Shareb Affiliates Ltd v The Information Commissioner & Anor [2026] UKFTT 80 (GRC)

[2026] UKFTT 00080 (GRC)Case Reference: EA/2023/0470
First-tier Tribunal
(General Regulatory Chamber)
Date 21 January 2026
Information Rights
No oral hearing.
Before
JUDGE KIAIMEMBER COSGRAVEMEMBER SHAW
Between
SHAREB AFFILIATES LTDAppellantTHE INFORMATION COMMISSIONERRespondentSE TRAINS LTDRespondentDecision: The appeal is refused.REASONS
[1]This is an appeal under section 57 of the Freedom of Information Act 2000 (“FOIA”)against Decision Notice IC-237348-W5R1 dated 11 October 2023, by which the Information Commissioner (“the Commissioner”) upheld SE Trains Limited’s (“SETL”) refusal of parts of the Appellant’s request of 12 April 2023.[2]By case management directions dated 21 October 2024, SETL was joined as Second Respondent. All parties indicated that the matter was suitable for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing withing rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. Summary[3]The Appellant seeks recorded information concerning the taxi rank permit arrangements at Sevenoaks Station. SETL’s permits are administered via an online portal operated by APCOA Parking (UK) Ltd. The Appellant’s earlier request, dated 28 December 2022, elicited some data (including the total number of permits issued and penalty notices at certain periods). On 12 April 2023, the Appellant made a further, 16-part request seeking (amongst other things) breakdowns of permit issuance between new and existing permit holders, prioritisation policies, enforcement measures against hoarding or transfer of permits, any Equality Act 2010 assessments, and the names and business addresses of relevant SETL personnel.[4]By refusal notice dated 4 May 2023 (upheld on internal review, 5 June 2023), SETL relied on FOIA s.14(2) (repeat or substantially similar requests) for several parts, and FOIA s.40(2) (third-party personal data) for others.[5]The ICO’s Decision Notice upheld those refusals, and additionally found that, on the balance of probabilities, SETL did not hold certain requested information but had breached s.1(1)(a) by failing to state that fact.[6]The Appellant now appeals that decision.[7]SETL and the ICO resist the appeal. The scope of the appeal has changed over time, as set out below.[8]A more detailed break-down follows below. Previous Request[9]On 28 December 2022, the Appellant made the following request: ‘1. The total number of taxi rank permits applicants for Sevenoaks and Swanley Railway Stations respectively (“the respective stations”), each year since the commencement of the permit system. 2. The total number taxi rank permits issued for each of the respective stations each year since the commencement of the taxi rank permit system (“the permit system”). 3. The annual fee payable for a taxi rank permit at each of the respective stations each year since the commencement of the permit system. 4. The fine payable for use of the rank without a permit (“fines”) at each of the respective stations. 5. The number of fines issued each year at each of the respective stations since the commencement of the permit system. 6. The total annual revenue generated from fines each year at each of the respective stations since the commencement of the permit system. 7. The physical and administrative maintenance arrangements for the taxi ranks at each of the respective stations each year since the commencement of the permit system. 8. The date of the fixing of the taxi ranks at each of the respective stations. 9. The legal basis on which the permit system is operated. 10.Details of any cap on the number of permits issued annually, the rationale for any such cap, and details of how the specific prescribed maximum number of issuable permitted was decided at each of the respective stations. 11.Details of any impact assessments of, or investigations into the permit system’s actual or potential impediment, restraint of and/or interference with the hackney carriage trade, and the business of hackney carriage drivers and proprietors in the Sevenoaks District. 12.The number of single individuals and entities issued with permits for 2 or more hackney carriages in each year since the commencement of the permit system. 13.The maximum number of concurrent permits (for 2 or more hackney carriages) held by a single individual or entity in each year since the commencement of the permit system. 14.For each year since the commencement of the permit system, the total number of permits issued to:(a) wheelchair accessible vehicles;(b) vehicles licensed to carry 5 or more passengers; and(c) electric vehicles. 15.Confirmation of the existence of any contracts, policies, procedures and arrangements existing between SE Rail Limited and Sevenoaks District Council concerning the appointment, fixing, operation and/or use of the taxi ranks at each of the respective stations. If any of the aforementioned (in this paragraph) exists, please provide us with a written copy of each’.[10]On 24 January 2023, SETL responded in the following manner: ‘1. The total number of taxi rank permits applicants for Sevenoaks and Swanley Railway Stations respectively ("the respective stations"), each year since the commencement of the permit system. Swanley - We do not issue permits for Swanley. Sevenoaks – We hold records for the last 12 months only, during which 112 applications were received. 2. The total number taxi rank permits issued for each of the respective stations each year since the commencement of the taxi rank permit system ("the permit system"). Swanley – 0 Sevenoaks – 86 and 83 in 2021 and 2022 respectively. 3. The annual fee payable for a taxi rank permit at each of the respective stations each year since the commencement of the permit system. Sevenoaks - £545.39 p.a. 4. The fine payable for use of the rank without a permit ("fines") at each of the respective stations. £100, or £60 if paid within 14 days 5. The number of fines issued each year at each of the respective stations since the commencement of the permit system. We do not hold penalty notice issue data specific to the operation of the taxi rank, but the station in general, including car parks. Sevenoaks - 1st August 2021 to 31st July 2022 – 2057 penalty notices, 1st August 2022 to 15th January 2023 – 995 penalty notices were issued. Swanley - 1st August 2021 to 31st July 2022 - 274 penalty notices, 1st August 2022 to 15th January 2023 – 105 penalty notices were issued. 6. The total annual revenue generated from fines each year at each of the respective stations since the commencement of the permit system. Per the above, we do not hold information, specific to operation of the taxi rank. 7. The physical and administrative maintenance arrangements for the taxi ranks at each of the respective stations each year since the commencement of the permit system. The responsibility for maintenance and renewal work is separated between the lessor and lessee. These arrangements are described in the station access conditions and agreement. Under s21 of the FOIA information already accessible by other means, the access conditions are exempt from disclosure. This is an absolute exemption and not subject to the public interest test. https://www.orr.gov.uk/rail-guidance-compliance/network-access/station-depot/template-documentation Southeastern have contracted station maintenance services which require third parties to maintain all station assets. There is no distinct schedule for taxi ranks. Our contractors provide planned preventative maintenance services which require the contractor to provide a fully comprehensive service for operating and maintaining the assets within the Customer’s lease area and honour any relevant franchise obligations of which the Southeastern has informed the contractor, including surface makings. Repairs to potholes currently remain the responsibility of Network Rail. Southeastern’s contractors also provide a reactive maintenance service in order to respond to any fault in theshortest possible time. 8. The date of the fixing of the taxi ranks at each of the respective stations. We do not hold this information. This is because taxi ranks operation pre-dates the operation of Southeastern. 9. The legal basis on which the permit system is operated. Permits are not issued by Southeastern but by APCOA, under contract law. 10. Details of any cap on the number of permits issued annually, the rationale for any such cap, and details of how the specific prescribed maximum number of issuable permitted was decided at each of the respective stations. Sevenoaks – The current cap is set at 83 and it is estimated that 20 vehicles can be on the rank at any one time, which determines the cap. 11. Details of any impact assessments of, or investigations into the permit system's actual or potential impediment, restraint of and/or interference with the hackney carriage trade, and the business of hackney carriage drivers and proprietors in the Sevenoaks District. We do not hold this information. 12. The number of single individuals and entities issued with permits for 2 or more hackney carriages in each year since the commencement of the permit system. We hold information for the current year. Sevenoaks - 0 13. The maximum number of concurrent permits (for 2 or more hackney carriages) held by a single individual or entity in each year since the commencement of the permit system. We hold information for the current year. Sevenoaks – 0 14. For each year since the commencement of the permit system, the total number of permits issued to:(a) wheelchair accessible vehicles;(b) vehicles licensed to carry 5 or more passengers; and(c) electric vehicles. We hold some relevant information as the provision of the data requested is not mandatory. The following declarations have been received. Vehicle Accessibility Features Number Declared Ability to carry assistance dogs at no extra charge 24 Intercom 1 Low level floor lighting 1 Swivel seat 1 Wheelchair ramps 1 Grand Total 28 15. Confirmation of the existence of any contracts, policies, procedures and arrangements existing between SE Rail Limited and Sevenoaks District Council concerning the appointment, fixing, operation and/or use of the taxi ranks at each of the respective stations. If any of the aforementioned (in this paragraph) exists, please provide us with a written copy of each. We do not hold this information, as there are no such arrangements with Sevenoaks District Council’.[11]The Appellant requested a review, in a letter dated 11 February 2023. In that document, it asked further questions/clarifications.[12]In an email dated 3 March 2023, SETL responded: ‘For ease of reference, we have retained the numbering from your letter dated 11 February 2023. 5. Would you please confirm the reason(s) for your lack of possession of the requested data relating to the taxi rank(s) and whether you are obligated to possess and/or retain the requested data. Southeastern’s obligation to provide information under the Freedom of Information Act 2000 (the “Act”) extends to information that is recorded. We have previously explained that information is captured and recorded at station level, and not sub location level. We do not hold penalty notice issue data specific to the operation of taxi ranks, but stations in general, including car parks. 6. Would you please confirm:(a) the reason(s) for your lack of possession of the requested data relating to the taxi rank(s) and whether you are obligated to possess and/or retain the requested data;(b) the total annual revenue generated from fines as a whole in 2021 and 2022 respectively. Southeastern’s obligation to provide information under the Act extends to information that is recorded. Southeastern do not hold or record the information you have requested at 6 (a). 7. Would you please confirm whether Sevenoaks District Council maintains and/or provides funding for the maintenance of any part of the rank(s). This is a separate and new request for information, and will therefore, not be addressed in this review. 9. Would you please confirm the legal basis/source/authority/origin from which any alleged or purported legal right for SE Trains Limited to operate the permit system against taxi driver licensed by Sevenoaks District Council; and/or for SE Trains to arrange for/instruct APCOA Parking (UK) Limited or any other third party, on behalf of SE Trains or otherwise, to operate the permit system against taxi drivers licensed by Sevenoaks District Council. Southeastern’s obligation to provide information under the Act extends to information that is recorded. Southeastern do not hold or record the information you have requested. However, Southeastern’s authority is underpinned by the Railway Byelaws. 10. Would you please confirm: (a) the rationale for the imposition of the cap. We note your reference to the fact that it is estimated that 20 vehicles can be on the rank at any one time. However, the reference to the estimated number of vehicles that can be on the rank at any one time fails to reasonably justify the imposition of the permit system, as every taxi rank in the UK is subjected to such a natural limitation on the number of vehicles that can be on the rank at any one time, a number which is determined by the size of the rank (“the natural limitation”). Other ranks subject to the natural limitation operate well without the imposition of a superimposed artificial limitation on access the ranks (such as a rank permit system); (b) the reason(s) why the artificial limitation on the pool of vehicles with access to the rank (the permit system) is superimposed on the natural limitation;(c) the precise calculation used to determine the cap in 2022;(d) how the cap calculation was determined in 2022;(e) whether the estimated number of vehicles that could use the rank at any one time in 2021 reduced in 2022;(f) the precise calculation used to determine the cap in 2021;(g) how the cap calculation was determined in 2021. Southeastern’s obligation to provide information under the Act extends to information that is recorded. Southeastern do not hold or record the information requested. 11. Could you please confirm the reason(s) for your lack of possession of the requested data and whether you are obligated to possess and/or retain the requested Southeastern’s obligation to provide information under the Act extends to information that is recorded. Southeastern do not hold or record the information requested. The purpose of this review, is to clarify your FOI request dated 28th December 2022. Therefore, any new requests for information in your letter dated 11th February 2023, will not be addressed.[13]On 9 March 2023, SETL emailed the Appellant in the following terms:
‘With reference to you appeal in which you raised a request for two new pieces of information being: 1. The total annual revenue generated from fines as a whole in 2021 and 2022 respectively. We hold this information, however the information requested is substantially similar to that previously requested and provided and repeated below. Value per fine = £100, or £60 if paid within 14 days. Number of penalties at Sevenoaks - 1st August 2021 to 31st July 2022 – 2057 penalty notices, 1st August 2022 to 15th January 2023 – 995 penalty notices were issued. (Total £207K) Number of penalties at Swanley - 1st August 2021 to 31st July 2022 - 274 penalty notices, 1st August 2022 to 15th January 2023 – 105 penalty notices were issued. (Total £26K) 2.

(s) They do not’

. Current Request[14]On 12 April 2023, the Appellant wrote to SETL and requested information in the following terms:
‘1. The total number of taxi rank permits for Sevenoaks Station (“the permit system”) issued to new applicants (first time applicants or non-existing permit holders) in 2021 and 2022 respectively. 2. The total number of taxi rank permits for Sevenoaks Station (“permit(s)”) issued to existing permit holders (individuals and/or entities holding a permit in the preceding year) in 2022 and 2023 respectively. 3. Whether SE Trains Limited prioritises permit applications received from existing permit holders over permit applications received from new applicants. 4. Details of any and all hackney carriage rank access/permit arrangements applicable to any individual(s), entity(ies), hackney carriage vehicle feet operator(s) and/or private hire vehicle operator(s) outside of the permit system operated by APCOA Parking (UK) Limited online at: https://sertaxi.apcoa.co.uk/. 5. Confirmation as to whether holders of permits issued by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/ are permitted to hoard and/or transfer issued permits by sale, rental or otherwise. 6. Confirmation as to whether holders of permits issued outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apcoa.co.uk/ are permitted to hoard and /or transfer issued permits by sale, rental or otherwise. 7. Details of any and all measures taken by SE Trains Limited (and/or APCOA Parking (UK) Limited) to enforce any prohibition on the hoarding and/or transfer, rental and/or sale of permits issued to permit holders by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/. 8. Details of any and all measures taken by SE Trains Limited (and/or APCOA Parking (UK) Limited) to enforce any prohibition and/or restriction(s) on the hoarding and/or transfer, rental and/or sale of permits issued to permit holders outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apcoa.co.uk/. 9. Description of enforcement action taken by SE Trains and/or APCOA Parking (UK) Limited against any permit holder individual or entity found to have contravened any prohibition on the hoarding and/or transfer of permits by sale, rental or otherwise for permits: (a) issued by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/; (b) issued outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apcoa.co.uk/. 10. Details of any and all hackney carriage vehicle and/or driver service(s) engaged and/or procured by SE Trains Limited for operation at Sevenoaks Station. 11. Details of any/all assessments as to whether the operation of the permit system, including the cap on issuable permits, restricted access to submit permit applications to the month of July only annually, and/or the permit fee is compatible and/or complaint with the provisions of the Equality Act 2010. Particularly, any and all assessments as to whether the permit system and/or its operation complies with sections 15, 19, 20 and 21 of the EA 2010, respectively prohibiting discrimination arising from disability, indirect discrimination based on age and/or disability, and failure of a duty to make adjustments. 12. Name(s) and business address(es) of SE Trains Limited’s Car Parking Managers. 13. Name(s) and business addresses of the company decision maker(s) concerning the permit system and its operation. 14. Confirmation as to whether any individual or entity may concurrently hold 2 or more permits issued outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apcoa.co.uk/. 15. Confirmation of the maximum number of permits held concurrently by any individual and/or entity, issued outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apcoa.co.uk/ 16. A list of each of the licensed: (a) hackney carriage vehicle plate numbers currently holding a permit; and (b) hackney carriage driver badge numbers currently holding a permit’
The Response[15]On 4 May 2023, SETL responded in the following manner: ‘Please find our response to your Freedom of Information Act (“the Act”) request. Under Section 14(2) of the Act, a Public Authority is entitled to refuse a request which repeats or is substantially similar to a previous request, and / or where we have previously confirmed that information is not recorded or held. As with your previous and substantially similar request, it requires statements confirmation, description or explanation, not information which is recorded or held by Southeastern. The Act covers recorded information. Your request is therefore refused under section 14(2) of the Act. I would further clarify that parts of your request (sections 12, 13 and 16) are for personal data, which is exempt from disclosure under s40(2) of the Act. The s40(2) exemption is absolute and not subject to the Public Interest test’.[16]On 10May 2023, the Appellant responded requesting a review of the decision.[17]SETL responded by way of an email dated 5June 2023, upholding its decision.[18]On 7 June 2023, the Appellant complained to the ICO. The Decision Notice (dated 11 October 2023)[19]The ICO concluded that:a. SETL was correct to rely on section 14(2) (repeat requests) of FOIA to refuse parts 4, 6, 8, 10, 11, 14 and 15 of the request;b. SETL was correct to rely on section 40(2) (third party personal information) of FOIA to refuse parts 12, 13 and 16 of the request;c. SETL does not hold the remaining information sought by the request;d. SETL breached section 1(1)(a) of FOIA as it failed to communicate to the complainant that it did not hold the remaining information (parts 1, 2, 3, 5, 7 and 9): i. SETL does not hold data distinguishing first-time vs renewal applicants (part 1 and 2); ii. No written policy on prioritising applications (part 3); iii. No recorded information on hoarding or transferring permits or enforcement measures (parts 5, 6, and 9).e. SETL was not required to take any further steps. Grounds of Appeal[20]On 6 November 2023, the Appellant appealed against that decision on the following basis: Ground 1 – Misinterpretation of Requests[21]The Appellant contends that the ICO erred in law and fact by misconstruing parts 4, 6, 8, 10, 11, 14 and 15 of the Appellant’s request.[22]The ICO wrongly interpreted these parts as seeking information concerning “permits issued outside of the permit system operated by APCOA Parking (UK) Limited”. The ICO failed to consider the full wording of the requests, which expressly referred to permits issued outside of the system operated by APCOA Parking (UK) Limited online at https://sertaxi.apcoa.co.uk. The requests sought information about permits issued outside the online portal, not outside APCOA entirely.[23]The true purpose of these requests was to ascertain whether any alternative or additional channels existed for submitting and processing permit applications, beyond the APCOA online portal (eg postal or email applications, telephone arrangements, or direct dealings with SETL/APCOA personnel).[24]This inquiry is materially distinct from previous requests, which concerned permits issued via the online portal only. Accordingly, the ICO erred in concluding that these parts were substantially similar to earlier requests and in upholding SETL’s reliance on section 14(2). Ground 2 – Error on Information Held[25]The Appellant further contends that the ICO erred by concluding that SETL did not hold the information sought in parts 1 and 2 of the request (breakdown of permits issued to new versus existing holders).[26]On the balance of probabilities, SETL and APCOA should hold this information for the following reasons:(a) SETL’s privacy policy confirms retention of personal data for 6 months after the statutory limitation period (usually 6 years), or longer where necessary to comply with legal obligations.(b) APCOA’s privacy policy states that personal data is retained for up to 6 years where there has been interaction or for related contracts.(c) APCOA communicates with applicants by letter and email following online submissions, implying that hard or digital copies of such correspondence exist.(d) SETL’s response of 24 January 2023 disclosed historical data (112 applications in the preceding 12 months; 86 permits in 2021; 83 in 2022), contradicting its claim of only 12-month retention.(e) APCOA operates a waiting list for unsuccessful applicants, which could not function without retaining historical application data.(f) Common industry practice and the Limitation Act 1980 require retention of data for 6 years to enable legal claims.[27]The ICO’s conclusion that SETL does not hold the requested data is inconsistent with the retention policies and practices. If SETL does not hold the data, this may indicate a breach of data protection legislation, potentially warranting enforcement action. Information Commissioner’s Response[28]In its response dated 3rd January, the ICO states:a. Further to Ground 1: i. The ICO maintains that parts 4, 6, 8, 14, and 15 use similar phrasing and appear substantially similar to an earlier request (December 2022) seeking the legal basis for the permit system. ii. The ICO notes that SETL previously confirmed permits are issued by APCOA under contract law and that Southeastern does not hold other related information. iii. However, the Commissioner acknowledges that the January 2023 response did not explicitly confirm whether it referred only to the portal or other channels, which introduces a distinction. iv. Requests 10 and 11 differ in phrasing:• Request 10: Sought details of hackney carriage services engaged/procured by SETL.• Request 11: Sought details of Equality Act 2010 compliance assessments. v. The ICO suggests the Tribunal seek further submissions from SETL to clarify whether these requests are substantially similar to previous ones.b. In response to Ground 2, the ICO states that it considers the Tribunal would be assisted by having sight of the Department’s responses to the Appellant’s Ground 2 and, to that end, invites the Tribunal to seek specific submissions via its case management powers under rule 5(3)(d) of the Rules. The Appellant’s Reply[29]In the Appellant’s Reply dated 30th January 2024, they assert: Amendment to the Grounds of Appeal The Appellant seeks to add requests 7 and 9 to the grounds of appeal, in light of new information revealed in the ICO’s response. Basis for amendment(i) New information in the Respondent’s response (3 Jan 2024) revealed inconsistencies between reasons given in the original decision (11 Oct 2023) and those resisting the appeal.(ii) Original reasoning focused on APCOA as permit administrator; later reasoning focused on the legal basis of the permit system—creating confusion and impairing the Appellant’s ability to respond. Procedural unfairness alleged: (i) The Respondent did not allow the Appellant to reply to SETL’s representations before issuing the decision, contrary to natural justice. (ii) The Respondent now invites the Tribunal to seek further submissions from SETL, suggesting the decision was insufficiently informed. Ground 1 – Misinterpretation and Misapplication of Section 14(2) FOIA - Requests (4, 6, 7, 8, 9, 10, 11, 14, 15) are not substantially similar to previous requests; similarity in phrasing alone is insufficient. - The original request concerned the overarching legal basis; the material requests sought specific operational details (e.g., enforcement measures, Equality Act 2010 compliance, permit hoarding rules). - SETL’s responses failed to explicitly confirm whether other channels for permit issuance exist, leaving requests unsatisfied. - Each material request is distinct in scope and substance from the original request and remains undisclosed. Ground 2 The Appellant refers back to arguments under Ground 1, emphasising procedural unfairness and Respondent’s reliance on speculative reasoning. SETL’S Interim Response[30]The Tribunal added SETL as a party to the appeal by directions dated 21 October 2024.[31]Following correspondence between SETL and the Tribunal, the Second Respondent made the following submissions, dated 18 November 2024:
‘As required by Rule 23 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (“the 2009 Rules”), SETL hereby states that it opposes the Appeal. Some of the 16 parts of the Appellant’s request ask questions, rather than seeking recorded information. Where information is sought, it is either (i) not held by SETL (and in some cases, the request asks a question rather than seeking disclosure of recorded information), (ii) was the subject of a substantially similar request with which SETL has recently complied, such that it is not obliged to respond to those parts of the request in accordance with s.14(2) of the Freedom of Information Act 2000 (“FOIA”); and/or comprised third-party personal data that is absolutely exempt from disclosure in accordance with s.40(2) FOIA’
. SETL’s Response[32]Following an extension of time, the Second Respondent served a detailed response, dated 20 December 2024. In that decision it contended that the majority of the 16 parts of the Request were either:(a) Questions rather than requests for recorded information.(b) Seeking information not held by SETL.(c) Substantially similar to an earlier request, thus exempt under s.14(2) FOIA.(d) Involving third-party personal data, exempt under s.40(2) FOIA.[33]SETL clarified from the outset that: ‘11. SETL has obtained legal advice during the course of these proceedings and is now represented by solicitors and counsel. While it maintains that it was correct overall not to disclose information and/or refuse to respond to the Request, the basis on which it now puts its case is slightly different from when it responded to the Request, and from the position set out in the DN. Given that, and the shifting arguments advanced by the Appellant, SETL considers that it would be of most assistance to the Tribunal for it simply to set out below what it considers to be the correct position on each Part of the Request: the case is more straightforward than it has been made to appear through the pleadings to date. SETL gives its position in response to all 16 Parts of the Request, since the scope of the Appeal is unclear – albeit very briefly on those Parts which do not appear to be pursued by the Appellant’.[34]It responded to each request in the following way: (a) Parts 1 & 2 – Permit Numbers• SETL does not hold data distinguishing new vs. existing applicants.• The total number of permits issued for previous years is known because it is subject to a cap (86 in 2021; 83 thereafter) and fully allocated annually.• SETL does not hold information on who is an ‘existing permit holder’.• No 2023 data existed at the date of the request. (b). Part 3 – Prioritisation• The Appellant does not appear to be pursuing this. It does not contain a request for recorded information; it asks a question.• No recorded information answering the question exists.• SETL confirms that outside FOIA, applications are treated equally – priority is not given to existing permit holders (which is why there is no reason for the portal to distinguish between them). (c). Parts 4–6 – Alternative Systems & Transfers• No permits exist outside the APCOA Portal – accordingly there is no information within the scope of Part 4 or 6.• The Appellant does not appear to be pursuing Part 5. It does not contain a request for recorded information; it asks a question.• SETL confirms that permits are non-transferable and limited to one per person. If ‘hoarding’ means holding more than one permit – that is not allowed. (d). Parts 7–9 – Enforcement• In relation to part 7, no recorded enforcement details exist.• APCOA monitors ranks, but this was not documented at the date of the request. Nor is any other information about how APCOA enforces any aspect of the permit system.• For the reasons given in response to part 4 and part 7, there is no information in scope of part 8.• For the reasons given in response to parts 4, 7 and 8 there is no information in scope of part 9. (e). Part 10 – Hackney Carriage Services• SETL does not procure such services; no information is held. (f). Part 11 – Equality Act Assessments• Substantially similar to part 11 of an earlier request, which was a more general request for assessments about the impacts of the permit system and would therefore encompass this more specific request for Equality Act assessments; refusal justified under s.14(2).• Confirm no Equality Act assessments have been undertaken. (g). Parts 12, 13 & 16 – Personal Data• The Appellant does not seem to be pursuing parts 12 or 13 or 16. Names, addresses, and permit holder details withheld under s.40(2). (h). Parts 14 & 15 – Multiple Permits• Part 14 does not contain a request for recorded information.• Confirms no permits are issued outside the Portal (as explained in response to Part 4).• Confirms only one permit allowed per individual/entity (as explained in response to Part 5).[35]SETL invites the Tribunal to:a. Dismiss the Appeal, orb. Substitute a decision notice confirming the Commissioner’s conclusion in the DN that SETL was entitled to refuse to respond and/or withhold information under FOIA provisions – but for the reasons given above in relation to each part of the request, insofar as those differ from the reasons given in the DN. Appellant’s reply to the Second Respondent[36]The Appellant served a reply to the Second Respondent’s response, dated 21st January 2025. In that reply he makes the following submissions: Scope[37]The Appellant indicates that it is pursuing Parts 3, 5, 7 and 9 of the Request, and seeks permission to amend the grounds if necessary. Although the Appellant did not highlight a challenge to SETL’s application of section 40(2) in the pleadings, the Appellant invites the Tribunal, in the public interest, and for the purposes of enforcing personal accountability, if necessary, to rule on whether SETL correctly applied section 40(2).[38]The Appellant submits that, based on SETL’s responses, it appears SETL’s administration of the permit system may engage and potentially contravene duties and/or obligations arising under: ◦ the Equality Act 2010 (“EA 2010”), including matters associated with Part 11 of the Request and the possibility of personal liability for certain duties. If so, disclosure of the names and job titles of relevant decision makers is in the public interest. ◦ the Service Agreement, including identification of key personnel, record-keeping, inspection rights of the Secretary of State, maintenance of accounting records, notification duties for data protection breaches (including breaches by APCOA as data processor), and ensuring the Secretary of State’s access to third-party held information; ◦ data protection law, particularly in respect of any automated decision-making suggested by portal functionality; ◦ the Competition Act 1998 (“CA 1998”), insofar as retention and disclosure of information is necessary to demonstrate compliance or defend claims; ◦ accounting laws and practices regarding retention of transactional records for permit fees. Appellant’s Submissions on SETL’s Evolving Position[39]The Appellant contends that SETL’s position has shifted and remains unclear. While it maintains the overall correctness of non-disclosure or refusal, the basis on which it now puts its case differs from its response to the Request and the Decision Notice. The Appellant further notes SETL’s initial assertion that several parts of the Request were similar to an earlier FOIA, but in its detailed Response SETL states that only Part 11 was substantially similar (and then provides a ‘sought response’ to Part 11 of the Request). Notwithstanding such assertions, SETL proceeded to provide responses to all 16 parts of the Request, including certain responses “outside of FOIA”.[40]The Appellant disputes the relevance and accuracy of SETL’s distinction between FOIA requests “asking a question” and “seeking recorded information”, arguing that properly framed FOIA requests may take the form of questions where the answers consist of recorded information held. It also asserts that some of the parts of the request were not questions as alleged.[41]The Appellant invites the Tribunal to note that SETL’s provision of substantive answers in its Response sits uneasily with SETL’s invitation that the Tribunal dismiss the appeal or substitute a Decision Notice confirming SETL’s entitlement to refuse to respond/withhold information while relying on different reasons than those recorded in the Commissioner’s Decision Notice. Data Holding, Retention and Evidence Sources[42]In relation to Parts 1–3 of the Request, SETL states that it does not hold information distinguishing existing permit holders from new applicants and that it does not prioritise applications from existing permit holders. The Appellant submits that, if correct, the absence of such data would appear inconsistent with:• retention obligations in the Service Agreement (records for 6 years);• SETL’s and APCOA’s published privacy policies (6-year retention of personal data);• accounting records obligations (including identification of payers and transaction details for permit fees). The Appellant points to figures previously disclosed by SETL for 2022 (annual permit fee £545.39; 83 permits issued), yielding total fees received of £45,267.37 in that year alone, and asserts that accounting practice would require retention of transactional and payer identity data, which, by cross-referencing across years, would allow determination of whether issued permits were to existing or new holders.[43]The Appellant challenges any implication that decision-making is automated by the portal (potentially relevant to parts 1, 2 and 3). It cites APCOA guidance indicating that an administrator approves or rejects permit applications and processes permit-related vehicle changes, with email notifications sent to applicants/permit holders. The Appellant asserts that such communications should be retained either by SETL or APCOA (as data processor), beyond the portal environment, for the applicable retention period.[44]The Appellant further submits that surveillance data (e.g., CCTV, ANPR, body-worn cameras) at the Station rank could identify permit holders over time and, according to published policies, should be retained for 6 years. Such data would provide an evidential basis for monitoring and enforcement, particularly of compliance with EA 2010 and the Service Agreement. Contractual Terms and Enforcement[45]The Appellant argues that SETL failed to address records which it may hold or ought to hold outside of the Portal, whether electronically or manually. It references APCOA’s permit terms and conditions, which contemplate the physical issue of permits, written explanations upon revocation, and discretionary replacement/reissue processes (including fees), all of which suggest and require record creation and retention outside the portal.[46]The Appellant argues that failure to retain permit data beyond expiry would impede enforcement of surviving contractual obligations, including non-disclosure and public announcement restrictions, and undermine SETL’s ability to produce documentary evidence in relation to:• first-come-first-served operation of the system;• any defence to allegations of breach;• monitoring of compliance with EA 2010 and other legal obligations. Practical and Economic Implications[47]The Appellant highlights the significant disparity in earning capacity between Station permit holders and non-permit holders, particularly given the Station rank’s size and the absence of Uber competition. It contends that a purely first-come-first-served system without any prioritisation for existing permit holders produces instability and potentially jeopardises drivers’ livelihoods, as a driver might experience higher income in one year but suffer substantial loss in the next if a permit application is unsuccessful.[48]The Appellant cautions that the purported failure to retain data renders the permit system susceptible to abuse and that any deletion or destruction of expired permit data may be viewed as the removal of evidence relevant to detecting such abuse, thereby necessitating safeguards and remedies. Legal Framework[49]The relevant provisions of FOIA are as follows.[50]Section 1(1) FOIA: ‘Any person making a request for information to a public authority is entitled –a. to be informed in writing by the public authority whether it holds information of the description specified in the request, andb. if that is the case, to have that information communicated to him’.[51]Section 84 FOIA defines ‘information’ as: ‘information record in any form’.[52]Section 40(2) FOIA(the ‘Personal Information’ Exemption) states:
‘(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information is - (a) it constitutes personal data which does not fall within subsection (1) and (b) the first, second or third condition below is satisfied.

(a) Would contravene any of the data protection principles, […]’

[53]Section 3 of the Data Protection Act 2018 defines personal data, (insofar as relevant) as:
‘(2) “Personal data” means any information relating to an identified or identifiable living individual. (3) “Identifiable living individual” means a living individual who can be identified, directly, or indirectly, in particular by reference to - (a) an identifier such as a name, an identification number, location data, or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual’
[54]Article 5(1)(a) of the GDPR states: ‘Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject’.[55]Article 6(1)(f) of the UK GDPR states:
‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’
. Discussion and Conclusions[56]In accordance with section 58 of FOIA, our role is to consider whether the ICO’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision. Scope of the Hearing[57]Following receipt of SETL’s response dated 20 December 2024 (which stated ‘SETL has obtained legal advice during the course of these proceedings and is nowrepresented by solicitors and counsel. While it maintains that it was correct overall not todisclose information and/or refuse to respond to the Request, the basis on which it now putsits case is slightly different from when it responded to the Request, and from the position setout in the DN’ and the Appellant’s reply thereto, dated 21 January 2025 (in particular at paragraph 8), the live issues before the Tribunal have narrowed and are now limited to:a. Whether Parts 3, 5, 7 and 9 amount to a valid request and if so, whether SETL held any relevant recorded information within scope at the time of the request (where information is not held, there is no duty to disclose what is not held in compliance with s1 (1) FOIA).b. Whether SETL were correct to rely upon section 40(2) in relation to parts 12 and 13 (ie whether disclosure would contravene data protection principles and is exempt).[58]We note that these differ to the original grounds of appeal. However, in light of the fact that Second Respondent served a detailed response addressing each request (and has not objected to the application to vary the grounds, despite the Appellant indicating their intention to rely on different grounds in January 2025), we have granted the application to amend the grounds of appeal.[59]We note the ICO’s submission that:
‘Secondly, and following receipt of SE Trains’
Response of 20 December 2024 and the Appellant’s Reply thereto dated 21 January 2025 (see paragraph eight in particular), the Commissioner understands that the live issues in dispute are now limited to (a) whether limbs 3; 5; 7 and 9 of the Appellant’s correspondence dated 12 April 2023 amount to valid requests and, if so, whether SE Trains held any relevant recorded information within scope at the time of the request and (b) whether SE Trains was correct to rely upon section 40(2) in relation to limbs 12 and 13’.[60]There has been no objection to the Appellant’s application to amend the grounds of appeal. We find there is no prejudice to the Second Respondent or ICO in the circumstances. Do parts 3, 5, 7 and 9 amount to a valid request and if so, do SETL held any relevant recorded information within scope at the time of the request. Part 3[61]The Appellant requested the following: ‘3. Whether SE Trains Limited prioritises permit applications received from existing permit holders over permit applications received from new applicants.[62]In the original response, SETL refused the application under section 14(2) of FOIA.[63]The ICO concluded that SETL was not entitled to refuse to comply with this part of the request by relying on section 14(2). It went on to consider if the information was in fact held by SETL. It concluded: ’18. With regard to part 3 of the request, SETL stated that it considered this to be a request for an explanation rather than recorded information. However, it went on to confirm to the Commissioner that it does not hold a written policy or other information which specifies how permit applications should be prioritised between new and existing permit holders…. 21. The Commissioner is satisfied, that, on the balance of probabilities, SETL does not hold any recorded information within the scope of parts..3…of the request. However as SETL did not fulfil its obligation to confirm this in writing to the complainant, it breached section 1(1)(a) of FOIA’.[64]In its most recent submissions, SETL maintains that the request was not a request for recorded information, it was a question. It further maintains that the information is not held. The Appellant disputes this and sets out the reasons for this at paragraphs 17-18 of its response. We do not set this out again here. (i) Is it a valid request?[65]We agree with SETL, that it was not a request for ‘recorded’ information. The objection made by SETL is not just to the fact that it was a question – it is to the fact that it was not asking for recorded information.[66]The statutory framework of the Freedom of Information Act 2000 is unequivocal in its scope: the right conferred upon an applicant is a right of access to recorded information held by a public authority at the time of the request. Section 1(1) of the Act provides that any person making a request for information is entitled to be informed whether the authority holds information of the description specified and, if so, to have that information communicated. The term “information” has been consistently construed by the courts and tribunals to mean information existing in a recorded form, irrespective of medium, and not to extend to opinions, explanations, or the creation of new material. The Act does not impose any obligation upon a public authority to generate fresh content or provide narrative answers; its duty is confined to disclosure of what is already documented. FOIA does not require authorities to supply commentary or construct responses beyond the recorded information held. Accordingly, requests framed as questions or seeking explanations fall outside the statutory remit unless the answers are already captured in recorded form.[67]We find it is not a valid request because it was not asking for recorded information, that brings the matter to an end.[68]For completeness however, we add the following points.[69]The Appellant submits that if SETL is correct in its responses to parts 1, 2 and 3 of the request, that it does not hold the information because the portal system does not distinguish between existing permit holders and new applicants, it does not hold information on who is an existent permit holder and it does not prioritise applications from existing permit holders or those from new applications, then it would appear to be in contravention of its data retention obligations which provide that personal data is retained for 6 years.[70]We note firstly that the Appellant has not sought to challenge the responses to parts 1 and 2. Only part 3. As such, it would seem that he accepts the responses he received to parts 1 and 2 – which state that SETL does not hold information on who is an existing permit holder. However, he does seem to challenge whether information is held on who is an existing permit holder when considering part 3.[71]The Appellant’s position is in effect, that SETL should have this information. However whether SETL ‘should’ act in a particular manner, is not a matter for this tribunal. SETL state that they do not have this information. We accept – on the balance of probabilities - this evidence and conclude that the information is not held. We note that SETL have chosen to provide answers, even where the information is not recorded - they explicitly confirmed outside FOIA that applications are treated equally and that priority is not given to existing permit holders, which is why there is no reason for the portal to distinguish between them. They were not obliged to provide this information for the reasons provided, the fact that they chose to do so indicates to us that they are not seeking to avoid disclosing information. There simply is no recorded information to provide. We note that the answers are provided in pleadings by counsel – who has legal obligations not to mislead the court – these are clearly based on instructions. It would be a very serious allegation to assert that that the public authority (and/or counsel) have lied (this is not the type of case where it can be suggested that they are ‘mistaken’). We do not accept that they have lied or sought to mislead the Tribunal – we accept the evidence contained in their responses. We also note that the internal messages (page B453 of the bundle) refer to the fact that ‘No guarantees of availability are implied or assured. Permits are sold on a first come first served basis’. SETL’s position on this has always been consistent, and we accept it as an accurate reflection of the position.[72]We find the Appellant’s requests have been answered.[73]In the initial grounds of appeal, the Appellant stated that he wanted a response to the requests. We acknowledge that the grounds have moved on since then and different requests were challenged by this appeal. However, we note that the Appellant has had a response to his requests now.[74]Several of the issues raised by the Appellant in its response to SETL’s response, dated 20 December 2025 are wide-ranging and challenge the operation of the permit system, asserting that it may engage and potentially contravene duties/obligations arising under the EA 2010, the Service Agreement, Data Protection Law relating to automated decision-making, Competition Act 1998 and accounting laws/practices. Any potential breaches are not a matter for this Tribunal and are not within our jurisdiction, we make no finding in relation to this. We do not find one way or another that the failure to hold recorded information within the scope of this request means the Second Respondent is in breach of its duties/obligations.[75]We were invited to find that the information requested is held, because if it were not that would mean that SETL is in breach of various laws/contracts. We find that even if there are potential breaches, this does not undermine the assertion by SETL that they do not hold the information, for the reasons provided above.[76]We add for completeness, that it may well be that some information could be generated, however SETL are under no obligation to do so. FOIA permits access to information which exists in a recorded form. It does not extend to the creation of new material. The request asked if SETL prioritised requests from existing permit holders. The question was answered.[77]We agree that the request is not a request for recorded information. SETL states that the system does not prioritise existing permit holders. As such there are inevitably no records evidencing prioritisation. Parts 5, 7 and 9[78]The Appellant requested the following: ‘5. Confirmation as to whether holders of permits issued by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/ are permitted to hoard and/or transfer issued permits by sale, rental or otherwise’…. 7. Details of any and all measures taken by SE Trains Limited (and/or APCOA Parking (UK) Limited) to enforce any prohibition on the hoarding and/or transfer, rental and/or sale of permits issued to permit holders by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/.... 9. Description of enforcement action taken by SE Trains and/or APCOA Parking (UK) Limited against any permit holder individual or entity found to have contravened any prohibition on the hoarding and/or transfer of permits by sale, rental or otherwise for permits:(a) issued by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/;(b) issued outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apcoa.co.uk/.[79]In the original response, SETL refused the requests under section 14(2) of FOIA.[80]The ICO concluded that SETL was not entitled to refuse to comply with these parts of the request by relying on section 14(2). It went on to consider if the information was in fact held by SETL. It concluded: ‘19. Parts 5, 7 and 9 of the request all relate to hoarding or transferring of taxi permits via sale or rental. SETL explained to the Commissioner that it does not hold any recorded information which specifically addresses the matter of hoarding or transferring of permits via sale or rental. SETL considers that part 5 of the request is seeking clarification rather than recorded information, and as such it was not obliged to respond to it. However, by way of advice, SETL outlined that the Terms and Conditions of the permits state only one permit per account, and the name attached to the permit cannot be changed.20. SETL advised that it does not hold any recorded information about the measures or enforcement action relating to hoarding or transferring of permits via sale or rental, as described by the complainant at parts 7 and 9 of the request. SETL went on to explain that APCOA is responsible for the general policing of the taxi ranks and checking that the driver is displaying the permit issued to their vehicle, however details of the specific measures taken by SETL or APCOA are not recorded anywhere. SETL further explained that no permit holders have been found to be in breach of the terms and conditions, therefore it does not hold details of any enforcement action taken against permit holders.21. The Commissioner is satisfied that, on the balance of probabilities, SETL does not hold any recorded information within the scope of parts…5, 7 and 9 of the request. However, as SETL did not fulfil its obligation to confirm this in writing to the complainant, it breached section 1(1)(a) of FOIA’.[81]In its letter dated 24 January 2023, SETL stated:
‘12. The number of single individuals and entities issued with permits for 2 or more hackney carriages in each year since the commencement of the permit system. We hold information for the current year. Sevenoaks - 0 13. The maximum number of concurrent permits (for 2 or more hackney carriages) held by a single individual or entity in each year since the commencement of the permit system. We hold information for the current year. Sevenoaks – 0’
[82]In its letter dated 15August 2023, SETL stated:
‘Questions 5… do not constitute requests forinformation. Nevertheless, the answer to the Complainants questions are addressed by point 12 and13 of SETL’s response dated 24 January 2023… Question 5 - Confirmation as to whether holders of permits issued by APCOA Parking (UK) Limitedby way of application at: https://sertaxi.apcoa.co.uk/ are permitted to hoard and/or transfer issuedpermits by sale, rental or otherwise. Terms and Conditions clearly state 1 permit per driver. Theapplicant is not asking for recorded information. They are asking SETL to confirm something that isby definition excluded and was answered on 24th January 2023…’
And ‘Question 7 – Compliance with terms and conditions is monitored by APCOA, but there is no recordedinformation describing the approach suggested by the Complainant and held by SETL or APCOAParking (UK) Limited…. Question 7 - Details of any and all measures taken by SE Trains Limited (and/or APCOA Parking(UK) Limited) to enforce any prohibition on the hoarding and/or transfer, rental and/or sale of permitsissued to permit holders by APCOA Parking (UK) Limited by way of application at:https://sertaxi.apcoa.co.uk/. APCOA police the taxi ranks and check that the driver is displaying thepermit issued to their vehicle. These measures are not recorded anywhere… the terms and conditions, copied by the Complainant on a number of occasions, in his request clearly state that an applicant can only hold 1 permit, allocated to a specific vehicle (https://sertaxi.co.uk/)’. And ‘Question 9 – No permit holder have been found to have breached the terms and conditions. To theextent such a breach occurred, it would be discussed at contract review meetings. Both APCOAParking (UK) Limited and SETL’s Contract Manager (responsible for managing the contractualrelationship) confirm this information is not recorded and a breach has not occurred.. Question 9 – Description of enforcement action taken by SE Trains and/or APCOA Parking (UK) Limited against any permit holder individual or entity found to have contravened any prohibition on the hoarding and/or transfer of permits by sale, rental or otherwise for permits: (a) issued by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/; (b) issued outside of the permit system operated by APCOA Parking (UK) Limited at: https://sertaxi.apoa.co.uk. Any enforcement action would be discussed at contract meetings held between the contract manager and APCOA. Both have confirmed that no such action has been taken’.

And

[83]In its most recent submissions, SETL maintains that:
‘[Part 5…] does not contain a request for recorded information, it asks a question. However SETL can confirm outside of FOIA that permits are non-transferable and that a person is only entitled to hold one permit, so that if by “hoarding” the Appellant means holding more than one permit, that is not allowed. The position is confirmed in paragraph 1 of the ‘Conduct and General Terms’ section of the permit Terms of Conditions, appended to this response…. [Part 7…] SETL is aware that APCOA monitors the taxi ranks and checks that the driver is displaying the permit issued to their vehicle. However, the fact that this is done was not recorded anywhere at the date of the Request. Nor is any other information about how APCOA enforces any aspect of the permit system. Accordingly, there is no recorded information within the scope of Part 7… [Part 9…] for the reasons given in response to Parts 4, 7 and 8 there is no information in scope of Part 9’
. Is part 5 a valid request?[84]The Appellant states that he made a valid request. SETL disputes this.[85]The request was ‘Confirmation as to whether holders of permits issued by APCOA Parking (UK) Limited by way of application at: https://sertaxi.apcoa.co.uk/ are permitted to hoard and/or transfer issued permits by sale, rental or otherwise.[86]We accept that this was a valid request for information. Although the request used the word ‘confirmation’, we conclude that it was a request for recorded information ‘confirming’ whether holders of permits are permitted to hoard or transfer permits. Did SETL hold any relevant recorded information within scope at the time of the request?[87]We agree that SETL held relevant recorded information within scope at the time of the hearing.[88]The Appellant was referred to the Terms and Conditions which state 1 permit per driver.[89]Further, as SETL has set out above, these questions were answered at points 12 and 13 of the 24 January 2023 response. This stated:
‘12. The number of single individuals and entities issued with permits for 2 or more hackney carriages in each year since the commencement of the permit system. We hold information for the current year. Sevenoaks - 0 13. The maximum number of concurrent permits (for 2 or more hackney carriages) held by a single individual or entity in each year since the commencement of the permit system. We hold information for the current year. Sevenoaks – 0’
[90]To the extent that information was held, it was provided. Is part 7 a valid request?[91]There has been no suggestion by any party that part 7 was not a valid request. We accept that it was. Did SETL hold any relevant recorded information within scope at the time of the request?[92]SETL maintain that there was no recorded information at the date of the request. The Appellant does not address why we should not accept this position (other than the general points made previously (eg relating to the Equality Act/service agreement etc) which have been addressed above).[93]We note that the Appellant stated in its submissions (dated 30th January 2024):
‘If SETL and/or APCOA takes measures…on the hoarding and/or transfer, rental and/or sale of permits issued via Other Channels, then SETL is obligated to explicitly state so, and provide details of all measures taken. … If SETL takes measures to enforce any prohibition and/or restriction(s) on the hoarding and/or transfer, rental and/or sale of permits issued via the online portal, then SETL is obligated to explicitly state so, and provide details of the measures Taken’
. They have now done so. The Appellant has the information it requested (bearing in mind that there is no recorded information). Is part 9 a valid request?[94]There has been no suggestion by any party that part 9 was not a valid request. We accept that it was. Did SETL hold any relevant recorded information within scope at the time of the request?[95]SETL maintain that there was no recorded information at the date of the request. The Appellant does not address why we should not accept this position (other than the general points made previously which have been addressed above).[96]Again we note that the Appellant stated in its submissions (dated 30th January 2024) ‘If SETL and/or APCOA took no enforcement action (pursuant to contract, the Railway Byelaws or otherwise) against holders of permits issued via the online portal or via Other Channels respectively, whom were found to have contravened any prohibition on the hoarding and/or transfer of permits by sale, rental or otherwise for permits, then SETL is obligated to explicitly state so’. They have now done so. The Appellant has been provided with the information they requested, to the extent possible (keeping in mind that there is no recorded information). Addressing other points raised by the Appellant[97]The Appellant has raised many points in its submissions. To the extent that they are relevant, we have addressed these below.[98]At paragraph 26 of the Appellant’s response, they assert: ‘Notwithstanding the above, whilst at paragraphs 14 to 17 of its Response, R2 focussed on the Portal and its purported inability to distinguish between new and existing permit applicants, R2 failed to address records which may hold or ought to hold outside of the Portal, whether electronically (by email for example) or manually’.[99]It is unclear what is meant by this submission. The Appellant has only challenged Parts 3, 5, 7 and 9 in this appeal. These requests do not address this issue.[100]We note for completeness that SETL confirmed in their letter dated 15th August 2023 that questions 6 and 8 (which ask about permits issued outside of the permit system) refer to a non-existent system of permit use’.[101]They also confirmed ‘5. If searches included electronic data, which search terms were used and please explain whether the search included information held locally on personal computers used by key officials (including laptop computers) and on networked resources and emails. Where the information requested doesn’t exist and therefore not held, no searches have been carried out’.[102]What SETL ‘ought’ to hold outside of the portal is not an issue for the Tribunal. We are dealing with FOIA which solely considers recorded information.[103]At paragraph 30 of the Appellant’s response, they assert: ‘R2’s Response fails to address Station rank camera monitoring data obtained through its surveillance systems such as CCTV, ANPR or body worn cameras, and retained by R2 and/or APCOA (Exhibits 12 and 13). Such surveillance data would enable R2 to identify permit holders over the years, through observations of vehicles plying for hire on the Station rank. According to R2’s and APCOA’s respective privacy policies, R2’s and/or APCOA’s surveillance footage is respectively retained by both parties for 6 years’.[104]The requests did not ask for disclosure of this information. It may well be that information could be generated from this information; however SETL is under no obligation to generate new information. FOIA permits access to information which exists in a recorded form. It does not extend to the creation of new material.[105]At paragraph 32, the Appellant states “R2’s Response fails to explain how it is able to objectively affirm the number of permits issued in 2021 and 2022; how R2 knows of level of the cap on the number of permits issued in 2021 and 2022; and/or whether or not the cap was reached in 2021 and 2022 respectively. Similarly, in the purported absence of permit data beyond the expiry date and prior to the commencement date of permits, it is similarly unclear how R2 is able to objectively and positively affirm that there are no other ways to obtain a permit than through the online Portal; and/or that existing permit holders are not prioritised over new permit applicants’. Again we reemphasise that SETL was not required to ‘explain’ answers. It was obliged to provide recorded information. It explained that there was no recorded information. There is no obligation to go further (albeit they have chosen to provide information over and above, outside of FOIA). It is unclear which of the disputed grounds, the Appellant states this is relevant to. The Tribunal is only considering those limited number of issues. SETL clearly explained that permits are only issued via the portal.[106]The Appellant states in its letter dated 28 April 2025 under the heading “Principle disputed facts” that: ‘3. The principal factual disputes include (non-exhaustively):[107]First of all, what ‘ought’ to be the case, is not an issue for the Tribunal. We have no jurisdiction to consider this, and we do not do so.[108]Secondly, the question ‘what length of time is permit data retained by the data controller and its data processor’ was not asked. SETL was only required to provide recorded information in response to the requests specified. We accept that it did so. All the requests were answered, and SETL went further to answer questions outside of FOIA which it was not required to do.[109]We make no finding in relation to whether SETL would be in breach of its obligations. That is not a matter for this tribunal. It is not for this Tribunal to make findings in relation to how it should have acted. If they don’t have the information – which we find they do not – that is the end of the matter for this Tribunal. Even if the data controller should be doing something different – that is not a matter for us. Whether the ICO should have considered this more thoroughly, is again, not a matter for us.[110]SETL does not need to prove beyond reasonable doubt that it does not hold the information in question. It needs to demonstrate that it has carried out reasonable searches to identify all the relevant information that it holds. In this case, extensive searches were not required. SETL’s position is simple: their systems do not retain the information requested in the manner requested. As such there is no recorded information. We accept this. The searches were limited but appropriate. This is not a case where the adequacy of the searches carried out is in question. The ICO makes a decision based on the balance of probabilities (i.e. more likely than not). We agree with that decision.[111]FOIA only applies to information that a public authority already holds in recorded form at the time of the request. If SETL do not hold the specific information requested, they do not have to create it i.e. if SETL do not have a record of existing permit holders and new applicants, it is not required to create this information. We note that SETL stated that the portal system does not distinguish between existing permit holders and new applicants – not that it did not hold any information on permit holders at all. In their email dated 22 August 2023, they state: ‘…we are able to confirm the total number of permits that are issued, we are unable to confirm if these permits are being issued to new or existing permit holders. The online portal system is very simple and automatically overrides old information when a new permit is issued…. In order to confirm if the permit issued in the 2022 cohort were to new or existing permit holders, we would need the 2021 data and as mentioned above, we do not have the data for 2021 to be able to determine if the permits were issued to new or existing permit holders, as the system automatically deletes the data when a new permit is issued.[112]The Appellant states in their letter dated 28 April 2025 under the heading “Principle disputed facts” that ‘3. The principal factual disputes include (non-exhaustively)… (b) Whether or not R2 prioritises the permit applications of existing permit holders over the applications of non-permit holders. R2 asserts that it holds no records that answers the question. Yet in contradiction, it simultaneously asserts ‘outside of the FOIA” that no priority is given to permit applications by existing permit holders. The Appellant asserts that, on the balance of probabilities, priority is given to applications by existing permit holders.[113]We have not concluded that SETL has contradicted itself. The fact that no recorded information is held is not inconsistent with the assertion that no priority is given to permit applications by existing permit holders. Indeed, as they assert, this information is not held because there is no distinction between the two. We accept on the balance of probabilities that no information is held. Were SETL correct to rely upon section 40(2) in relation to parts 12 and 13.[114]According to s.40(2) FOIA, information is exempt from disclosure if it is personal data of an individual other than the requester, where one of the conditions listed in section 40(3A)(3B) or 40 (4A) is satisfied.[115]The ICO asserts section 40(3A)(a) is applicable. We agree. The Appellant does not suggest otherwise. Is the withheld information personal data as defined by the Data Protection Act?[116]Personal data is defined in Section 3(2) of the DPA (‘any information relating to an identified or identifiable living individual’).[117]The ICO found that: ’28. An identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.29. Information will relate to a person if it about them, linked to them, has biographical significant for them, is used to inform decisions affecting them or has them as its main focus.30. In the circumstances of this case, having considered the information sought by parts 12, 13, and 16 of the request, the Commissioner is satisfied that name, addresses, vehicle plate numbers and driver badge numbers all clearly relate to and could be used to identify those concerned. This information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA’.[118]We agree with this entirely. It does not seem that the Appellant disputes this.[119]In its letter dated 10 May 2023, the Appellant submits that the requested information does not qualify as exempt personal data under section 40(2) of the Freedom of Information Act 2000 because:a. Disclosure is justified: the public interest in transparency outweighs the employee(s) privacy rights. Employees managing relevant policies should reasonably expect disclosure, especially given their accountability for decisions and public funds.b. Under the Equality Act 2010, employees can be personally liable for contraventions (sections 110–112), regardless of employer liability. Non-disclosure could undermine enforcement of the Act.c. ICO guidance confirms that senior public authority employees should expect greater disclosure due to their responsibility for major policy decisions and expenditure. Government policy promotes transparency, influencing reasonable expectations. Even if disclosure causes distress, it may still be warranted if proportionate and in the public interest.[120]The next stage of the test is to decide whether disclosure would contravene any of the Data Protection principles. Would disclosure breach any of the DP principles?[121]The ICO found that the most relevant DP principle in this case is principle (a) which states ‘Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject’.[122]In order to be lawful, the ICO considers that the most applicable is 6(1)(f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’. Again, we agree, and the Appellant does not suggest otherwise.[123]It is necessary to consider the following 3-part test: i) Legitimate Interest Test: whether a legitimate interest is being pursued in the request for information. ii) Necessity Test: whether disclosure of the information is necessary to meet the legitimate interest in question. iii) Balancing Test: whether the above legitimate interests override the interests or fundamental rights and freedoms of the data subject. Legitimate Interest Test[124]The ICO states ’41. Whilst neither SETL nor the complainant put forward any specific legitimate interests in the disclosure of the information at parts 12, 13 and 16 in this case, the Commissioner accepts that there may be a general, albeit narrow, interest in the processes surrounding the issuing and management of taxi rank permits’.[125]We agree that there is a general, narrow interest in the processes being considered. The case concerns the operation of a taxi-rank permit system at one train station. We accept that there is a general public interest in transparency and accountability of public authorities, including assurance that policies are administered lawfully and the proper use of public funds. Necessity Test[126]We find that full identification of individual employees is not necessary to meet that interest. We agree with the ICO that the test of necessity had not been met because:a. The narrow general interest in the processes surrounding the issuing and management of taxi rank permits has already been met by the information provided by SETL in multiple correspondences to the Appellant, along with information in the Terms and Conditions on APCOA’s website. Therefore, it is not a necessary or proportionate to disclose the personal information of either its staff or those individuals in possession of a taxi rank permit to the world at large;b. Their personal details will not aid those seeking to understand the process by which permits may be issued. Nor will it provide further clarification or understanding of the management of existing permits.[127]Even if necessity were established, we find that the balance favours non-disclosurefor the following reasons:a. Reasonable Expectations: The employees may not reasonably expect disclosure of their names linked to specific contentious matters, complaints, or potential contraventions, particularly where the request goes beyond already-published senior leadership information;b. Role and Seniority: While senior decision-makers have a greater expectation of scrutiny, seniority is not determinative. The question is reasonableness in context. Where identification would expose individuals to targeted criticism, harassment, or reputational harm detached from due process, expectations against disclosure are reasonable—even for senior staff—unless a clear and compelling necessity is shown.c. Proportionality: The public interest in the processes has already been met by the information provided. The marginal additional value of naming individuals does not outweigh the interference with their rights and freedoms.[128]For the reasons set out above, we find disclosure is not necessary under s.40(2).[129]For completeness, the Tribunal observes that, notwithstanding the fact that its reasoning for dismissing the appeal departs in certain respects from that adopted by the ICO—principally by reason of material provided by the Second Respondent which was not before the ICO—the conclusions set out in the Decision Notice nonetheless represent the proper and legally correct disposal of the appeal. Signed Date: Judge Kiai 12th January 2026