA which provides: Section 40 Personal information(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles ...

[25]S3(2) DPA defines personal data as “any information relating to an identified or identifiable living individual.” The “processing” of personal data includes disclosure by “transmission, dissemination or otherwise making available” (s3(4)(d) DPA).

[26]The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”. “Lawful” entails disclosure meeting one of the conditions of lawful processing listed in Article 6(1) UK GDPR.

[27]The applicable condition in this case is Article 6(1)(f) UK GDPR, namely that the disclosure “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

[28]Section 40(2) FOIA, so far as relating to the first condition under s40(3A) FOIA, is an absolute exemption, and not therefore subject to a public interest test.

[29]S58 FOIA provides that:(1) If on an appeal under section 57 the Tribunal considers- (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

[30]The import of s58 FOIA is that the right of appeal to the First-tier Tribunal involves a full merits consideration of whether, on the facts and the law, the public authority’s response to the Request is in accordance with Part 1 of FOIA (Information Commissioner v Malnick and ACOBA

[2018] UKUT 72 (AAC)

; the Tribunal has jurisdiction to decide, de novo on the merits, whether the Commissioner’s decision is in accordance with the law.

Analysis

[31]It is no part of the Tribunal’s jurisdiction to determine any procedural or substantive unfairness in, or, ultimately, the lawfulness of the Council’s grant assessment process or funding decisions. Nor is it any part of the Tribunal’s role to determine whether any relevant individual had a conflict of interest, or whether such conflict was operative, or potentially operative, in any part of the process or decision-making. To that end, we do not address any of those facts or matters which the Commissioner or the Council contends justify the process adopted by the Council or the decisions reached.

[32]The Tribunal’s role is to oversee the correct application of FOIA, and to determine the lawfulness of the Council’s responses to the request, specifically, in this case, whether the Council was entitled to withhold the disputed information pursuant to s40(2) FOIA.

[33]We are satisfied that the withheld information is personal data within the meaning of s3(2) DPA, and that its disclosure under FOIA would constitute processing within the meaning of s3(4)(d) DPA.

[34]The focus of our consideration, therefore, is whether disclosure of the disputed information under FOIA would contravene Article 6(1)(f) UK GDPR: specifically, would disclosure be lawful, fair and transparent?

[35]Dealing with the first requirement of lawfulness: resolving that issue involves consideration of three questions (South Lanarkshire Council v Scottish Information Commissioner

[2013] UKSC 55

) [18]:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

b. Is the processing involved necessary for the purposes of those interests?

c. is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

[36]Question c. above was framed by reference to the Data Protection Act 1998, which is now replaced by the DPA and the GDPR. It should therefore now reflect the words used in the GDPR - whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

[37]In consideration of these questions, we think it important first to identify correctly the factual scope of the request.

[38]In his Grounds of Appeal the Appellant states that an employee who sits on a panel to award £1.2 million in public funding is not a junior employee and that they should have a reasonable expectation that their name will be disclosed as part of the minute taking and made available, if requested. However, as we understand it, the part of the process to which the disputed information relates is the Council’s assessment of the various applications, not the ultimate decision to award any grant.

[39]The Council has explained the structure and sequence of the full grant award process: the scoring matrix used in the assessment process; the presentation of a report to the Grant Aid Panel; the presentation of a report to the Regeneration and Community Committee, which included the report presented to the Grant Aid Panel and minutes of the Grant Aid Panel meeting; the report presented to the Grant Aid Appeals panel, including appeal letters; and a final report to the Regeneration and Community Committee including the Grant Aid Appeals Panel report and minutes of the Grant Aid Appeals Panel meeting.

[40]In relation to the first question, therefore, we find that the interest pursued by the request is confined to the assessment of the applications for a grant, and does not extend to the decision to make a grant, but we accept that that interest is legitimate: seeking to establish the fairness of the assessment process in the wider grant process, and transparency and accountability in the Council’s operations in that context.

[41]In relation to the second question: the word “necessary’ in this context must be interpreted consistently with its interpretation in EU jurisprudence, from which the concept derives in the GDPR and carries over into the UK GDPR. There it has a specific meaning: reasonable necessity rather than strict or absolute necessity. The processing to which the word “necessary” applies must be proportionate to the aim pursued by that processing and entail the minimum interference with the privacy rights of the data subject that will achieve the aim in question (R (Ali & another) v Minister for the Cabinet Office & another

[2012] EWHC 1943 (Admin)

[76]). It requires the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question (Goldsmith International Business School v Information Commissioner and the Home Office

[2014] UKUT 563 (AAC)

) [39] and South Lanarkshire [27]. For something to be necessary, there must be no other reasonable means of achieving it: Information Commissioner v Halpin

[2020] UKUT 29 (AAC)

[42]As the Appellant accepts, he has open to him alternative avenues to pursue his concerns: recourse to the Local Government Auditor in the Northern Ireland Audit office or to the Northern Ireland Public Services Ombudsman, or possibly both.

[43]However, the Appellant says that disclosure of the disputed information is “central to whether a complaint would be lodged with either body”. To the extent that the Appellant means that he needs the disputed information to achieve recourse to the complaint and investigation processes of either body, we reject that submission.

[44]In our view, it would be sufficient for him to lay before either body the information he already holds so that it might consider his complaint and make such enquiries of the Council as it considers appropriate. It cannot be the case that either body could only consider a complaint if presented with the disputed information, or, to put it the other way around, could not consider a complaint without the disputed information.

[45]We find that the existence of such recourse with no requirement for the disputed information, means that disclosure of the disputed information under FOIA is not reasonably necessary for the purposes of the legitimate interest of the request. Such disclosure would not be the least intrusive means of achieving the legitimate interest.

[46]Given that finding, there is no need for us to go on to consider what is effectively the balancing exercise required by the third question identified in South Lanarkshire, as now necessarily refined by the advent of the UK GDPR: whether such interest is overridden by the interests or fundamental rights and freedoms of the Council's employees which require protection of their personal data.

[47]By extension, because we find that disclosure of the disputed information would not be lawful, it is not necessary for us to go on to consider whether its disclosure would be fair or transparent. If disclosure is not lawful, it would contravene Article 6(1(f) UK GDPR. The disputed information is therefore exempt from disclosure pursuant to s40(2) FOIA.

Conclusion

[48]We find that the Commissioner was correct to conclude that the disputed information was exempt from disclosure pursuant to s40(2) FOIA. To that extent, the Decision Notice is in accordance with the law.

[49]The Appeal must be dismissed. Signed: Judge Foss Date: 28 July 2025