Advice North West v The Information Commissioner [2025] UKFTT 971 (GRC)

[2025] UKFTT 00971 (GRC)

Case Reference: FT.EA.2024.0322

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

Decided without a hearing

Decision given on: 13 Aug. 25

Before

JUDGE SANGER

MEMBER COSGRAVE

MEMBER TAYLOR

Between

Advice NORTH WESTAppellant

THE INFORMATION COMMISSIONERRespondent

Advice North West for Appellant

Information Commissioner for Respondent

Decision: The appeal is Dismissed.

REASONS

Date 2025-08-13

[1]This is an appeal under s57 Freedom of Information Act 2000 (“the Act”) by the Appellant against Decision number IC-286471-Z4Z1, issued on 8th August 2024.

[2]The Appellant brings an appeal against the Decision of the Respondent that the Department for Communities was entitled to refuse to confirm or deny that it held the information the Appellant requested.

[3]The matter was listed for oral consideration on 24th February 2025 but the Appellant was unable to attend, owing to reasons outside its control. The hearing was adjourned to a date to be fixed and the parties agreed, in the interim, that the matter could be heard on the papers.

[4]On 24th March 2025 the Appellant wrote to the Tribunal to confirm that it was content for the matter to proceed without a hearing. The Respondent had already confirmed, in a case management questionnaire returned on 25th September 2024, that it was content for the matter to proceed without a hearing.

[5]Rule 36 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 allows the matter to be determined in a party’s absence if the Tribunal is satisfied that the party had notice of the hearing and it is in the interests of justice to do so. Both parties had consented to the matter being considered in their absence and the matter was, therefore, considered on the papers.

The Evidence

[6]The Tribunal considered an open bundle and a closed bundle, each of which had been prepared by the Respondent. A gist of the closed bundle had been sent to the Appellant and the Tribunal on 10th February 2025.

The relevant legislation

[7]Freedom of Information Act 2000 s1: General right of access to information held by public authorities. (1) Any person making a request for information to a public authority is entitled— (a)to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b)if that is the case, to have that information communicated to him. (6) In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.

[8]Freedom of Information Act 2000 section 31(1)(a): Law enforcement. (1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— (a)the prevention or detection of crime, (3) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would, or would be likely to, prejudice any of the matters mentioned in subsection (1).

[9]Data Protection Act 2018 section 44: Information: controller's general duties(1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)— (c)the purposes for which the controller processes personal data;

(2) The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following— (a)information about the legal basis for the processing; (b)information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period; (c)where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations); (d)such further information as is necessary to enable the exercise of the data subject's rights under this Part. (4) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to— (b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

[10]Data Protection Act 2018 section 67: (1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner— (a)without undue delay, and (b)where feasible, not later than 72 hours after becoming aware of it.

The Request for information

[11]On 23rd November 2023 the following request was made by the Appellant of the Department for Communities (“the Public Authority”): 1. When a customer logs into their online Universal Credit account can their location be determined by an Officer from, or acting on behalf of, the Department for Communities? 2. If the location of the customer can be determined, how is that information communicated to the Department for Communities? For example, if a customer logs into their online Universal Credit account from a location outside of the United Kingdom is the ‘System/Software’ designed in such a way as to automatically send a notification to the Department for Communities?

[12]A response was issued on 2nd January 2024. The Public Authority refused to confirm or deny that it held the information and relied upon s30(3) of the Act (investigations).

[13]An internal review was requested by the Appellant on 3rd January 2024. The Appellant made the following arguments:a. to fail to notify an individual that their location could be determined from their log-in would represent a breach of s44 and s67 Data Protection Act 2018;

b. if it is the case that the Public Authority can identify the location of a customer from their UC login, customers are entitled to know that, by reason of protecting their privacy and right to freedom of movement in the course of their lawful business.

[14]The outcome of that review was communicated to the Appellant on 26th January 2024. The Public Authority upheld its decision. A reference to s43 of the Act was made in this correspondence but that was later confirmed to have been an error and no reliance was ever, in fact, placed on that section.

The complaint to the Respondent

[15]The Appellant submitted a complaint under s50 FOIA to the Respondent on 4th February 2024 and an investigation was commenced. The response of the Department was challenged, in part, on the grounds that it was not compliant with ss44 and 67 Data Protection Act 2018 (“DPA”) although it was not asserted how it was not compliant and no reasoned arguments were ever set out on that point. The Appellant wrote: I seek to challenge this response on the grounds that it does not comply with the Data Protection Act 2018, for example Sections 44 and 67. I take the view that The Department's investigative functions would not be compromised. Claimants have a right to know if their location is being monitored.

[16]The Appellant also asserted that it believed that the public interest was best served by the provision of the information requested. The writer noted that he took the view, implicit in the response of the Department, that it was capable of determining the location of “a customer” from a log-in to their Universal Credit account.

[17]On 28th May 2024, the Respondent wrote to the Public Authority requesting information to assist him in dealing with the Appellant’s complaint. In summary, it was not clear how s30 was relied up on as it had not been explained in either the initial response or the response to internal review.

[18]On 13th June 2024, in response to that enquiry, the Public Authority revised its position and determined that it would withdraw its reliance on s30(3) and instead rely on s31(1)(3) in conjunction with s31(1)(a) of the same Act (prejudice to the prevention or detection of crime).

[19]The Appellant’s case is set out in detail in an email to the Respondent dated 19th June 2024. In summary, the position is as follows:a. the Department for Communities Annual Report and Accounts for the year ending 31 March 2023 revealed Customer Fraud Overpayments amounting to £174.1 million (of which £86.1 million related to Universal Credit) while the total Official Error expenditure was £24.6 million and of that “Official Error” expenditure in relation to Universal Credit stood at £12.2 million;

b. the Appellant calculated that, in 2018 (before Universal Credit was in force), the Customer Fraud Overpayments figure would have been around £51.6 million and the “Official Error” figure was £16.9 million. The relevant conclusions that were to be drawn from this were not entirely clear;

c. “Official Error” expenditure as a whole has risen, in the same period, from £16.9 million to £24.6 million;

d. in 2024, members of a criminal gang operating in England and Wales between 2016 and 2021 were convicted of benefit fraud; according to information available online, this was the biggest benefit fraud in the UK concerning Universal Credit, yet the convictions did not arise from customers logging on to their accounts from outside the UK;

e. this means that the argument of the Department (that to confirm or deny holding the information would prejudice its ability to detect and prevent crime) is not well founded: it needs to get its own house in order by reducing “official error” expenditure.

[20]The Respondent issued his decision notice with regard to the revised reliance on s31 on 8th August 2024.

The Decision Notice

[21]In his Decision Notice, the Respondent agreed with the Public Authority that the public interest in maintaining the refusal to confirm or deny whether it held the information outweighed the public interest in confirming or denying that the information was held. His decision was based on the following analysis: In order to engage a prejudice based exemption or exclusion such as section 31, there must be the likelihood that disclosure would, or would be likely to, cause prejudice to the interest that the exemption or exclusion protects. In the Commissioner’s view, three criteria must be met:• first, the actual harm which the public authority alleges would, or would be likely to, occur if the withheld information was disclosed has to relate to the applicable interests within the relevant exemption;

• secondly, the public authority must be able to demonstrate that some causal relationship exists between the potential disclosure of the information being withheld and the prejudice which the exemption is designed to protect. Furthermore, the resultant prejudice which is alleged must be real, actual or of substance; and,

• thirdly, it is necessary to establish whether the level of likelihood of prejudice being relied upon by the public authority is met – ie disclosure ‘would be likely’ to result in prejudice or disclosure ‘would’ result in prejudice.

[22]The Respondent noted that the Department’s position was that confirming or denying that the requested information was held would prejudice its ability to detect and investigate cases in which people were claiming benefits in circumstances in which they were not entitled to; i.e. spending significant time outside the UK and failing to declare that in the appropriate way. The Northern Ireland Government website advises that Universal Credit may be claimed in the usual way for up to one month during temporary trips abroad, but for longer trips, or if the individual resides abroad, entitlement may be affected.

[23]The Respondent accepted the argument that confirming or denying that the requested information was held would provide fraudulent claimant with insight into the Department’s ability to identify where they were logging in from. This in turn would assist those individuals who wished to make fraudulent claims.

[24]He was therefore satisfied that Department had identified a prejudice, in confirming or denying that the requested information was held, which related directly to the interests that s31(1)(a) was designed to protect: the ability to prevent or detect crime.

[25]The Respondent was also satisfied that the Department was entitled to rely on the higher level of prejudice: disclosure would have the prejudicial effect identified (as opposed to disclosure being likely to have the prejudicial effect). He was satisfied that there was a real and significant risk of the prejudice occurring. He found that there was a clear link between the requirement to reside in the UK and the Department’s ability to establish the location of the login.

[26]The Respondent went on to consider the balance of the public interest test. His decision can be summarised as follows:a. there is a public interest inherent in s31(1)(a): the public interest in avoiding prejudice to the prevention and detection of crime and this will attract a significant weight in most cases;

b. confirming or denying that the requested information is held would have detrimental consequences upon the ability of the Department to prevent or detect crime;

c. there is a presumption that openness itself is an important factor under FOIA;

d. individuals do not have an absolute right to know if they are being monitored because the prevention and detection of crime involves proportionate interference with individuals’ rights;

e. the argument regarding s44 of the Data Protection Act 2018 does not provide a compelling argument in favour of it being in the public interest to confirm or deny whether the information is held. The Department’s privacy notice provides sufficient information to individuals regarding how their data is used and the section itself contains a restriction in respect of data being used for the purpose of prevention and detection of crime;

f. neither does the argument in respect of s67 Data Protection Act 2018 provide a compelling argument. s67 relates to the requirement to report data breaches to the Commissioner. The requirement to do so, were the Department to hold certain information, is separate to its obligations under FOIA, under which any report is considered to have been made to the world at large. That is a different consideration to the consideration as to whether data is held in breach of the DPA 2018.

[27]The Respondent found that there was a significant public interest in maintaining the refusal to confirm or deny that the information was held.

The appeal to the First Tier Tribunal

[28]On 21st August 2024 the Appellant submitted an appeal to the Tribunal. The grounds of appeal can be summarised as follows:a. Claimants have a right to know if they are being monitored;

b. The response is in breach of ss44 and 67 of the Data Protection Act 2018;

c. The public interest is best served by providing the information requested;

d. In refusing to confirm or deny that the information is held, it is implicit that it is, or the Public Authority would have said so.

[29]The Respondent responded to the appeal on 25th September 2024. The response was brief and can be summarised as follows:a. The Appellant appeared to accept that s31 was engaged but was concerned with the public interest balance;

b. The Respondent had already addressed the arguments comprehensively in the DN and had nothing further to add to its arguments previously made.

c. The jurisdiction of the Tribunal goes to whether the Public Authority is entitled to rely on the exemption claimed, not to determine whether or not the relevant information is held.

[30]In response, the Appellant provided an email dated 2nd October 2024 in which it stated:a. the Respondent failed to consider adequately the contents of an email sent at 12.22pm on 19th June 2024;

b. the Public Authority’s annual accounts for the year ending 31st March 2024 reported a 17% increase in Universal Credit official error between 2022/23 and 2023/24. This does not support the argument of the Public Authority which concludes that refusing to confirm or deny that the information is held protects the public purse.

[31]On 9th December 2024 the Appellant provided the Tribunal with a further document, which was a response, dated 4th October 2024, from the Department for Work and Pensions (in London), to a similar request made by the Appellant on 10th September 2024 which stated, in summary: You wrote:

“I herein request the following information under the Freedom of Information Act 2000. In general terms, the various Social Security Welfare Benefit Regulations detail the requirement to be habitually resident/right to reside as a condition of entitlement to that Benefit, for example Income Support, Income Related ESA, PIP, or Universal Credit. There are of course exceptions for temporary absence. To ask, within the context of fraud, how many claimants have had their claims closed and/or been prosecuted, since February 2018, because of being found to be spending significant time outside the United Kingdom in breach of the various Regulations. I understand the data where the offence/primary offence is listed as 'Abroad' would encompass all types of fraud prosecuted under the 'Abroad' classification.”

We confirm that we hold some of the information you have requested. There were 97 overall cases referred for prosecution since February 2018. However, we are unable to provide the claim closure information as we do not hold this data. We stress that all those claiming benefits have a responsibility to ensure that they are entitled to any payments they receive and that they report relevant changes of circumstances to the Department, including periods of time out of the country, where required, and where changes may affect their claim.

Discussion and conclusions

[32]The starting point, under s1 FOIA, is that when a request for information is made under the Act, a Public Authority must, in the first instance, confirm or deny that it holds the information (“the duty to confirm or deny”). The information must then be provided, if held, unless an exemption applies under the Act.

[33]One of those duties is found in s31, which states that information is deemed exempt if its disclosure would, or would be likely to, prejudice the prevention or detection of crime (s31(1)(a)). Further, the duty to confirm or deny does not arise, to the extent that compliance with it would, or would be likely to prejudice the prevention and detection of crime (s31(3)).

[34]s31(3) is a qualified exemption. This means that, if it finds that the exemption applies, the Tribunal is required to move on to balance the public interest in maintaining it against refusing to do so.

[35]The Respondent characterised the appeal as relating solely to the application of the public interest test. It was held by the Respondent, in his decision notice, that s31(3) applied and that this was not appealed.

[36]The panel had some reservations about that approach. The appeal form does indeed engage with the public interest test but the Appellant also states, “I take the view that the Department’s investigative functions would not be compromised”. The panel therefore began by considering whether s31(1)(a) was engaged.

[37]Before entering into a discussion of the merits of the appeal, it should be noted that the Appellant included in the documents he had sent to the Respondent a copy of a decision, on appeal, of the Social Security Commissioner of Northern Ireland dated 22 September 2020. The only explanation from the Appellant as to the relevance of this decision was to direct the Respondent (during his investigation) to a paragraph in which it is acknowledged that certain Government computer systems could have been assumed to have recorded information made available through a different system. The decision is not binding on this Tribunal and that case did not turn on any provision of FOIA. Thus it was determined by the panel in the present case that it had no relevance in the current proceedings. Is section 31(1)(a) engaged?

[38]The Respondent’s response to the appeal did not set out why s31(1)(a) was engaged. It referred instead to the Department’s previous correspondence with the Appellant and the Respondent.

[39]It was unambiguous and was therefore held by the Tribunal that the Department had the power to investigate specific offences of fraud under s103A of the Social Security Administration (Northern Ireland) Act 1992.

[40]If the information was held, the Department had stated in their revised response to the Appellant of 13th June 2024, it would be exempt under s31(1)(a) because its disclosure would be likely to prejudice the prevention or detection of crime. It noted that:a. confirming that the information is held would enable fraudulent claimants to use technical or other actions to prevent detection;

b. denying that it is held would assure fraudulent claimants that they could claim benefit while living outside the UK for significant periods and may encourage others to do likewise; and that either option would harm the department’s ability to deliver its investigative functions, which are aimed at protecting the public purse from fraudulent claims, effectively.

[41]This was accepted by the Respondent in its Decision Notice and the finding of the Respondent was that there would be a prejudice, which would be more likely than not, based on the “clear link between the requirement to reside within the UK and the Department’s ability (or otherwise) to establish the location of the login”.

[42]Although the appeal notice stated that it was the Appellant’s view that the Department’s investigative powers would not be compromised, there were no submissions in support of this point and there was no evidence to undermine or raise questions regarding the Respondent’s submission.

[43]The Tribunal therefore accepted the submissions of the Respondent and determined that s31(1)(a) is engaged, although we did not agree with the analysis of the Respondent (in the decision notice) that a disclosure would prejudice the prevention or detection of crime. In its revised response of 13th June 2024 the Department’s case was that disclosure would be likely to prejudice the prevention or detection of crime and that is the finding of this Tribunal. Does the public interest in disclosing the information outweigh the public interest in maintaining the exemption?

[44]Again, the Respondent made no arguments in support of the public interest test, but simply referred to the Decision Notice. In that, however, he had not considered the public interest test as it applied to the disclosure of information but had only considered it as it applied to the decision to rely section 31(3) i.e. the balance of the public interest in maintaining the refusal to confirm or deny that the requested information is held against the public interest in confirming or denying that the requested information is held.

[45]Without any arguments before us, the Tribunal could not form a view as to whether the public interest in disclosure outweighed the public interest in withholding the information, if indeed it were held. Does the public interest in maintaining a refusal to confirm or deny that the information is held outweigh the public interest in confirming/denying that it is held?

[46]The Respondent held, in the Decision Notice, that it is a matter of great public interest to protect the ability to prevent and detect crime and that the appropriate weight to be afforded to the public interest is therefore significant.

[47]While the Respondent had accepted that either confirming or denying that the information was held would have detrimental consequences, he was mindful of the general principle in FOIA that openness is in the public interest.

[48]Ultimately, the Respondent argued, the public interest in maintaining the refusal to confirm or deny outweighed the public interest in confirming or denying that the requested information was held.

[49]The arguments raised by the Appellant with regard to the application of the public interest test were not always clear and did not appear to be directed towards the relevant provisions of FOIA. We have extrapolated them as best we can from the submissions and carefully considered what we determined to be the Appellant’s case.

[50]The Appellant appeared to make an argument that the public purse was best protected by the disclosure of the requested information or the Department confirming or denying that it held the information.

[51]The panel failed to see how the public purse was best protected by either confirming or denying that the information was held. While there is undoubtedly a public interest inherent in reducing spend on fraudulently claimed benefits, the view of the Tribunal was that it would take a leap of logic to make a direct link between confirming or denying that the information is held and a future reduction in fraudulent claims.

[52]We preferred the argument of the Department, contained within its response to the Respondent and relied upon in the Decision Notice, that to allow it to maintain its “neither confirm nor deny” position and thereby effectively discharge its investigatory obligations would protect the public purse from would-be fraudulent benefit claimants.

[53]In correspondence, the Appellant stated that it considered that people had a right to know if they were being monitored. The panel has assumed that that is where the arguments in respect of the Data Protection Act 2018 have arisen. In the appeal notice, the Appellant said nothing further than “I seek to challenge this response on the grounds that it does not comply with the Data Protection Act 2018, for example sections 44 and 67”.

[54]s44 sets out the general duties imposed upon a data controller. The panel was careful not to stray too deeply into matters of data protection but in short:a. a data controller must inform data subjects of certain information to do with how it holds and processes data;

b. a data controller must release certain data to the data subject upon request;

c. this is qualified by a provision allowing the data controller to withhold data in specified circumstances, which includes to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties (s44(4)(b)).

[55]With no clear argument on the point, the panel could not establish how the section was said to support the contention that the response of the Commissioner was not compliant with the Data Protection Act 2018. The Tribunal takes the view that s44 deals with individual requests made by data subjects, not general requests for information made under FOIA.

[56]Data protection and freedom of information are two very different regimes and each is governed by its own principles and legislation. If, indeed, the Appellant wished to argue that s44 DPA meant that individuals have a right to know if they are being monitored, the Tribunal would note that that is a matter that does not fall to be determined in this case. Of more relevance is the fact that the Tribunal did not feel that any rights of data subjects under s44 outweighed the public interest in maintaining the refusal to confirm or deny whether the information was held.

[57]s67 obliges a data controller to make the Commissioner aware of any personal data breach for which it is responsible. The section sets out when, how and in what circumstances such a report must be made.

[58]Again, the panel could not identify the relevance of that s67 obligation to the decision that fell to be made. The panel did not consider that anything in this section supported an argument that the public interest was best served by the Department confirming or denying that the information was held.

[59]We considered that the principal argument in favour of confirming or denying that the information was held would be the general public interest in transparency. It is important that our state powers of investigation, detection and prevention of crime are transparent and that enforcement authorities, as agents of the state, are accountable. The panel was of the view, however, that that test is met by way of clear legislation and regulation of the authorities and that the scrutiny and accountability of those processes is the preserve of the criminal justice system and operates on a case by case basis.

[60]Transparency in the circumstances of the prevention and detection of criminal activity does not mean the nuts and bolts of each investigation. To reveal any information about how fraudulent benefit claimants are identified, be it by means of checking their log-ins or otherwise, would be to reveal some information that would be bound to be of use to those intending to defraud the state. The release of even those small fragments of the whole picture is capable of leading to potential fraudsters piecing together a picture, “a patchwork effect”, as to how benefit fraud is investigated.

[61]In relation to the public purse argument, the Tribunal finds that the public purse is best protected when the Department is able to detect and prevent criminal activity effectively. It was the finding of this panel that relying on this exemption puts the Department in a stronger position in that regard.

[62]The Tribunal did not need to determine whether or not the requested information was, in fact, held. Additionally, it did not need to determine whether confirming or denying would have a different effect. In circumstances where either to confirm or to deny would reveal something of the answer to the request, and prejudice would (or would be likely to) arise, a Public Authority may issue a “neither confirm nor deny” response.

[63]The panel took that view that the exemption allowing a Public Authority to neither confirm nor deny that information is held is a protective concept, which allows for a consistent approach by public authorities where matters of public policy and protection are under consideration.

[64]Reliance on s31(3) allows for a consistent approach. It is conceivable that an individual may make repeated or multiple requests of the same Public Authority. If the question is slightly varied on each occasion, such that a series of responses are received stating that the information is not held followed by one which is “neither confirm nor deny”, that response immediately sheds light on what the substantive response might be.

[65]This is alluded to by the Appellant in the appeal form, in which it is stated “I take the view, implicit in their response, is my belief that the Department can determine the location of a customer from a log-in of their Universal Credit account” [sic]. The Tribunal make two observations on this point. The first is that this tends to support the analysis at paragraph 62 and is an important factor in the Department’s argument that even to confirm or deny that the information is held might inadvertently reveal something of the nature of the information itself. The second is that the Appellant may well believe that but the fact is that his belief is not the same as an organisation providing information to substantiate that belief, nor does it follow that, just because an individual holds a belief, the Public Authority is in any way obliged to confirm or refute that belief.

[66]For these reasons the Tribunal came to the view that the public interest in maintaining the refusal outweighed the public interest in confirming whether or not the Department holds the requested information.

[67]The appeal is dismissed accordingly. Signed Date: Judge Sanger 11th August 2025