Rabbi Gabriel Kanter-Webber v The Information Commissioner [2026] UKFTT 1048 (GRC)

[2026] UKFTT 01048 (GRC)Case Reference: EA/2022/0222
First-tier Tribunal
General Regulatory Chamber
Date 17 July 2026
Information Rights
Decided without a hearing
Before
JUDGE STEPHEN ROPERMEMBER SUZANNE COSGRAVEMEMBER JO MURPHY
Between
RABBI GABRIEL KANTER-WEBBERAppellantTHE INFORMATION COMMIsSIONERRespondentDecision: The appeal is DismissedREASONS

Preliminary matters

[1]In this decision (including the Closed Annex), we use the following terms to denote the meanings shown: Appellant: Rabbi Gabriel Kanter-Webber. Audio Recording: The audio recording of the Hearing (comprising part of the Withheld Information). Authority: Chief Constable of Wiltshire Police. Balancing Test: The last limb of the Legitimate Interests Test, as referred to in paragraph 50. Closed Annex: The closed annex to this decision (see paragraph 3). Commissioner: The Information Commissioner (the Respondent). Complainant: The person who complained about the conduct of the Officer and whose allegations were the subject of the Hearing. Complainant’s Special Data: As defined in paragraph x16.b. Decision Notice: The Decision Notice of the Commissioner dated 9 August 2022, reference IC-127412-P1R1, relating to the Request. DPA: The Data Protection Act 2018. Duty to Inform: The duty of a public authority to confirm whether or not it holds information which is requested, pursuant to section 1(1)(a) (set out in paragraph 31). Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 31). Earlier Decision: As defined in paragraph 21. Earlier Disciplinary Hearing: As defined in paragraph 84. FOIA: The Freedom of Information Act 2000. Google case: The decision of the High Court in NT1 and NT2 v Google LLC & The Information Commissioner [2018] EWHC 799 (QB). Hearing: The hearing on 2 July 2021 regarding misconduct of a named police officer, as referred to in paragraph 7. Khuja case: The decision of the Supreme Court in Khuja v Times Newspapers Limited and others [2017] UKSC 49. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f), as set out in paragraph 47. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 49. Officer: The police officer who was the subject of the Hearing. Other Personal Data: The personal data of individuals contained in the Withheld Information, excluding Special Category Data. Panel: The Police Misconduct Panel which conducted the Hearing. Panel’s Decision The Panel’s written findings in respect of the Hearing (comprising part of the Withheld Information). Public Interest Test: As applicable, either: the test, pursuant to section 2(1)(b) (set out in paragraph 34), as to whether, in all the circumstances of the case, the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the public authority holds the information; or the test, pursuant to section 2(2)(b) (set out in paragraph 37), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information. Relevant Legitimate Interest: As defined in paragraph 93. Relevant Special Data: The Special Category Data of individuals (including the Complainant) which is contained in the Withheld Information. Request: The request for information made to the Authority by the Appellant dated 9 July 2021, as set out in paragraph 8. Requested Information: The information which was requested by way of the Request. Special Category Data: As defined in paragraph 59. Transcript: The transcript of the Hearing. Tribunal Rules: The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018. Withheld Information: The audio recording of the Hearing and the Panel's written findings in respect of the Hearing.[2]Unless the context otherwise requires, or as otherwise expressly stated, references in this decision (and in the Closed Annex):a. to numbered paragraphs are references to paragraphs of this decision so numbered;b. to any section are references to the applicable section of FOIA;c. to any Article are references to the applicable Article of the UK GDPR;d. to the Commissioner’s “response” mean his response to the appeal;e. to the Commissioner’s “investigation” mean his investigation, for the purposes of section 50, of the Appellant’s complaint relating to the Authority’s response to the Request.[3]There is a closed annex to this decision. The closed annex refers to some specific aspects of the Withheld Information, in support of some of our reasons below. A copy of the closed annex has been sent to the Commissioner. It has been withheld from the Appellant because revealing those specific aspects of the Withheld Information would be inappropriate, given our dismissal of the appeal.[4]We refer to the Information Commissioner as ‘he’ and ‘his’ to reflect the fact that the Information Commissioner was John Edwards at the time of the Decision Notice, whilst acknowledging that the Information Commissioner was Elizabeth Denham CBE at the time of the Request and the Appellant’s subsequent complaint to the Commissioner.[5]Nothing we say in this decision should be taken as an indication as to whether or not the Transcript is held by the Authority.

Introduction

[6]This was an appeal against the Decision Notice, which (in summary) decided that the Authority was entitled to rely on section 40(2) (personal information) to refuse to disclose the Withheld Information.

Background to the appeal

[7]The background to the appeal is as follows. It may be helpful to explain that the Request related to the outcome of a hearing on 2 July 2021 regarding allegations of inappropriate sexual behaviour by a serving police officer towards a junior female colleague. The hearing was conducted in public, although the Panel directed that the Complainant would be given anonymity (and was accordingly referred to in the Panel’s Decision by way of a cipher). The hearing resulted in findings of gross misconduct on the part of the police officer in question, who was then dismissed without notice.

The Request

[8]On 9 July 2021, the Appellant contacted the Authority via the ‘whatdotheyknow’ website and requested information in the following terms: “Please provide me with an electronic copy of(i) the transcript,(ii) the panel’s full written findings, and(iii) the panel’s decision on sanction, in relation to the disciplinary hearing of [name redacted]. If there is no transcript, the audio recording will be acceptable as an alternative.”.[9]The Authority responded on 6 August 2021. They refused to provide the Requested Information, relying on the exemptions under section 21(1) (information accessible to the applicant by other means), section 31(1)(g) (law enforcement, read with section 31(2)(b)), section 38(1) (health and safety) and section 40(2) (personal information).[10]The Appellant contacted the Authority on the same date (via the ‘whatdotheyknow’ website), requesting an internal review.[11]The Authority responded on 3 September 2021 with the outcome of its internal review. They withdrew their reliance on section 38(1) FOIA, but upheld their position regarding the other exemptions they had previously cited.[12]The Appellant contacted the Commissioner on the same date to complain about the Authority’s response to the Request.[13]During the course of the Commissioner’s investigation, the Authority revised their position regarding their response to the Request. In summary, the Authority’s revised position:a. disclosed the sanction determined by the Panel as a result of the Hearing; andb. in respect of the Withheld Information:(i) removed their reliance on section 21;(ii) confirmed their reliance on section 31(1)(g) section 38(1)(a) and section 40(2);(iii) relied additionally on section 32(1)(c) (court records etc).[14]Pursuant to their revised position, the Authority also advised that (relying on section 40(5B)) they would neither confirm nor deny whether they hold the Transcript.[15]The Commissioner subsequently issued the Decision Notice.

The Decision Notice

[16]In the Decision Notice, the Commissioner determined (in summary) that:a. the Withheld Information relates to, and identifies, various individuals (including the members of the Panel, advocates, witnesses and the police officers concerned) and therefore constitutes personal data;b. the Withheld Information also included Special Category Data because the Hearing related to the Officer’s inappropriate sexual behaviour against a colleague (the Complainant) and therefore related to a natural person’s sex life; accordingly, any information which could be used to identify the Complainant comprises Special Category Data (the “Complainant’s Special Data”);c. none of the conditions required for lawful processing of the Complainant’s Special Data was satisfied, so there was no legal basis for its disclosure;d. disclosure of the Complainant’s Special Data would therefore breach the first data protection principle (see paragraph 45.c) and consequently it was exempt under section 40(2);e. regarding the Other Personal Data, disclosure was not necessary for the purposes of the Legitimate Interests Test and therefore there was no lawful basis for processing of it; andf. disclosure of the Other Personal Data would therefore breach the first data protection principle and consequently it was exempt under section 40(2).[17]The Commissioner accordingly concluded that the Authority was entitled to rely on section 40(2) to refuse to disclose all of the Withheld Information.[18]Given that finding, the Commissioner decided that it was not necessary to consider the other exemptions which had been cited by the Authority.[19]The Decision Notice did not require the Authority to take any further steps. The appeal The grounds of appeal

The appeal

[20]The essence of the Appellant’s appeal was that the Commissioner was wrong to conclude, in the Decision Notice, that section 40(2) applied to the Withheld Information.[21]The Appellant submitted that the Decision Notice was based entirely on the proposition that section 40(2) exempts from disclosure the transcripts and/or audio recordings of police misconduct hearings held in public. His grounds of appeal argued that identical subject matter was considered in another appeal of his, Kanter-Webber v Information Commissioner and the Chief Constable of Cambridgeshire Constabulary under case reference EA/2021/0376 Neutral citation number [2023] UKFTT 441 (GRC) (the “Earlier Decision”). The Appellant stated that, in that case, the Tribunal had “expressly, and extensively, rejected this proposition…which related to precisely the same facts and precisely the same question of law”.[22]The Appellant accordingly contended that the Commissioner’s conclusion in the Decision Notice that the Authority could rely on section 40(2) appeared to be unsustainable.[23]We comment below on the Appellant’s grounds of appeal, as well as other relevant submissions of his in respect of the appeal.

The Tribunal’s powers and role

[24]The powers of the Tribunal in determining this appeal are set out in section 58, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[25]In summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).

Mode of hearing

[26]The parties consented to the appeal being determined by the Tribunal without an oral hearing. The Tribunal had the benefit of the bundles referred to in paragraph 28. Having reviewed the same, we did not consider that further information was required from either party in order to make an informed decision.[27]The Tribunal was therefore satisfied that the appeal was suitable for determination on the papers in accordance with rule 32 of the Tribunal Rules and that it was fair and just to conduct the appeal in this way.

The evidence and pleadings

[28]The Tribunal read and took account of an open bundle of evidence and pleadings, as well as a closed bundle. The closed bundle contained the Panel’s Decision.[29]Pursuant to Case Management Directions issued by the Tribunal, the Commissioner also sent to the Appellant (and the Tribunal) a gist of the Withheld Material. The gist specified the nature of the Withheld Information (as defined in this decision) and stated as follows: “The CLOSED Bundle contains the disciplinary panel’s full written findings. Due to the size and nature of the files, it was not possible to include the audio files of the recording of the hearing within the CLOSED bundle. The Respondent does not consider that there is a need for the Tribunal to listen to the audio recording in order to decide the appeal. However, the Respondent has suggested to the Tribunal that, should the Tribunal wish to listen to the audio recording, the Tribunal should contact Wiltshire Police for a copy. The outcome of the disciplinary panel has been disclosed to the Appellant and is included at pages C81 – C85 of the main OPEN bundle (‘O/B’). At a high level, it is stated at paragraph 22 of the DN (A8 O/B ) that “Wiltshire Police has confirmed that the information “would incorporate the personal data of very many different data subjects: the Panel, advocates, witnesses, and the officers concerned, at a minimum” and that, at paragraph 32 of the DN (A9 O/B ) “…the misconduct case relates to an officer’s inappropriate sexual behaviour against a colleague…”.[30]All of the contents of the bundles were read and considered, and all of the submissions from the parties were taken into account, even if not directly referred to in this decision. The relevant statutory framework General principles

The relevant statutory framework

[31]Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[32]In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[33]Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.[34]Section 2(1) addresses potential exemptions from to the Duty to Inform. That section provides: “Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—(a) the provision confers absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.”.[35]Accordingly, where there is an applicable exemption in Part II of FOIA then it negates the Duty to Inform. This means that the public authority is permitted to neither confirm nor deny that it holds the requested information.[36]Pursuant to the provisions of section 2(1), some of the exemptions to the Duty to Inform set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exemptions are absolute). For the purposes of the appeal, the relevant exemption is section 40(5B), which is not included in that list.[37]Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[38]The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). For the purposes of the appeal, section 32 is included in that list and section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied. Section 31 and section 38 are not included in that list.[39]Accordingly, summarising the above:a. the exemption to the Duty to Inform in section 40(5B) is subject to the Public Interest Test;b. the exemption to the Duty to Disclose in section 32 is an absolute exemption;c. the exemption to the Duty to Disclose in section 40(2) is an absolute exemption only in cases where that first condition is satisfied, otherwise the exemption is subject to the Public Interest Test; andd. the exemptions to the Duty to Disclose in section 31 and section 38 are subject to the Public Interest Test.

Section 31 – law enforcement

[40]So far as is relevant for the purposes of the appeal, section 31 provides:
“(1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— … (g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2), … (2) The purposes referred to in subsection (1)(g) to (i) are— … (b) the purpose of ascertaining whether any person is responsible for any conduct which is improper”
.

Section 32 – court records, etc

[41]So far as is relevant for current purposes, section 32 provides as follows: “(1) Information held by a public authority is exempt information if it is held only by virtue of being contained in— … (c) any document created by—(i) a court, or(ii) a member of the administrative staff of a court, for the purposes of proceedings in a particular cause or matter.”.[42]Pursuant to section 32(4), references in section 32 to a “court” include any tribunal or body exercising the judicial power of the State.

Section 38 - health and safety

[43]So far as is relevant for the purposes of the appeal, section 38(1) provides:
“Information is exempt information if its disclosure under this Act would, or would be likely to— (a) endanger the physical or mental health of any individual…”
.

Section 40 – personal information

[44]So far as is relevant for the purposes of the appeal, section 40 provides: “…(2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles… … (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles…”.[45]Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. Section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA.b. The “data protection principles” are those set out in Article 5(1) and section 34(1) of the DPA.c. The first data protection principle, in Article 5(1)(a), is that personal data shall be:
“processed lawfully, fairly and in a transparent manner in relation to the data subject”. d. A “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”
.

Lawful basis – legitimate interests

[46]To be lawful, processing of personal data must meet one of the bases for lawful processing, which are set out in Article 6(1).[47]One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f)).[48]Article 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.

The Legitimate Interests Test

[49]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Agency v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[50]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[51]It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.[52]The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb (the Balancing Test) can be considered.[53]For the purposes of the second limb of the Legitimate Interests Test, case law has established that the term “necessary” means something which is more than desirable but less than an indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive”, or the “least intrusive”, means of achieving the legitimate interest in question).

Lawful basis – consent

[54]The only other lawful basis for processing of personal data which is relevant for current purposes is consent. Consent is defined in Article 4(11) as: “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”.[55]In summary, for consent to be a valid lawful basis for the processing of personal data, the relevant data subject must have freely and clearly given consent for the use of their personal data for a specific purpose.

Article 9 – special categories of personal data

[56]Article 9 addresses some particular categories of personal data (set out in Article 9(1) and known as ‘special categories of personal data’) which are prohibited from being processed unless certain conditions (set out in Article 9(2); see below) are met. Pursuant to Article 9(1), the special categories of personal data are defined as: “…personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation…”.[57]So far as is relevant for current purposes, therefore, the special categories of personal data include “data concerning a natural person’s sex life” as well as “data concerning health”. Article 4 (15) defines “data concerning health” as: “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.”.[58]Recital 35 of the UK GDPR also specifies that personal data concerning health: “should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject.”.[59]For convenience, we refer below to the special categories of personal defined in Article 9(1) as “Special Category Data”.

Conditions for the processing of special categories of personal data

[60]As noted above, Special Category Data is prohibited from being processed unless certain conditions are met, as set out in Article 9(2). In other words, to be lawful, the processing of Special Category Data must satisfy one of the conditions set out in in Article 9(2) - in addition to having another lawful basis for processing under Article 6(1). For the purposes of the appeal, the following of those conditions are relevant.[61]Article 9(2)(a) provides (so far as is relevant): “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes…”.[62]Article 9(2)(e) provides: “processing relates to personal data which are manifestly made public by the data subject”.[63]In summary, therefore, for the processing of Special Category Data to be lawful:a. the applicable data subject must either have given explicit consent to the processing of it, or must have manifestly made it public; andb. there must be another lawful basis applicable to such processing. Discussion and findings Introduction

Discussion and findings

[64]As we noted in paragraph 24 (and summarised in paragraph 25), the scope of the Tribunal’s jurisdiction relates to the lawfulness of the Decision Notice. The primary issue which we needed to determine was therefore whether the Decision Notice was correct to conclude that the Authority was entitled to rely on section 40(2) to refuse to disclose the Withheld Information.[65]We therefore address below the relevant issues concerning the Commissioner’s conclusions regarding the engagement of section 40(2) in respect of the Withheld Information. We would only need to consider the Authority’s reliance on other exemptions if we concluded that all the Withheld Information could not be withheld pursuant to that section.[66]We should also comment that case law has established that a public authority is entitled to rely on new exemptions at any point before an appeal is considered by the First-tier Tribunal. This includes reliance on new exemptions by the public authority in its response to a request for information under FOIA, any subsequent review of that response or in its subsequent dealings with the Commissioner when he is investigating a complaint under section 50 relating to that request.[67]The Decision Notice recorded that the Commissioner had not found it necessary to listen to the Audio Recording, which he understood to cover seven days. We were not provided with a copy of the Audio Recording in connection with the appeal (as referred to in the gist set out in paragraph 29) but, for the reasons given in paragraph 75, we considered that it was not necessary for us to listen to it.

The Withheld Information - personal data and Special Category Data

[68]As we have noted, the Commissioner determined in the Decision Notice that the Withheld Information relates to, and identifies, various individuals (including the members of the Panel, advocates, witnesses and the police officers concerned) and therefore constitutes personal data. The Decision Notice also recorded the Commissioner’s conclusion that some of the Withheld Information also related to a natural person’s sex life and accordingly comprised Special Category Data.[69]The Appellant did not dispute that the Withheld Information constitutes personal data, nor that the Withheld Information includes Special Category Data (although see paragraph 103). Rather, the Appellant’s grounds of appeal were based largely on the premise that the Decision Notice wrongly concluded that section 40(2) exempts from disclosure transcripts or audio recordings of police misconduct hearings held in public.[70]Nevertheless, for completeness, we set out our findings regarding whether the Withheld Information comprises personal data and whether it includes Special Category Data.[71]As we have noted, section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The test for what constitutes ‘personal data’ is whether or not a living individual is or could be identified, directly or indirectly, from such information.[72]From our assessment of the Panel’s Decision, we find that it contained personal data relating to various individuals, including:a. the Officer;b. the Complainant;c. witnesses;d. members of the Panel;e. legal representatives; andf. other individuals, including some who were not participants in the Hearing. See point 1 of the Closed Annex.[73]The Panel’s Decision contains information about the Complainant’s allegations, evidence and witnesses, and the relevant individuals involved in the Hearing were clearly identified or identifiable. Several individuals were named in the Panel’s Decision. We also find that the Complainant would be identifiable, because others involved in the Hearing (particularly the witnesses) would evidently know their identity. See point 2 of the Closed Annex.[74]For clarity, we should perhaps additionally comment that, although the Panel directed that the Complainant would be given anonymity, this does not preclude their personal data being included in the Withheld Information. As we have noted, the test for what constitutes ‘personal data’ is whether or not a living individual is or could be identified, directly or indirectly and, for the reasons given in the preceding paragraph, the Complainant would still be identifiable in the Withheld Information (even though a cipher was used to refer to them in the Panel’s Decision). See point 3 of the Closed Annex.[75]Given that the Panel’s Decision is based on what was discussed at the Hearing (including referring to the evidence which was given at the Hearing), it follows that the Audio Recording would also contain personal data relating to the same individuals. For that reason, and because the Commissioner had stated that he understood the Audio Recording to cover seven days, we concluded that it would be unnecessary and disproportionate (having regard to the overriding objective in rule 2 of the Tribunal Rules) for the Tribunal to spend the time listening to the Audio Recording. We recognise the possibility that the Audio Recording may include personal data of individuals other than those referred to in the Panel’s Decision, but this would not alter our findings (on the contrary, that would simply increase the extent of the personal data involved). Accordingly, where applicable, references to our findings in respect of the Panel’s Decision should be construed to include references to the Audio Recording.[76]For the above reasons, we find that the Commissioner was correct to conclude in the Decision Notice that the Withheld Information constitutes personal data (and see our comments in paragraph 125).[77]As we have noted, Special Category Data includes data concerning a natural person’s sex life. We find that the Panel’s Decision includes Special Category Data, on the basis that it refers to the sex life of the Complainant, because the Hearing concerned allegations of inappropriate sexual behaviour against the Complainant. Also, the Panel’s Decision refers to evidence and findings regarding such allegations (and specifically concerning the Complainant’s experiences).[78]We also find that the Panel’s Decision includes Special Category Data relating to individuals other than the Complainant. See point 4 of the Closed Annex.[79]Again, as we referred to in paragraph 75, given that the Panel’s Decision is based on what was discussed at the Hearing (including referring to the evidence which was given at the Hearing), it follows that the Audio Recording would also contain Special Category Data relating to the same individuals.[80]Accordingly, we find that the Commissioner was correct to conclude in the Decision Notice that the Withheld Information constitutes Special Category Data.

The Other Personal Data – the Legitimate Interests Test

[81]As we have noted, the Appellant’s grounds of appeal were based largely on the premise that the Decision Notice wrongly concluded that section 40(2) exempts from disclosure transcripts or audio recordings of police misconduct hearings held in public.[82]The Appellant further submitted that (in summary):a. the Hearing was conducted in public;b. journalists and members of the public were entitled to attend the Hearing;c. the Withheld Information was therefore already disclosed openly;d. participants in the Hearing consequently had no reasonable expectation that the evidence given and findings made would remain private; ande. principles of transparency and open justice require disclosure of the Withheld Information.[83]The Appellant’s position was, in essence, that information disclosed in public proceedings could not properly attract the level of privacy protection identified by the Commissioner in the Decision Notice. Essentially, the Appellant argued that the Legitimate Interests Basis was satisfied and accordingly that the processing of the personal data, by way of disclosure of the Withheld Information, would be lawful. This was on the basis that, for the purposes of the Balancing Test, the data subjects would have no reasonable expectation of privacy, given that the Hearing was held in public. In support of his position, the Appellant referred to the Google case.[84]In support of his position, the Appellant also (as we have noted) relied on the Earlier Decision, which concerned a substantially similar request for recordings or transcripts of a different police misconduct hearing (the “Earlier Disciplinary Hearing”).[85]In the Earlier Decision, the First-tier Tribunal found that (in essence) there could be no expectation of privacy by those involved in the Earlier Disciplinary Hearing, on the basis that the Earlier Disciplinary Hearing was conducted in ‘open court’. The First-tier Tribunal therefore concluded, when applying the Balancing Test, that the data protection rights of those involved in the Earlier Disciplinary Hearing did not outweigh the Appellant’s legitimate interests in disclosure of the relevant information.[86]It is important to note that the Tribunal must look independently at each case before it, based on the specific facts and issues in that case, regardless of the view reached by the First-tier Tribunal in other cases (including, for current purposes, the Earlier Decision). Whilst our deliberations included consideration of the Earlier Decision, as well as other decisions of the First-tier Tribunal which the parties referred to, we have also been mindful that other First-tier Tribunal decisions are not binding on us and, more importantly, that each such decision turns on its own facts and the particular issues which are relevant in that case.[87]We also consider that the Earlier Disciplinary Hearing is distinguishable from the Hearing, for three main reasons. First, the allegation of misconduct which was the subject of the Earlier Disciplinary Hearing essentially involved shoplifting and accordingly there was no individual ‘victim’ as such. Secondly, the allegation of misconduct which was the subject of the Hearing involved inappropriate sexual behaviour and accordingly there were particular sensitivities to take into account. Thirdly, the Panel Decision includes reference to third parties who were not participants in the Hearing (as referred to in paragraph 72). This is in contrast to the audio recording of the Earlier Disciplinary Hearing, which contained the personal data only of the police officer concerned and other people present at it This was the finding of the First-tier Tribunal in paragraph 44(a) of the Earlier Decision. .[88]The Appellant raised arguments regarding the principle of ‘issue estoppel’. In summary, he argued that the Commissioner chose not to pursue an appeal regarding the Earlier Decision and was consequently estopped from going behind the decision reached by the Firs-tier Tribunal in the Earlier Decision. The Appellant argued, in essence, that the parties in the Earlier Decision were the same (the Appellant and the Commissioner) and the issues were the same as the current appeal. He cited case law O’Hanlon v Information Commissioner [2019] UKUT 34 (AAC), at paragraph 17. to the effect that decisions of the First-tier Tribunal are binding as between the parties on the issues.[89]We disagree that we would be bound by the Earlier Decision on the basis of the case law referred to. The relevant legal principle in that case law was that that a decision of the First-tier Tribunal is, subject to any appeal, binding in that case as between the parties. It does not mean that the Tribunal is then also bound to follow that decision in any subsequent proceedings relating to a different appeal, even if the parties are the same and the subject matter is broadly the same. Moreover, for the reasons we have given in paragraph 87, we disagree with the Appellant that the subject matter in the Earlier Decision is the same as that in this appeal; there are various differentiating factors in the Earlier Disciplinary Hearing which are relevant to our conclusions in this decision regarding the Hearing.[90]An additional point is that the First-tier Tribunal made a finding in the Earlier Decision that the Earlier Disciplinary Hearing constituted “proceedings conducted in open court” Paragraph 44(d) of the Earlier Decision. . It has since been established by the Upper Tribunal (in a case in which the Appellant was also a party Kanter-Webber v The Information Commissioner & The Chief Constable of Hampshire Constabulary [2025] UKUT 171 (AAC) ) that a Police Misconduct Panel was not a court for the purpose of applying the exemption given in section 32. Whilst that case related to section 32, it is clear that a Police Misconduct Panel is distinguishable from a court or Tribunal and accordingly the principles in the Google case regarding matters disclosed in ‘open court’ do not have the same application for matters disclosed in proceedings before a Police Misconduct Panel (including the Hearing). See also our comments in paragraph 107.[91]We turn now to the Legitimate Interests Test. It may be helpful to reiterate the Legitimate Interests Basis. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
. Translating that language to the context of the appeal: a. the disclosure of the Withheld Information would be ‘processing’; b. the Appellant is the ‘third party’; and c. the individuals whose personal data is included in the Withheld Information (for the reasons we have given) are the ‘data subjects’.[92]In respect of the first limb of the Legitimate Interests Test, the Decision Notice stated that the Appellant had not specified any particular legitimate interest in disclosure of the Withheld Information, but the Commissioner concluded in the Decision Notice that that the Appellant was pursuing a legitimate interest in making the Request. Paragraph 49 of the Decision Notice stated that the Commissioner could see some legitimate interest in disclosure of the Withheld Information in order to allow those who did not attend the Hearing to see what actually happened at the time, and to understand the findings.[93]We find that there is a legitimate public interest in understanding the matters addressed in the Hearing and what the outcome was, linked to the principle of police accountability (which is obviously a matter of public importance). We also find that the Appellant was pursuing a legitimate interest seeking disclosure of the Requested Information for that purpose (the “Relevant Legitimate Interest”) and therefore that the first limb of the Legitimate Interests Test was satisfied.[94]Turning to the second limb of the Legitimate Interests Test, this involves ascertaining whether the relevant processing is necessary for the purposes of the Relevant Legitimate Interest. As we have noted, this test of ‘reasonable necessity’ must be met before the Balancing Test can be considered and the test of ‘reasonable necessity’ involves the consideration of whether the Relevant Legitimate Interest could be achieved by something less.[95]The Decision Notice recorded that the Appellant had not specified why he believed that disclosure was ‘necessary’, but it referred to his arguments that because the Hearing had been held in public then the data subjects could have no reasonable expectation of privacy. The Commissioner considered that there was unlikely to be any other way of securing the Withheld Information, other than under DPA subject access rights for the data subjects in question. However, the Commissioner agreed with the Authority’s arguments that disclosure of the Withheld Information was not necessary because information had already been placed in the public domain about the subject matter and outcome of the Hearing.[96]We find that disclosure of the Withheld Information was not necessary to meet the Relevant Legitimate Interest. As we have noted, the Relevant Legitimate Interest was about understanding the matters addressed in, and the outcome of, the Hearing. In this case, the public was informed about the basic details of the allegations (see paragraph 97), the identity of the Officer, that the allegations were found to have been proven and of the outcome (namely, that the Officer was guilty of gross misconduct and that he was dismissed without notice). The Hearing was conducted in public and the outcome was reported in the press.[97]In his response, the Commissioner stated that the published outcome of the Hearing did not disclose details of the misconduct of the Officer concerned, but that the Deputy Chief Constable of Wiltshire Police was quoted in the press following the Hearing as stating:
“As both a Police Officer and supervisor he betrayed the trust invested in him and subjected a junior colleague to inappropriate sexual behaviour whilst on duty.”
. A news article contained in the open bundle also described the allegations in more detail.[98]Accordingly, we consider that the Relevant Legitimate Interest was achieved by the fact that the allegations involved and the outcome of the Hearing were publicly disclosed (as well as the identity of the Officer). In our view, no material public interest would be served by disclosure of the Withheld Information; disclosure would achieve little more than provide salacious details of the allegations and the evidence and this would not further the Relevant Legitimate Interest.[99]We reiterate that, for the purposes of the second limb of the Legitimate Interests Test, the processing of the relevant personal data (by way of disclosure of the Withheld Information) must be the “least restrictive” or “least intrusive” means of achieving the legitimate interest in question. As the Relevant Legitimate Interest has therefore been achieved by other means, it is not necessary for the Withheld Information to be disclosed under FOIA.[100]For the reasons we have given, therefore, we find that disclosure of the Other Personal Data was not necessary for the purposes of the second limb of the Legitimate Interests Test. Given that finding, it has not been necessary for us to consider the Balancing Test and disclosure of the Other Personal Data would not be lawful.[101]Consequently, we find that disclosure of the Other Personal Data pursuant to the Request would therefore breach the first data protection principle. Accordingly, the Commissioner was correct to conclude in the Decision Notice that the Authority was entitled to rely on section 40(2) in respect of the Other Personal Data.

The Relevant Special Data – the conditions for processing

[102]As we have noted, the Commissioner also concluded in the Decision Notice that none of the conditions required for lawful processing of the Complainant’s Special Data was satisfied, so there was no legal basis for its disclosure.[103]Whilst the Appellant did not specifically dispute that the Withheld Information includes Special Category Data, he argued that it was “doubtful” that restrictions on the processing of Special Category Data can have been intended to allow a “sexual predator” to invoke the right of privacy and respect to their own “sexual crimes”. This related to the Appellant’s assertion that it had been proven (as a result of the Hearing) that the Officer was guilty of the crime of “sexual assault”.[104]However, the Officer being found guilty of sexual misconduct in disciplinary proceedings before the Panel is not the same as being found guilty of a crime. There was no evidence before us that the Officer had in fact been convicted of any crime. In any event, the rules about Special Category Data apply regardless of whether a data subject has committed a crime (and, incidentally, the UK GDPR also gives extra protection to “personal data relating to criminal convictions and offences or related security measures”, covering information about offenders or suspected offenders in the context of criminal activity, allegations, investigations and proceedings).[105]A related point made by the Appellant was that (in summary) the Officer had made his personal data public, or otherwise lost his right to privacy, when he “decided to perpetrate multiple sexual assaults while a serving police officer”, citing the Google case regarding information which had been disclosed in open court.[106]However, as we have noted, there was no evidence before us that the Officer was convicted of any crime and in this case the relevant information was disclosed only before a Police Misconduct Panel (not in open court).[107]The Appellant also argued that police misconduct proceedings are not compatible to other regulatory standards, on the basis that “the proper conduct of police officers goes to the very heart of democracy, the rule of law and social contract”. We do not disagree that the allegations involving the Officer which were the subject of the Hearing are matters of public interest, given the nature of the allegations and the fact that they related to the conduct of a serving police officer. However, as we have noted, that public interest has been satisfied by disclosure of the basic details of the allegations involved, the identity of the Officer and the outcome of the Hearing, including the sanction imposed.[108]We find that no condition under Article 9 had been satisfied which would permit disclosure of the Relevant Special Data.[109]As we have noted, for the processing of the Relevant Special Data to be lawful, the applicable data subject must either have given explicit consent to the processing of it, or must have manifestly made it public. In addition, there must be another lawful basis for such processing (and, in this case, the only applicable lawful basis would be the Legitimate Interests Basis).[110]We find that there was no lawful basis for the processing of the Relevant Special Data pursuant to the Legitimate Interests Basis, for the same reasons as we have given in respect of the Other Personal Data. Given that finding, there can be no lawful processing of the Relevant Special Data and accordingly it is not necessary for us to consider any other conditions for processing of it.[111]However, for completeness, we would just briefly comment incidentally that:a. there was no evidence before us that any data subject had given explicit consent to the processing of any Relevant Special Data;b. we are not persuaded by the Appellant’s arguments that participation in, or attendance at, the Hearing (even though it was held in public) means that the Relevant Special Data has been ‘manifestly made public’ by any applicable data subject.[112]Linked to the above, we also address some specific arguments made by the Appellant (again for completeness, but these are incidental points given our finding in paragraph 110).[113]The Appellant argued that any Special Category Data in the Withheld Information was manifestly made public by the data subjects, on the basis that everyone involved in the Hearing took part voluntarily and no-one asked for a private hearing. He also argued that there could be no expectation of privacy once matters had been disclosed “in open court”, stating that there was a general rule that anything said in open court may be reported.[114]In order for a data subject to ‘manifestly make public’ their personal data, there must be a deliberate and unequivocal act by them. We do not consider that giving evidence in proceedings conducted publicly (such as the Hearing) is equivalent to a decision by the individual concerned to place such personal data into the public domain without restriction indefinitely. We comment further on this below.[115]We also agree with the Commissioner’s arguments in his response (which were addressing the Balancing Test regarding the Other Personal Data) that open justice is a powerful constitutional principle but not an absolute one, and that sometimes it will be necessary to derogate from that principle in order to protect privacy rights (amongst other things).[116]The Appellant submitted (in essence) that the Commissioner’s arguments above were inconsistent with the principles established in the Khuja case and the Google case and that they did not fit the issues in the appeal.[117]Paragraph 90 set out our views on how the principles in the Google case regarding matters disclosed in ‘open court’ can be distinguished from matters disclosed in the Hearing. We also agree with the Commissioner that (with respect) the First-tier Tribunal in the Earlier Decision misunderstood the Khuja case as holding that “the principle of open justice takes precedence over privacy rights in all cases where proceedings take place in open court”. Paragraph 41 of the Earlier Decision. Rather, we understand that the Khuja case established that the (important) principle of open justice has some qualifications, including with respect to the right of privacy.[118]Regardless of the above, we consider that the Khuja case can be distinguished from the proceedings in the Hearing, as the Khuja case itself related to information about allegations of criminal conduct and was primarily concerned with the right to privacy of the individual involved. In contrast, as we have noted, in this case:a. the Hearing was not about criminal conduct but allegations of inappropriate sexual behaviour (and for current purposes we consider it immaterial if the allegations in question also amounted to criminal conduct, as the Hearing did not constitute criminal proceedings);b. whilst the Hearing was conducted in public, it was not conducted in ‘open court’ (or in a tribunal); andc. the Withheld Information comprises (and therefore the issues regarding disclosure relate to) the personal data of various third parties, not just a person accused of wrongdoing.[119]Also, whilst we accept that it was open for the press to attend the Hearing and there was some publication of details of the allegations and the outcome of the Hearing, it does not necessarily follow that participants in the Hearing would expect that they would forever lose all privacy rights relating to their involvement at the Hearing. Indeed, there was no evidence before us to suggest that the participants would have any such expectation.[120]In addition, as we have noted, some of the personal data (including Special Category Data) contained in the Withheld Information related to individuals who were not participants in the Hearing (so did not ‘volunteer’ to take part). There was no evidence before us to the effect that those individuals were even aware that they would be mentioned in the Hearing.[121]It is also evident that the Complainant did not choose to make their persona data public and had expectations of privacy, notwithstanding their participation in the Hearing, given the Panel’s direction that they would be given anonymity.[122]In any event, the question before us was whether the Commissioner was correct to conclude that the Authority could rely on section 40(2) to refuse to disclose the Withheld Information. As we have noted, analysis of section 40(2) involves an assessment of whether it is lawful for the Authority to process the Other Personal Data and the Relevant Special Data, having regard to the relevant provisions of the DPA and the UK GDPR. These considerations regarding the lawfulness of processing by the Authority apply regardless of whether or not there has been public reporting of relevant information and whether or not the information is otherwise in the public domain (save in cases where data subjects themselves manifestly made it public, which is not applicable in the current instance for the reasons we have referred to).[123]For the above reasons, we find that:a. the Commissioner was correct to conclude in the Decision Notice that no conditions were met to enable lawful processing of the Complainant’s Special Data and accordingly that disclosure of it would be exempt under section 40(2); andb. no conditions were met to enable lawful processing of other Relevant Special Data and accordingly that disclosure of it would be exempt under section 40(2). Summary[124]For the reasons we have given, we conclude that section 40(2) was engaged in respect of the Withheld Information because: c. the Withheld Information comprises the personal data relating to various individuals and also includes Special Category Data of relevant individuals; d. no conditions under Article 9(2) for the processing of that Special Category Data by disclosure under FOIA are satisfied, and therefore there is no lawful basis for such disclosure; e. the Legitimate Interests Test is not satisfied for the processing of the Other Personal Data by disclosure under FOIA, and therefore there is no lawful basis for such disclosure.

Other points

[125]We finish by briefly addressing a further point which has been relevant to some of our conclusions above. Whilst the Commissioner concluded, in the Decision Notice, that all the Withheld Information constitutes personal data (and evidently considered that redaction of personal data would not be possible in the context of potential disclosure of the Withheld Information), he did not expressly address in the Decision Notice (or in his response) why he reached that conclusion. We find that the personal data (including Special Category Data) contained in the Withheld Information is an intrinsic part of the Withheld Information, such that it would not be feasible to disclose the Withheld Information by redacting personal data. In other words, the Withheld Information is inextricably linked with that personal data such that the entirety of the Withheld Information comprises personal data. Accordingly, we consider that it is not possible to disclose the Withheld Information without also releasing such personal data.[126]Consequently, given our finding that all of the Withheld Information is exempt from disclosure pursuant to section 40(2), it is not necessary for us to consider the additional exemptions relied on by the Authority.[127]Likewise, it is not necessary for us to consider whether the Authority could rely on section 40(5B)) to neither confirm nor deny whether they hold the Transcript (and the Commissioner made no finding on this in the Decision Notice in any event). Any conclusions of ours on this would be immaterial because, even if the Transcript is held by the Authority, it would be exempt from disclosure for the same reasons we have given in respect of the Withheld Information (given that the Transcript would contain the same information as the Audio Recording).

Final conclusions

[128]For all of the reasons we have given, we find that the Decision Notice was correct to conclude that the Authority was entitled to rely on section 40(2) to refuse to disclose the Withheld Information.[129]We therefore dismiss the appeal. Signed: Stephen Roper Date: 10 July 2026 130. Judge of the First-tier Tribunal