APG v Information Commissioner & The Ministry of Defence [2011] UKUT 153 (AAC)

UKUT-AAC

APG v Information Commissioner & The Ministry of Defence

[2011] UKUT 153 (AAC) · 2011-04-15

[1]The All Party Parliamentary Group on Extraordinary Rendition (APG) is a cross party group of MPs and peers established in December 2005 for the purpose of examining allegations of the UK’s involvement in extraordinary rendition and related issues. The chairman of the group is Mr Andrew Tyrie MP. Mr Tyrie and the APG are concerned to get to the truth on Britain’s involvement in extraordinary rendition (the extra-judicial transfer of a detained person, usually across state boundaries or between different authorities within them) and to do what it can to ensure the lawfulness of governmental actions.

[2]In the early part of 2008 following an earlier answer to a Parliamentary question a sequence of letters was written by Mr Tyrie to the Secretary of State for Defence and it was these letters that subsequently formed the basis of applications for information under the Freedom of Information Act 2000 (“FOIA”) and complaints to the Information Commissioner. The subject matter of the requests can for present purposes be described under four topics that will be considered in turn: i) Information relating to memoranda of understanding (MOU) between the United Kingdom and the Governments of Iraq, Afghanistan and the United States of America in respect to the treatment of persons detained in the conflicts in Iraq and Afghanistan. ii) A copy of the Detention Practices Review. iii) A request for the policy on capture and joint transfer. iv) Statistics on Detainees held in Iraq and Afghanistan.

[3]In due course between June and September 2008 the Ministry of Defence (MOD) refused to supply the information requested; and the APG asked for an internal review of the decisions made in respect of each request. The internal review was completed on the 27 February 2009. In that review the MOD for the first time raised Section 12 of the Freedom of Information Act by way of response to the request in respect of the first and third of these requests.

[4]APG was dissatisfied by this response and made a complaint to the Information Commissioner who on 15 June 2010 decided in favour of the MOD on requests 1, 2, 3 and substantial parts of 4, and in favour of APG in respect of a part of the fourth request. APG appealed to the First Tier Tribunal in respect of the Commissioner’s decisions with which they were dissatisfied and the MOD appealed in respect of the part of the fourth decision of the Commissioner.

[5]These appeals have been heard together and with the agreement of the parties were transferred to the Upper Tribunal having regard to the complexity, sensitivity and public importance of the issues involved in the case.

[6]We are grateful for the considerable assistance received from all three legal teams in this case by way of skeleton arguments, oral and supplementary written submissions.

[7]We also received unchallenged witness evidence from Mr Andrew Tyrie MP, Mr Ian Cobain, and Mr Daniel Carey, which we found of assistance.

[8]The subject matter of the requests is recognised by all to be one of profound public importance: whether and how the armed forces of our nation have complied with their legal obligations relating to the treatment of those detained in the course of operations in Iraq and Afghanistan, particularly when such persons are transferred to the custody of other sovereign powers. The subject matter has been the subject of a number of notable decisions of the courts in the United Kingdom and Strasbourg, in particular: R (on the application of Mohamed v Secretary of State for Foreign and Commonwealth Affairs

[2010] EWCA Civ 65

and 158 [2011]QB 218; R on the application of Al-Saadoon V Secretary of State for Defence

[2008] EWHC 3098

Admin ; Al Saadoon v United Kingdom, Case 61498/08

(2010) 51 EHRR 9

; R (on the application of Evans v Secretary of State for Defence)

[2010] EWHC 1445 (Admin)

[2011] ACD 11 . A number of these cases were progressing at the same time as APG made its requests and have led to material being placed in the public domain that had not previously been.

[9]We recognise, however, that:- i) The present appeals concern requests by APG as concerned citizens rather than as MPs or as persons entitled to information on confidential Privy Councillor terms. ii) The duty to disclose is to be judged by the framework of FOIA as opposed to the different duties that may arise in litigation, where a judicial assessment of relevance to the litigation may in certain cases override an otherwise legitimate claim to public interest immunity. iii) The relevant date for assessing the existence or scope of the duty is the time when the request was dealt with rather than the date of the Commissioner’s decision under appeal (see FOIA s.50(1) and Campaign Against the Arms Trade v Information Commissioner and Ministry of Defence EA/2006/0040 (26 August 2008) at [53]). The Legislative Scheme

[10]Section 1 of FOIA provides that:

“(1) Any person making a request to a public authority is entitled - a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and b) if that is the case, to have that information communicated to him. (2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”

Subsections 1(3) to (6) are not material to the present issues. Section 10 requires the public authority to comply with the s.1(1) duty promptly and in any event within 20 days, with a power afforded by s.10(4) for the Secretary of State to extend this period by regulations to a maximum of 60 days.

[11]Section 12 provides:

“(1) Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit. (2) Subsection (1) does not exempt the public authority from its obligation to comply with paragraph (a) of section 1(1) unless the estimated cost of complying with that paragraph alone would exceed the appropriate limit. (3) In subsections (1) and (2) ”the appropriate limit” means such amount as may be prescribed, and different amounts may be prescribed in relation to different cases. (4) The Secretary of State may by regulations provide that, in such circumstances as may be prescribed, where two or more requests for information are made to a public authority- (a) by one person, or (b) by different persons who appear to the public authority to be acting in concert or in pursuance of a campaign, the estimated cost of complying with any of the requests is to be taken to be the estimated total cost of complying with all of them.”

[12]By Section 13 of FOIA a public authority may charge for the communication of information whose communication is not required by Section 1(1) because the cost of complying with the request for information exceeds the amount which is the appropriate limit for the purposes of Section 12(1) and (2) (see also s.9). Section 17(1) requires that a public authority that is relying on a Part II exemption must give a notice that states that fact, specifies the exemption in question, and states (if not otherwise apparent) why the exemption applies. Section 17(5) provides “a public authority, which in relation to any request for information, is relying on a claim that section 12 or 14 applies must, within the time for complying with section 1(1), give the applicant a notice stating that fact.”

[13]The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 SI 2004 No 3244 are the regulations dealing with the appropriate limit and related matters. By reference to Regulation 3 and Regulation 4(4), the appropriate limit in the present case is £600 calculated at an hourly rate of £25 per person per hour.

[14]Regulation 4 is in the following terms:

“(1) This regulation has effect in any case in which a public authority proposes to estimate whether the cost of complying with a relevant request would exceed the appropriate limit. ….. (3) In a case in which this regulation has effect, a public authority may, for the purpose of its estimate, take account only of the costs it reasonably expects to incur in relation to the request in- (a) determining whether it holds the information, (b) locating the information, or a document which may contain the information, (c) retrieving the information, or a document which may contain the information, and (d) extracting the information from a document containing it.”

[15]Regulation 5(1) provides for aggregation of costs where two or more requests are made by one person or by different persons who appear to the public authority to be acting in concert or in pursuit of a campaign. Aggregation takes place in the circumstances set out in Regulation 5(2) namely:

“(a) the two or more requests referred to in paragraph (1) relate, to any extent, to the same or similar information, and (b) those requests are received by the public authority within any period of sixty consecutive working days.”

Request 1: Information relating to the Memoranda of Understanding

[16]On 31 January 2008 the Secretary of State for Defence wrote to Mr Tyrie following a Parliamentary question that he had asked the previous December on whether any individual detained by UK Forces in Iraq or Afghanistan had subsequently been held at the United States Detention Facility at Guantanamo Bay. He said as follows: “Whenever we have passed an individual from UK jurisdiction into the jurisdiction of the Iraqi, Afghan or US authorities, we have had in place an understanding that they would not transfer that individual to a third country without first seeking our consent or at least informing us of their intention. I have every confidence in our allies that they have and will continue to honour these understandings and we have no evidence to suggest that they have ever done otherwise”.

[17]On 6 February 2008 Mr Tyrie wrote in response requesting (among other things) a copy of all documents relating to the understanding referred to in the Minister’s letter.

[18]On 19 March 2008 the Minister responded by indicating that there were written agreements with the governments of Iraq and Afghanistan. The agreement relating to Afghanistan was disclosed but the Iraqi agreement was withheld as the Iraqi government had asked for confidentiality. Much later in the process it was discovered that the Iraq agreement had been placed in the public domain and it was disclosed. In respect of the US the letter stated as follows: “Work continues to review UK and US records and those US records to which we have access and I will let you know when this further work is complete. This understanding has been documented in various ways at different times including in an MOU put in place in 2003 and the draft of a replacement MOU we are working to conclude ; and in statements in UN Security Council Resolutions. It is backed up by assurances offered by senior US Commanders; by continuing access to US detention facilities; and by access to records”. (our emphasis)

[19]On 21 April 2008 Mr Tyrie responded to this letter repeating the requests for information that he had made on 6 February but now summarising the MOU request as:

“All information relating to the ‘understanding’ between UK, Iraqi, Afghan, and US authorities referred to in your letter of 31 January 2008 and set out in my letter of 6 February 2008.”

He asked for an internal review of the previous refusal. By way of representations he added:

“You appear to have rejected my request for all information relating to the ‘understanding’ between UK and Iraqi authorities- which you imply takes the form of a single written agreement- because “they have asked us not to put this document in the public domain”

. This is not a valid reason for non-disclosure of the understanding, or related information, under the Freedom of Information Act. It may be that this is intended to refer to s. 27 of the Freedom of Information Act, regarding international relations. As you will be aware, this exemption is qualified and you make no reference to having considered the public interest in disclosure. There is clearly a significant public interest in disclosure in this particular case. You appear to have accepted, at least in part, my request for all information relating to the ‘understanding’ between UK and Afghan authorities, by attaching a copy of the written agreement with the Afghanistan government on this issue. You imply, but do not state, that this information is contained exclusively in this written agreement. Is all information relating to the ‘understanding’ between UK and Afghan authorities contained in this agreement? You appear not to have considered my request for all information relating to the ‘understanding’ between the UK and US authorities, simply stating that “this understanding has been documented in various ways at different times” and providing a number of examples without disclosing the information contained in these documents nor outlining if or why it was being withheld. Having confirmed the existence of this information, I would be grateful if you would now disclose it”. The letter concluded with a repetition of the request for an internal review that should be undertaken promptly.

[20]On 7 July 2008 the Secretary of State responded in respect of this head of request:

“In your second letter you also request all information relating to the understandings between the UK, Iraq, Afghanistan and the US and make a series of points regarding the amount of information provided in relation to your initial request. Having reconsidered the information in light of the exemption at Section 27(1), I must inform you that the information we have provided to date is as much we judge we are required to release under the FOIA, and indeed as much as we can release without jeopardising our other obligations, which it is equally in the public interest that we meet. Sections 27(1) is (sic) qualified exemption and in reaching the conclusion not to release the information we have taken into account the public interest in disclosing the information, which is set out below. With regard to the understanding with Iraq, the Iraqi authorities have requested that the written agreement is not put into the public domain. Whilst this in itself is not a valid reason to claim an exemption under the FOIA, I have concluded that the best interest of the UK and the UK Armed Forces lays in a close and trusting relationship with our Iraqi counterparts. The publication of the understanding would undermine our bilateral relationship with Iraq and would put at risk ongoing operations. The exemption is being claimed regarding publication of the understanding and other information regarding our understanding with Iraq as disclosure of this information would also undermine the relationship. Whilst I acknowledge that there is inevitably a public interest in this information, and that there are genuine arguments for the public interest being served by the promulgation of a better understanding of the UK’s bilateral relations, as well as the concomitant benefits of promoting greater transparency and accountability, I have come to the conclusion that the balance of public interest lies in favour of withholding this information from the public domain. With regard to the document sent to you detailing the agreement between the Governments of the UK and Afghanistan, you ask if this document contains all information relating to the understanding. In answer to that question I can confirm that there is other information held by the MOD relating to the relationship between the UK and Afghanistan . As per the case for Iraq I am claiming an exemption for this additional information under section 27(1) (International Relations). ... With regard to the situation regarding the relationship between the UK and the US, it goes without saying that the UK sees its bilateral relationship with the US as its most vital relationship. The US is a key ally of the UK and our national and defence interests are linked on a multitude of levels. The Ministry of Defence holds numerous documents relating to our relationship with the US but after consideration I feel that the arguments regarding the maintenance of our relationship with the US outweigh the public interest arguments for release of this type of information, as set out above with regard to the Iraq agreement.”

(emphasis supplied)

[21]The letter concludes by inviting an informal resolution and if informal resolution is not possible independent internal review, and pointing out rights of appeal to the Information Commissioner thereafter.

[22]An internal review was requested on 29 August 2008 and a number of responses were given to the separate requests on the 27 February 2009. The response to the request relating to this head was in the following terms:

“12. Although some information was provided to you in response to this request, I have found that a full search for “all documents” was not conducted due to the fact that your original request was framed so broadly that it would be impossible to complete the work within the £600 cost limit permitted by section 12 of the Act. It is also the case that the Act gives entitlement to information rather than documents specifically and I note you were not advised of these facts at the time. In recognition of this failure to observe the proper process, and if you are able to reduce or refine your request, for instance by requesting just the actual Memoranda of Understanding that exist between the UK and Iraq, and the UK and the US, to bring the cost of compliance under the limit, MOD is willing to undertake a further search. However, under section 16(1) of the Act which requires public authorities to provide advice and assistance to requesters I think it only fair to advise you that this may prove to be a technical remedy since, on the basis of the information that has been identified so far, even if located through a further search it seems unlikely that any of the relevant information could be placed in the public domain by virtue of the Freedom of Information legislation. Nevertheless, if you wish us to proceed on this basis please write to me again and I shall treat this as a new request for information.”

[23]Thus more than a year after the original request for all documents (later expanded to all information) relating to the understanding with the US, APG was invited to start out all over again because for the first time the s.12 cost limit has been raised, and the answer is given that despite the context of the Ministerial correspondence no search has been done for all documents or all information as it would be cost prohibitive. It is also of significance that the Minister’s letter in July 2008 referred to documents relating to the relationship with the US whereas the request was for information relating to the understanding about treatment of detainees. Other Materials relevant to request 1

[24]A Code of Practice on the discharge of public authorities’ functions under Part 1 of the Act was issued by the Secretary of State for Constitutional Affairs pursuant to FOIA section 45 in November 2004. The material parts of the Code are as follows:

“8. A request for information must adequately specify and describe the information sought by the applicant. Public authorities are entitled to ask for more detail, if needed, to enable them to identify and locate the information sought. Authorities should, as far as reasonably practicable, provide assistance to the applicant to enable him or her to describe more clearly the information requested. 9. Authorities should be aware that the aim of providing assistance is to clarify the nature of the information sought, not to determine the aims or motivation of the applicant… Public authorities should be prepared to explain to the applicant why they are asking for more information. It is important that the applicant is contacted as soon as possible, preferably by telephone, fax or e-mail, where more information is needed to clarify what is sought. 10. Appropriate assistance in this instance might include: · providing an outline of the different kinds of information which might meet the terms of the request; · providing access to detailed catalogues and indexes, where these are available, to help the applicant to ascertain the nature and extent of the information held by the authority; · providing a general response setting out options for further information which could be provided on request. This list is not exhaustive, and most public authorities should be flexible in offering advice and assistance most appropriate to the circumstances of the applicant. ….. 12. If, following the provision of such assistance, the applicant still fails to describe the information requested in a way which would enable the authority to identify and locate it, the authority is not expected to seek further clarification. The authority should disclose any information relating to the application which has been successfully identified and found for which it does not propose to claim an exemption. It should also explain to the applicant why it cannot take the request any further and provide details of the authority’s complaints procedure.... ..... 14. Where an authority is not obliged to comply with a request for information because, under section 12(1) and regulations made under section 12, the cost of complying will exceed the “appropriate limit” (i.e. cost threshold) the authority should consider providing an indication of what, if any, information could be provided within the cost ceiling. ... ..... 36. Each public authority should have a procedure in place for dealing with complaints both (sic) in relation to its handling of requests for information. The same procedure could also usefully handle complaints in relation to the authority’s publication scheme. If the complaints cannot be dealt with swiftly and satisfactorily on an informal basis, the public authority should inform persons if approached by them of the details of its internal complaints procedure, and how to contact the Information Commissioner, if the complainant wishes to write to him about the matter. ..... 39. The complaints procedure should provide a fair and thorough review of handling issues and of decisions taken pursuant to the Act, including decisions taken about where the public interest lies in respect of exempt information. It should enable a fresh decision to be taken on a reconsideration of all the factors relevant to the issue. Complaints procedures should be as clear and simple as possible. They should encourage a prompt determination of the complaint.”

[25]The MOD publishes its own internal Guidance Notes. Guidance Note D8 Version 6, June 2009, states:- “ Outline of how to handle requests for information 1. Within MOD we deal with requests for information everyday. The FOI Act seeks to ensure that public authorities are following the principles of open government by mandating in law certain standards. 1.1 The basic process for handling requests can be broken down into a number of simple steps. How these steps will be carried out will vary on a case-by-case basis. The process is outlined below: · Identify that a request has been received and clarify its meaning. If necessary engage with the requestor from an early stage either by e-mail or telephone. Provide applicants with as much help as possible to obtain the information that they want · Transfer the request to the correct part of MOD · Identify the correct handling process · Find the information requested, or establish that it is not held · If it is an FOI request try to reduce the scope of broad requests to information that can be provided within the appropriate limit (for FOI this cost limit is set for central government at £600.00). · Create the response · If any information is to be withheld using an FOI exemption it must be authorised at 1* · Keep a copy of the request and any information released, along with any associated documentation… · Remember that you are responding on behalf of the department and must consult with other areas as necessary.”

[26]In the case of Urmenyi v Information Commissioner and London Borough of Sutton EA/2006/0093, (13 July 2007) the Information Tribunal observed (rightly in our view) at [16]: “It is clear from the wording of section 12 that it is for the Council to estimate whether the appropriate limit would be exceeded. The estimation is for the public authority to take based on the estimates of the times for the individual activities allowed to be included by the Regulation 4. The Commissioner and the Tribunal can enquire into whether the facts or assumptions underlying this estimation exist and have been taken into account by the public authority. The Commissioner and Tribunal can also enquire about whether the estimation has been made upon other facts or assumptions which ought not to have been taken into account. Furthermore, the public authority’s expectation of the time it would take to carry out the activities set out in Regulation 4(3) a-d must be reasonable.” (Our emphasis)

[27]In Roberts v Information Commissioner EA/2008/0050, 4 December 2008 the Information Tribunal concluded at [9] and [10] that only the activities covered by regulation 4(3) can form part of the reasonable estimate and those activities do not include consideration of exemptions and redaction. Further it is not sufficient for the authority to simply assert that the appropriate limit has been exceeded; the estimate has to be “sensible, realistic and supported by cogent evidence”. We agree. The evidence of Ms De Bourcier

[28]Katherine de Bourcier is head of corporate information at the Ministry of Defence and was responsible for the revised decisions made at the conclusion of the internal review. In November 2009 someone in her department had supplied the Commissioner with a schedule of the cost estimates that had led to the claims of the s.12 exemption (see [23] above) being upheld in substance We had a witness statement from her and she was cross-examined on behalf of APG and on behalf of the Commissioner.

[29]The substance of her evidence relating to the cost estimate on this request is set out in paragraphs 10 and 11 of her witness statement. There were seven main areas within the MOD likely to hold relevant information concerning the understandings in the form of paper records, electronic records and emails: Operations Directorate (at the time split into two departments), Legal Services, British Defence staff, Ministers’ Offices, and Policy Defence Relations North and South. Even focusing on the US material alone and excluding (as the Commissioner had determined should be the case), the seven hours per area to confirm if any relevant material was held, as a minimum 2 hours per area was required to locate it, 3 hours to retrieve it and 1 hour to read it through. That would give 42 hours’ relevant work, substantially over the cost limit. None of this work had been done yet and so no substantive claims to exemptions could be made although they would be likely to arise.

[30]In cross-examination it transpired that she was reliant on what she had been told by the lead department, the Operations Directorate, for the number of areas that may need to be searched and what might be found there; she was not aware whether the core documents were held by the Operations Directorate itself and what may have already been gathered together for the Minister to be able to answer parliamentary questions and the correspondence noted above and what had already been disclosed in the course of litigation. She indicated that departmental policy was to rely on the s.12 exemption to disclosure if it applied notwithstanding the delays in the case and the incorrect approach communicated in the original decision notices.

[31]It became apparent in her evidence that her team had placed a very wide construction on the request. She said the MOD would have to look for draft versions of the MOUs, internal meeting notes about the development of the documents, and internal correspondence, and that even low level communications which referred to an MOU were potentially in scope, if material and amounting to more than a mere mention. The decision of the Information Commissioner (in Decision Notice FS 50200 146)

[32]The IC accepted as reasonable the relevant parts of the schedule of time estimates supplied to him amounting to £1,050 (paragraphs 21-26 of the decision) and, while he recognised it was unfortunate that s.12 had not been relied on from the outset, concluded that the purpose of internal review was to enable the public authority to fundamentally review its decision and vary its substantive stance (paragraph 16). The submissions of the parties

[33]Mr Hickman for APG submitted:(i) It was too late for the MOD to rely on s.12 at all in response to this request, as FOIA s.17 requires a response to be as soon as possible and in any event within 20 days.

(ii) The Tribunal’s case law suggests that late reliance on an exemption from disclosure should only be permitted where there is reasonable justification for so doing; see Commissioner of Police of the Metropolis v Information Commissioner EA/2010/0006 at [34]; and there was no reasonable justification shown in the present case.

(iii) In any event the cost estimate for the US material alone amounting to 42 hours was not reasonable, given the background to the request summarised in the correspondence exchanges above, and litigation in the public domain relating to the same question.

(iv) The MOD had not provided clear and cogent evidence of why the searches in all the locations were necessary and how long they would take.

(v) Further it was unreasonable in all the circumstances of this case for the MOD to rely on s.12 for the reasons it did, when it did and in the light of the importance of the issues in the case.

[34]The MOD submitted:(i) It was well established that internal review could lead to different or further grounds for exemption and s.12 was an exemption of a similar nature to other substantive exemptions.

(ii) The reasonable justification test, deployed by the Information Commissioner when a new exemption was claimed in the process of the Commissioner’s investigation after internal review had been exhausted, was wrong and too restrictive.

(iii) Reasonableness went only to the total estimated hours and in the light of the breadth of the request the MOD’s response at internal review was evidentially supported and reasonable.

(iv) There was no requirement capable of adjudication in this appeal for the MOD to have behaved reasonably in claiming s.12 in this case. It was a complete answer to the duty if the costs objectively construed would exceed the limit.

[35]The Information Commissioner supported the MOD’s submissions on points (i) (iii) and (iv) but submitted that reasonable justification was the appropriate test when (unlike in this instance) a new reason was relied on for the first time after the internal review. The Commissioner did not accept that the fact similar information was searched for in the case of Evans heard in the Administrative Court in April 2010 was relevant to reasonableness of the estimate, as the search for such materials post dated the date that the MOD dealt with APG’s request in the instant case.

[36]The topic of late exemptions claimed by the public authority either after expiry of the s.17 time limit or after the internal review is a controversial one. The practice of the Information Commissioner in requiring justification before admitting a late exemption has been challenged by the public authority and has been found not to represent the law in the decision in DEFRA v Information Commissioner and Simon BiRkett; and the Home Office v Information Commissioner v and others [2011] UK UT 17 and 39 AAC per Judge Jacobs.

[37]We were aware that this decision was to be promulgated following the conclusion of the oral proceedings before us. We gave directions for supplementary written submissions to be made when the decision was available, and in due course we received submissions from the parties to the effect:(i) from the MOD that the decision was correct, supported its submission and should be followed;

(ii) from the IC that the decision was wrong, not binding and should not be followed;

(iii) from APG that the decision was wrong and in any event distinguishable and did not concern s.12. Discussion

[38]As a result of our conclusions on the various issues it has ultimately proved to be unnecessary for us in deciding this appeal to reach a definitive conclusion on whether the Information Tribunal’s previous practice of requiring reasonable justification for admission of late claims is wrong, as was found to be the case by UT Judge Jacobs in the case of DEFRA . We understand that permission to appeal to the Court of Appeal has been granted in that case.

[39]While the decision in the DEFRA case contains much valuable analysis, we confess to some general concerns that an indefeasible right in the public authority to raise whatever exemption it thought fit whenever it wanted to would raise a number of real problems with the scheme of the Act. The Act contemplates a process of application, reasoned decision within 20 days (or longer in certain cases), internal review, complaint to the Commissioner, and appeal. A willingness to readily admit novel points in late claims may frustrate the statutory policy of prompt response and investigation and the ability of the requester to know where they stand in the statutory processes. Hence one might have thought that late claims should only be permitted where a reasonable justification is shown that is consistent with the statutory purposes, which include the provision of an effective right to information alongside considerations of the public interest and protection of the rights of third parties.

[40]We can see strength in the Commissioner’s submission that access to the statutory process of complaint and appeal is conditioned by exhaustion of internal review procedures, and it would be antithetical to a thorough going review for the public authority to be precluded upon review from putting a revised case for substantive exemption in the way it considered most appropriate if it concluded that its initial decision was flawed in some material way. In the present case considerations of international relations, national security, military efficiency and the activities of designated institutions may all to a greater or lesser extent be engaged. The question of which statutory head is the most appropriate to rely on may be a matter of fine judgment. We agree with the conclusion in Campaign Against the Arms Trade v Information Commissioner (supra) that the complaints process by way of internal review was contemplated in the statutory scheme for response to an application.

[41]At the same time, we note that the time limit for compliance with s.1(1) is expressed in s.10(1) in strong terms (“promptly and in any event not later than the twentieth working day”). Contrary to a common interpretation, the public authority is not given an entitlement to take 20 days to answer the request; the 20 day limit is intended as a long stop. Section 17(1) states that a refusal notice specifying reliance on an exemption “must” be given within the time for compliance. Section 17(5) makes corresponding provision in similar language for reliance on the section 12 cost limit. In a complete analysis of the effect of these provisions we would have expected to see some reference to and application of the principles of construction of statutory time limits set out in Reg. v Secretary of State for the Home Department, ex parte., Jeyeanthan

[2000] 1 WLR 354

, (CA), and in R v Soneji

[2005] UKHL 49

;

[2006] 1 AC 340

. We have seen no indication that these authorities were cited to Judge Jacobs. We have also found helpful in understanding the workings of the statutory scheme the analysis set out in Campaign Against the Arms Trade v Information Commissioner (supra) at [35]-[53] and the remarks of Stanley Burnton J in Office of Government Commerce v Information Commissioner

[2008] EWHC 774 (Admin)

;

[2010] QB 98

at [98].

[42]While the Commissioner has powers to serve enforcement notices under s.52, which can be used to effect an improvement in the performance of authorities who have a generally poor record of compliance with Part I, these powers are by their nature a blunt instrument and are of no comfort to an individual requester whose particular request to a particular authority receives a delayed response. The same can be said of the Commissioner’s power to make recommendations under s.48

[43]We are conscious that there have been cases where the first a requester has known about some entirely fresh point raised by the public authority has been when he has seen it in the Commissioner’s Decision Notice, many months (sometimes years) after the information request was originally made. If novel exemptions can be raised as of right, however late, this seems to turn the time limit provisions of ss.10 and 17 almost into dead letters. It can also create a strong sense of injustice, because the requester will usually not have been given any opportunity by the Commissioner to comment on the new exemption. This can lead to unsatisfactory decisions by the Commissioner and unnecessary appeals (because sometimes the requester has a response to the new exemption which shows that it is not valid). If the raising of a new exemption before the Commissioner is subject to the Commissioner’s discretion, to be exercised fairly and in the light of the statutory purposes, this both restores some meaning to the time limits and avoids the potential unfairness to requesters, since a fair exercise of discretion would normally involve giving the requester the opportunity to comment on the newly claimed exemption before the Commissioner publishes his decision. In other words, if the public authority is being allowed by the Commissioner to add to its s.17 refusal notice even after the internal review, then fairness requires that the requester should be allowed to add to the terms of his complaint under s.50(1).

[44]The Commissioner’s task in s.50(4) is to decide whether the authority has failed to communicate information as required or failed to comply with the requirements of s.11 or s.17. If so, the decision notice must specify the steps which must be taken by the authority for complying with the requirement. A failure to identify an exemption claimed is a failure to comply with s.17 and the question of what steps to direct so as to secure compliance with this statutory duty is for the Commissioner to decide. While the public authority is not acting judicially in responding to an application, it is required to act in accordance with Part I in general and the s.17 duty in particular. Parliament plainly intended that some effective response to non-compliance would be forthcoming, and it does not seem to us that the existence of a discretion in the Commissioner and the Tribunal to enforce the s.17 time limit would result in an unduly low level of protection for the public interest or for third party rights.

[45]Whatever is the correct position in regard to late claiming of the substantive exemptions set out in Part II of the Act, we consider that the s.12 cost exemption is somewhat different and raises particular considerations of its own; and we note that this was not the kind of claim that was the subject of specific decision by Judge Jacobs in DEFRA . We adopt with the necessary adaptations the approach to statutory construction indicated in Reg. v Home Sec., Ex p. Jeyeanthan (Supra) at 358E-359D, 360C-362F, 366F, and in R v Soneji [2006] (Supra) at paragraphs 14-23.

[46]Section 12 provides a notable derogation from the obligation of communicating information that may otherwise require to be disclosed Although it does not require a public authority to refuse to communicate information on cost grounds it enables it to do so where a reasonable estimate is made that the cost of obtaining the information would exceed the prescribed limit. We accept that where it is fully and fairly engaged it is just as much a defence to the s.1 duty as Part II exemptions would be, but whereas a substantive exemption under Part II would (where justified) definitively prevent disclosure, a s.12 exemption may result in no more than a period of delay while an imprecise request is clarified, or sequential applications made for parts of the available data without exceeding the cost limit. Repeat requests are contemplated by the scheme as long as they not vexatious. Where a cost limit might be exceeded in respect of a single compendious request it may not if the request is broken down into constituent parts.

[47]We conclude that the effect of delay in claiming a s.12 exemption is different from delay in claiming a Part II exemption for the following reasons:- i) The statutory scheme read as a whole, and reinforced by the Code of Practice issued pursuant to s.45, indicates that prompt decision making has particular relevance for cost exemptions where the modest cost limit can yield to repeat requests in 60 day periods for discrete parts of the available material that the request seeks. Here the twelve months’ delay in raising the exemption denied APG the opportunity of using that time to break down its request into five or six distinct phases. ii) The cost exemption only has meaning if the point is taken early on in the process, before substantial costs are incurred in searching for or collating the information. It relates to an estimate of whether future events “would exceed” the limit and not whether past ones have. Thus, if material has been gathered together for some purpose including analysis for substantive exemptions such as international relations, it is no longer open to the authority to claim it. iii) The scheme as a whole suggests that where the request for information is not an abuse or frivolous, dialogue is contemplated between requester and public authority to refine the request to what is realistically available within cost. Only the public authority knows what information it holds, where it holds it, and how an overbroad request can sensibly be broken down into distinct separate chunks. iv) If there is uncertainty about the scope of a request, dialogue about the extent of the request may be able to clarify it and tease out what can be supplied within the cost limit.

[48]Our jurisdiction is to examine whether the notice of the Commissioner’s decision given under s.50 is in accordance with the law or any discretion should have been exercised differently (FOIA s.58). It is not a general judicial review of the exercise of discretion by the MOD. We cannot accept APG’s broadest submission that our function is to examine generally the overall reasonableness of the MOD’s response to this request for information. However the more extended the failure to comply with s.17(4) and the later the s.12 claim the more likely it is that prejudice would be caused to the applicant and the statutory scheme distorted. Decision on request 1

[49]We note the terms of the Ministerial correspondence that led to the request and the evidence before us of Ms De Bourcier. For the reasons set out below we reach the conclusion that the time estimate accepted by the Commissioner was not a reasonable one and the s. 12 exemption is therefore not made out. We further note that there was no early clarification, contrary to the terms and spirit of the relevant Codes of Guidance and Practice.

[50]A significant issue for the present request is whether a very broad or a reasonably focused request for information was being made in respect of the MOUs. The context of the correspondence between the Chair of APG and the Minister suggests that what was sought was to be found in a confined body of documentary material that had been studied and was referred to as the basis of the responses. The implication was that material could in principle be supplied under FOIA but for the international relations issues.

[51]In our judgment, in the context of the preceding correspondence exchange the reasonable understanding of the scope of the request was that it related to information about the nature and terms of the understanding reached with another sovereign state rather than all documents dealing with the preparation or application of the understanding or documents materially referring to it. It seems to us that the Minister’s letter of 19 March 2008 showed a correct appreciation that what APG was concerned with was the nature of the understandings and what the safeguards were that were contained in them, such as access to records and the like. This narrower interpretation is underlined by the comments made in APG’s letter of 21 April 2008, for APG could never have envisaged that (for example) the information relating to the understanding with Afghanistan might be contained in a single document, if the true meaning of the request had extended as widely as was subsequently envisaged by Ms De Bourcier and her team. If there had been any legitimate doubt about the scope of the request seen in context, clarification should have been sought but it was not.

[52]Those who made the time estimate were looking for information of a broader class and so there is no evidence before us of what a realistic time estimate would have been for dealing with a request for information about the nature and terms of the understanding. The information might have been contained in a single document or such a document with subsequent proposals or provisions for continuation or variation and we would be rather surprised if such core materials were not held in a central location whether in the Minister’s Office, the legal directorate or the operations directorate. Given the meaning of the request, properly understood in its context, we cannot accept that it would have been reasonable to search in all documentation being generated in the theatres of operation. Briefly put, if the Minister was able to give public assurance that understandings reached with our allies helped ensure that our armed forces complied with their legal duties, it must have been a far simpler task than Ms De Bourcier’s evidence suggests identifying what those understandings were and the documents that related to them.

[53]This conclusion means the documents that give the terms of the understanding with each of three respective governments, so far as not already disclosed, will need to be assessed (if they have not already been) to see whether a substantive exemption such as s.27 (international relations) applies. International relations

[54]Section 27 FOIA provides as follows:

“(1) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice- (a) relations between the United Kingdom and any other State, (b) relations between the United Kingdom and any international organisation or international court, (c) the interests of the United Kingdom abroad, or (d) the promotion or protection by the United Kingdom of its interests abroad. (2) Information is also exempt information if it is confidential information obtained from a State other than the United Kingdom or from an international organisation or international court. (3) For the purposes of this section, any information obtained from a State, organisation or court is confidential at any time while the terms on which it was obtained require it to be held in confidence or while the circumstances in which it was obtained make it reasonable for the State, organisation or court to expect that it will be so held.”

A s.27 exemption is a qualified exemption and thus subject to the balance in s.2, which reads:- (1) Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either- (a) the provision confers absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply. (2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that- (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

[55]The section 27 qualified exemptions for international relations is claimed not merely for information relating to the MOVs but also for other material before us where we have had to consider whether information contained in all or part of the document ought to be disclosed.

[56]There are essentially two issues: i) would disclosure of the information be likely to prejudice international relations; ii) if so, does the public interest in maintaining the exemption outweigh the public interest in disclosing it. Both matters are for the Tribunal to determine for itself in the light of the evidence. Appropriate weight needs to be attached to evidence from the executive branch of government about the prejudice likely to be caused to particular relations by disclosure of particular information: see Secretary of State for the Home Department v Rehman

[2001] UKHL 47

;

[2003] 1 AC 153

, [50]-[53] and see also R (on the application of Mohamed) v Secretary of State for Foreign and Commonwealth Affairs

[2010] EWCA Civ 65

at [131] per Master of the Rolls:

“In practical terms, the Foreign Secretary has unrestricted access to full and open advice from his experienced advisers, both in the Foreign Office and the intelligence services. He is accordingly far better informed, as well as having far more relevant experience, than any judge, for the purpose of assessing the likely attitude and actions of foreign intelligence services as a result of the publication of the redacted paragraphs, and the consequences of any such actions so far as the prevention of terrorism in this country is concerned.”

[57]In Campaign Against the Arms Trade v Information Commissioner and MOD (Supra) the Tribunal was concerned with defence contracts made between the Governments of the United Kingdom and Saudi Arabia, negotiated in secret and marked confidential. The concern was that those foreign governments would be less willing to impart information to the United Kingdom if they believed that material they understood was to remain secret was put into the public domain. The Tribunal concluded that disclosure would prejudice the relations concerned and that this consideration of the public interest outweighed the public interest in disclosure.

[58]By contrast in R (on the application of Mohamed) v Secretary of State for Foreign and Commonwealth Affairs

[2008] EWHC 2048 (Admin)

;

[2009] 1 WLR 2575

the Divisional Court was concerned with whether information supplied in confidence by a foreign intelligence service could be referred to in an open judgment of the Court having regard to the importance the executive attached to the “control principle” [1] that governed relations between the security services, the Foreign Secretary’s public interest immunity certificate and evidence from senior US officials as to the damage disclosure of that material could cause. The Divisional Court concluded that the information that had been supplied in confidence could be referred to, having regard to the importance of allegations of British security service complicity in ill treatment of detainees abroad at the hands of other governments. The Court of Appeal upheld the Divisional Court. By the time the case reached the Court of Appeal, it transpired that a US court had already made public the substance of the information applying its own constitutional traditions. The Lord Chief

Justice observed at [24]:

“True to our shared traditions the District Court of Columbia made its findings publicly available. The courts in the United States, upholding the principles of open justice, have publicly revealed the essence of Mr Mohamed's complaint and the circumstances of his detention. This provides an important aspect of my examination of the Foreign Secretary's reliance on public interest immunity based on the control principle.”

[59]We very much doubt that the terms of a memorandum of understanding or similar agreement that is designed to ensure compliance with human rights and similar legal obligations in respect of people whose detention is transferred to another state could be perceived as confidential in nature or something the existence of which embarrasses foreign states. Protection of human rights is a fundamental duty of all state parties to the United Nations. As the preamble to the Universal Declaration on Human Rights (1948) observes, such protection, including the right to seek asylum in other countries from persecution, was considered “essential to promote the development of friendly relations between states”.

[60]Practical examples of the public co-existence of friendly relations between states and human rights protections are legion: extradition treaties may make specific reservations for undertakings not to enforce the death penalty that the UK regards as a breach of fundamental human rights while other states may not. The Extradition Act requires courts to assess whether a return to another state may involve a breach of the right to fair trial, even if the return is to a state party to the European Convention on Human Rights itself.

[61]In the context of national security deportation, it has long been established that Memoranda of Understanding or diplomatic communications between States are a potential source of assurance on return or transfer of the individual concerned where the past practice of states gave rise to a concern: see for examples the decisions of the European Court of Human Rights: Chahal v United Kingdom, Case 22414/93

(1996) 23 EHRR 413

at [92] and [105]; Saadi v Italy , Case 37201/063

(2009) 49 EHRR 30

at [51] and [147-148].

[62]United Kingdom law has confirmed that such assurances have to be publicly communicated in open hearing for their efficacy to be assessed. The matter has been recently reviewed by Mitting J as Chair of the Special Immigration Appeals Commission in the case of Naseer v Secretary of State for the Home Department SC/77/09, 18 May 2010:

“35. No open assurances were given by the Pakistani authorities. With our approval Mr Bennathan QC made submissions about the approach which we should in principle adopt to confidential assurances, if given. 36. The issue has arisen before. On 12 July 2006, in an interlocutory judgment in the cases of Y and Othman, a panel of SIAC, presided over by its then President Ouseley J, ruled that closed evidence was admissible to support an open assurance given by a government to the United Kingdom, but, in paragraph 58, observed: ‘Nonetheless, we wish to make one point clear, which emerged more clearly during the substantive appeals. It is our view that the SSHD cannot rely on any substantive assurance unless it is put into the open. It may be the case that encouraging or supportive comments, even if described as assurances by the Government’s interlocutors, should remain in closed if for example they are steps en route to an agreement. But the key documents or conversations relied on to show that an Appellant’s return would not breach the UK’s international obligations or put him at risk of a death sentence or death penalty have to be in the open evidence. SIAC could not put weight on assurances which the giver was not prepared to make public; they would otherwise be deniable, or open to later misunderstanding; the fact of a breach would not be known to the public and the pressure which that might yield would be reduced. They must be available to be tested and recorded.’ Those observations were approved by Lord Philips in RB (Algeria) v SSHD [2009] 2WLR 512 paragraph 102. It is true that Lord Philips’ answer to the question, could SIAC rely on closed material when determining the safety on return issue?, although the same as that of the other members of the appellate committee, was reached by a different route. Mr Bennathan accepts that his observations are not part of the ratio decidendi of the case and are persuasive only. Mr Tam submits that, properly construed, SIAC’s ruling did not prevent reliance on confidential assurances or, if it did, it should be departed from. His construction of the phrase substantive assurance is that it means, and means only, a formal memorandum of understanding or government to government assurance. We do not agree. The fourth sentence of paragraph 58 of SIAC’s judgment makes it clear what it had in mind: the key documents or conversations relied on to show that an appellant’s return would not breach the UK’s international obligations. If the key documents or conversations are not formal government to government assurances, they none the less remain the key documents or conversations, because they are the only assurances upon which reliance can be placed. We also decline Mr Tam‘s invitation to depart from SIAC’s statement of principle. The assessment of the value of assurances is not a matter of law. Nevertheless, SIAC has adopted four yardsticks by which it will ordinarily assess the reliability and value of assurances. They were set out in BB (RB in the appellate courts) and were not criticised indeed they appear to have been accepted by appellate courts. The first and fourth give rise to problems if the assurances are not made public: the terms of the assurances must be such that, if fulfilled, the individual will not be subject to prohibited ill-treatment; and fulfilment of the assurances must be capable of being verified. It is theoretically possible that a written private assurance could satisfy the first requirement, but unless it was written and unequivocal, it would be open to later misunderstanding and would, in any event, be publicly deniable. Verification of a confidential assurance would be problematic and could not provide the protection to an individual which public scrutiny, by the High Commission, by local media, by family and by organisations such as Human Rights Watch and Amnesty International, can provide. For these reasons, we agree with SIAC’s observations in Y and Othman and would not be willing to accept confidential assurances as a sufficient safeguard against prohibited ill-treatment in a state in which otherwise there was a real risk that it would occur.”

[63]In the case of Evans v (Supra) the Divisional Court examined in some detail allegations of torture being perpetrated in Afghanistan and the adequacy of arrangements to protect against it, including the terms of the memorandum of understanding between the British and Afghan authorities. We accept that the decision in Evans post-dated the date that the MOD dealt with the applicant’s request, but the principles of open dealing with such matters were not new and long preceded it. In any event, any future evaluation will be based on the current manifestation of the common law that is always speaking.

[64]Since the maintenance of the rule of law and protection of fundamental rights is known to be a core value of the government of the United Kingdom, it is difficult to see how any responsible government with whom we have friendly relations could take offence at open disclosure of the terms of an agreement or similar practical arrangements to ensure that the law is upheld.

[65]One of the governments in respect of whom APG was seeking information about the terms of the agreement on transfer is the United States of America. By contrast to the secretive nature of the regime in Campaign Against the Arms Trade where the Tribunal noted at [76] that the concept of freedom of information and transparency is alien to the culture, the USA is a constitutional democracy with its own well established traditions of free speech and freedom of information, the very point the Lord Chief Justice was making above.

[66]Unless cogent evidence is adduced to show why a particular government would have strong concerns about disclosure of such information as we are here considering, we would be minded to conclude that no case of prejudice to international relations would be made out. If, on the other hand, there was such a case, then the public interest in disclosing the terms of those arrangements becomes that much more pressing and weighty. It is difficult to see how the Secretary of State for Defence, let alone the general public concerned with the issue, could be assured by assurances with a foreign government that was unwilling to have the terms of such arrangements made open.

[67]For these reasons we rather doubt whether the s.27 exemption can outweigh the public interest in knowing what the terms of the understanding are, but we can reach no concluded decision on the issue in the absence of the information itself and any reasoned submissions on it. Subject to further submissions from counsel when this decision is promulgated we would anticipate reconvening this hearing at a future date to assess the validity of any exemption claimed under s.27. Request 2: Detention Practices review

[68]The second request made by APG on 21 April 2008 was for all information contained in the review of detention practices in Iraq and Afghanistan mentioned in the Secretary of State’s letter of 19 March 2008. The Secretary of State had referred in that letter to allegations made by a Mr Griffin about mistreatment of prisoners handed over to US authorities, and wrote “Because I take such allegations very seriously, I have set in hand a review of detention practices in Iraq and Afghanistan, including an audit of records relating to individuals captured by UK forces and subsequently detained by US forces. This review has been led by a senior British General and I have recently received his report. … I have uncovered no evidence that anyone captured by UK forces and detained by the US forces has been either mistreated or unlawfully rendited. Work continues to review UK and US records and those US records to which we have access and I will let you know when this further work is complete.”

[69]The official response to the information request in respect of the detention practices review was contained in the Secretary of State’s letter of 7 July 2008, which constituted the refusal notice required by FOIA s17. The letter gave a detailed explanation of reliance upon exemptions in ss 23, 26(1), 27(1), 38(1), 40(2) and 42(1), including the application of the public interest test, and attached two pages of extracts from the review, being the remaining text not affected by the exemptions. APG requested internal review of how the information request had been handled. By letter of 27 February 2009 the internal review by the Ministry of Defence substantially adhered to the position set out in the refusal notice, except that s40(2) was no longer relied on.

[70]The Commissioner in his Decision Notice FS 50200 146 rejected the reliance upon s38(1) but otherwise upheld the findings of the internal review. His reasoning in relation to s26(1)(b) was contained in a confidential annex, which was not supplied to APG. On appeal APG did not challenge the principle of the application of s23, which related to information supplied by or relating to the Special Forces. APG contended that s26(1)(b) (prejudice to the capability of forces) was not engaged, that the application of s27 (prejudice to international relations) was not established and that in any event the public interest balance was in favour of disclosure. As regards a legal annex to the detention practices review and the s42 exemption (legal professional privilege), APG abandoned an argument that there had been a waiver of privilege but maintained that the public interest balance favoured disclosure. The legislation

[71]We have set out s.27 above. The other relevant Part II exemptions are in the following terms: “23 Information supplied by, or relating to, bodies dealing with security matters(1) Information held by a public authority is exempt information if it was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).

(2) A certificate signed by a Minister of the Crown certifying that the information to which it applies was directly or indirectly supplied by, or relates to, any of the bodies specified in subsection (3) shall, subject to section 60, be conclusive evidence of that fact.

(3) The bodies referred to in subsections (1) and (2) are- ... (d) the special forces, ... (5) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) which was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3). 26 Defence (1) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice- ... (b) the capability, effectiveness or security of any relevant forces. (2) In subsection (1)(b) “relevant forces” means- (a) the armed forces of the Crown, and (b) any forces co-operating with those forces, or any part of any of those forces. (3) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would, or would be likely to, prejudice any of the matters mentioned in subsection (1). 42 Legal professional privilege (1) Information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality of communications could be maintained in legal proceedings is exempt information. (2) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) in respect of which such a claim could be maintained in legal proceedings. Discussion and Conclusions

[72]Without sight of the disputed information, APG was not in a position to make detailed submissions on the extent of the material to which the various exemptions did or did not apply, and necessarily relied on arguments of a general nature. With the assistance of the closed evidence and closed submissions we have examined the application of the relevant exemptions in detail and further findings and reasoning are set out in the closed annex to our decision.

[73]Broadly the position which we have reached is as follows(a) Certain passages were correctly redacted under s23 (Special Forces).

(b) Contrary to the finding of the Commissioner, section 26(1)(b) was not engaged (prejudice to the capability of forces).

(c) We found some applications of s27 to be unconvincing, bearing in mind what the text actually said and what was already in the public domain regarding allegations against US forces and the process of review undertaken by the UK Government. Moreover, the public interest in maintaining the exemption was in our view strongly outweighed by the public interest in the disclosure of the information.

[74]Section 42 was correctly relied on in regard to the legal annex to the detention practices review, and the public interest in maintaining the s42 exemption was not outweighed by the public interest in disclosure.

[75]On the balance of public interest in relation to the legal annex APG pointed to the following-(a) It was important that all allegations of rendition and ill treatment were the subject of investigation.

(b) So far as APG was aware, the detention practices review was the only determination that had been made of the UK’s compliance with its national and international legal and policy obligations in regard to such treatment. In so far as the review remained secret, the UK’s compliance remained secret.

(c) The UK Government repeatedly stated that it had uncovered no evidence of ill treatment. Without making public the full detail of the investigation and its reasoning, the strength of such assurance could not be validated. Disclosure was essential to accountability.

(d) In particular, the Government had repeatedly defended its position by referring to the comprehensiveness of the review, which was said to have taken a considerable period of time, whereas the short extract disclosed to APG referred to a “short notice 48 hr visit” and a “rapid audit”.

(e) As noted in a letter from the Secretary of State dated 11 June 2009, the on-going review ultimately revealed that two individuals had been subject to onward transfer by the US military from Iraq to Afghanistan. The emergence of this finding was inconsistent with the glowing conclusions of the review.

(f) Overall, the public interest in transparency and accountability demanded the disclosure of the whole of the review notwithstanding the application of s42 to part of it.

[76]We acknowledge the weighty nature of the public interest factors in favour of disclosure of material concerning treatment of detainees, as did the MOD and the Commissioner in their submissions. As the Report of the Eminent Jurists Panel on Terrorism, Counter-Terrorism and Human Rights (2009) observed: “Extraordinary rendition violates numerous human rights, including the rights protecting individuals against arbitrary arrest, enforced disappearance, forcible transfer, or subjection to torture and other cruel, inhuman or degrading treatment. … secret and unacknowledged detention itself constitutes a violation of some of the most basic tenets of international law … When a rendered person is held in secret detention, or held for interrogation by authorities of other States, with no information supplied to family members or others regarding the detention, this constitutes an enforced disappearance - a crime under international law.” (Chapter 4 pp 80-81, paragraph 3.1). “Accountability is not an obstacle to countering terrorism: it provides the crucial under-pinning of counter-terrorist measures if the latter are to secure the necessary public support and legitimacy to be truly effective. … the authorities must be prepared to account fully for the use of their powers, and must be prepared to submit themselves to adequate independent scrutiny.” (Chapter 7 p162).

[77]Balanced against these very important considerations, we must also have regard to the strength of the inherent public interest in the s42 exemption where information is subject to legal professional privilege, and its strength in this particular case. The public interest that exists in enabling the Government to obtain frank and confidential legal advice is not lessened by the fact that the topic under consideration is one of legitimate strong public concern and is intimately concerned with respect for the rule of law, indeed in precisely such cases the public interest in the obtaining of frank and confidential advice will often be particularly strong. In our view that consideration has particular force here. We follow the approach set out by Wyn Williams J in Department for Business Enterprise and Regulatory Reform v O’Brien

[2009] EWHC 164 (QB)

at paragraphs 37-39, 41 and 53. We do not consider that in the present case the public interest in favour of disclosure is of sufficient strength to outweigh the strong public interest in maintaining the exemption for the particular material that is subject to legal professional privilege in the present case.

[78]The overall effect of our decision is that more of the detention practices review should be disclosed than was attached to the Secretary of State’s letter of 7 July 2008 Request 3: Policy on Capture

[79]By a letter of 20 June 2008 APG asked the Secretary of State whether at any time since the invasion of Afghanistan in 2001 there had been a formal or informal policy (whether at governmental level, within the UK Forces or the UK Special Forces) that UK Special Forces operating within the joint task force referred to by Mr Griffin would detain or capture individuals but not arrest them. APG’s letter stated:

“Please supply a documentary record of the policy and any non-legally privileged information relating to the policy, its application and the purpose behind it. Please treat this question as a request under the Freedom of Information Act.”

[80]The Secretary of State’s s17 refusal notice, contained in his letter of 5 September 2008, refused to confirm or deny whether the requested information was held, citing s23 (Special Forces). Section 24 (national security) was also referred to.

[81]Upon internal review the Ministry of Defence in its letter of 27 February 2009 stated that reliance on ss23 and 24 was not the correct response, and that the answer that should have been given was that the s12 cost limit of £600 would be exceeded; however the letter did also say that, even if the information could be located within the cost limit, ss23 and 24 might apply.

[82]For the purposes of the Commissioner’s investigation the Ministry of Defence supplied a detailed cost estimate amounting to £1875. The Commissioner in his Decision Notice FS50246244 took issue with parts of the cost estimate, but was satisfied as to the reasonableness of £625 within the estimate, and therefore upheld the application of the s12 exemption.

[83]On appeal APG argued that s12 had been claimed too late (ie, after the s17 refusal notice) and that the estimate even of £625 was not reasonable; given the importance of the information it should be readily accessible. APG did not, however, object to the principle that s23 might have some application, and that the MOD should be entitled to rely on it if it did.

[84]We have set out at paragraphs [45] to [48] above what we consider to be the correct approach to the claiming of the s12 cost exemption after the expiry of time for service of the s17 refusal notice.

[85]The thrust of APG’s submission was that the request about the policy on capture was a “relatively self-contained” request. In our judgment it was a wide request. It asked not only for documentation relating to the policy on capture and the purpose behind it but asked also for a documentary record of the application of the policy. If there was such a policy, it was either applied or not applied whenever any relevant capture took place. It was inherently likely that a reasonable search for all relevant information would be relatively time consuming and costly. Since the scope of the request was unambiguous there was little scope for clarifying or refining it by consultation before or during the internal review process.

[86]In these circumstances we are not satisfied that there was prejudice or material unfairness in the raising of the s12 exemption at the time of the internal review or that the time estimate accepted by the Commissioner was unreasonable.

[87]But the issue under s12 is in our judgment of no practical import. The information requested, by the very nature of how it was defined in the request, related (in so far as it existed) to the UK Special Forces. It was inevitable, therefore, that the Ministry of Defence was entitled to rely on s23 to refuse to confirm or deny whether the information was held, and to refuse to supply any information that was held. Despite the statement in the internal review letter that the response in the initial refusal notice was incorrect, it seems to us that it was entirely correct in so far as it relied on the s23 exemption. In our judgment s23 was correctly relied on in the refusal notice, and is justifiably relied on now. Accordingly we cannot order disclosure of the information that was requested concerning the policy on capture . Request 4: Detainee Information

[88]On 20 June 2008 APG requested of the Secretary of State the following information (we have added identifying numbers in square brackets that were used in argument for ease of reference): [5] All information relating to any individuals who were detained or captured by UK solders operating within the joint US/UK task force, referred to by Ben Griffin [ie, in Iraq]. [6] Please state how many of these individuals were subsequently transferred to Guantanamo Bay Detention Camp, Bagram Theatre Internment Facility, Balad Special Forces Case, Camp Nama BIAP or Abu Ghraib Prison or any other detention facility in third countries. Please state how many of these individuals following capture were taken to:(i) a detention facility under the authority and control of British Forces;

(ii) a detention facility under the joint authority and control of British Forces;

(iii) any other detention facility (please specify);

(iv) more than one detention facility, or

(v) no detention facility. [7] In respect of each individual case please provide as much information as possible, including: (a) the date of detention and/or capture; (b) the date of transfer to US authority and control; (c) the location of such transfer; (d) subsequent known places of detention and dates thereof. [8] Please explain what you have treated as detention and capture for the purposes of answering these questions. [9] The same request on the same terms as above, in relation to all other individuals that have been detained or captured jointly by British Forces and forces of another country in Iraq or Afghanistan. Please make clear in each case which other force was acting jointly with UK Forces.

[89]The Secretary of State by letter of 5 September 2008 confirmed that information falling within the scope of the request was held, but refused to disclose it, relying on the exemption in s40(2) (protection of personal data). The internal review of 27 February 2009 maintained that position. The Commissioner in his Decision Notice FS50246244 upheld the refusal on that basis in regard to items [5] and [7] and the corresponding elements of [9], but decided in favour of disclosure of item [6] (the numerical and location information), item [8] (explanation of what was treated as detention or capture) and the corresponding elements of item [9]

[90]APG accepted that names should be redacted to anonymise the data but appealed against the non-disclosure of individual dates and transfer locations (item [7] and the corresponding element of item [9]). The Ministry of Defence appealed against the Commissioner’s decision so far as it required disclosure, relying as before on s40(2) and belatedly seeking to rely additionally on s12 (cost limit) and s23 (Special Forces).

[91]The Ministry of Defence identified information falling within items [5]-[9] as being contained within an Operation Telic MND(SE) Detention Register relating to detentions in Iraq and an Operation Herrick Detention Register relating to detentions in Afghanistan. The available information included some capture data in spreadsheet format said to be sourced from and to relate to the Special Forces. It should be remembered that the request was not for comprehensive information about detentions by UK forces but was limited to detentions effected where UK troops were acting jointly with the forces of the USA or another country. Late claim to s12 exemption

[92]We consider first the MOD’s late claim to rely on s12. The MOD’s argument was that s12 had been legitimately raised at internal review in relation to the request concerning policy on capture, and that with hindsight it could be seen that a single s12 limit ought to have been applied to both the request concerning policy on capture and the request for detainee information. Since the request concerning policy on capture alone exhausted the limit, the s12 exemption applied also to the request for detainee information.

[93]The argument was put in two ways. The first was that the two requests were properly to be regarded as a single request. We see no merit in this. While the requests were contained in a single letter, they were set out separately, they would have been understood as separate requests by the reasonable reader, and they were in fact treated as separate by the MOD and the Commissioner.

[94]The MOD’s second argument involved reliance upon regulation 5 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (SI 2004/3244), which we have referred to above. It is at least possible that the request concerning policy on capture (which included information about the application of the policy) and the request for detainee information might relate, to some extent, to the same or similar information although we have not seen any evidence to demonstrate that it does.

[95]Moreover, both the Commissioner and APG opposed the MOD’s reliance on s12 in relation to the request for detainee information on the ground that it was too late. We have set out above our approach to late claiming of the s12 exemption. The claim is very late, its lateness is likely to cause unfairness to the applicant, and pursuing a novel point on s.12 aggregation at this stage in the proceedings would be inappropriate in view of the time and effort spent on the substance of the matter to date. It would be disproportionate and contrary to the Upper Tribunal’s overriding objective to allow this point to be taken now. [2]

[96]We note that the information falling within the request for detainee information has been collated by the MOD for a variety of reasons, and was already collated irrespective of the freedom of information request. Belated reliance on s12 is therefore inappropriate and inconsistent with the statutory purpose of protecting a public authority against the incurring of future unreasonable costs in meeting an information request. The costs have already been incurred. MOD seeks to rely on s12 merely as a convenient reason for not providing the information when the time for relying on it has long expired. For all these reasons we conclude that the MOD is not entitled to rely upon it at this late stage. Late claim to s.23 exemption

[97]We consider next the MOD’s late claim to rely on s23 (Special Forces). The MOD contended that, in so far as the s23 exemption was applicable, the Tribunal had no discretionary power not to apply it, but, if there was a discretion, it should be exercised so as to uphold the exemption because of the high importance of safeguarding information to which the exemption applied and because of the desirability of consistency with the upholding of the same exemption in relation to parts of the detention practices review.

[98]The Commissioner, while expressing his concern at the lateness of the claim to rely on s23, did not object to it. APG submitted that, given the very late appearance of the point, two years after the original request was made, the Tribunal should give particularly close scrutiny to the claim that s23 applied. APG conceded that, if information was properly covered by s23, it could not reasonably claim disclosure of it. APG however contended that, given the lateness of the reliance, and that s23 had not been raised in answer to APG’s own appeal regarding this head of information, the Tribunal should consider whether the information could be redacted in such a way as to render disclosure of no possible harm to national security.

[99]It seems to us that both the Commissioner and APG effectively accepted in their submissions before and at the hearing that in the present context it was proper for the MOD to rely on s23 even though the reliance came very late. In the circumstances of this case we concur, and we consider that in principle the correct approach is to redact the information to remove that which is protected by s23 before going on to consider the effect of s40(2) on the remaining information. We have done this in the closed annex to this judgment.

[100]APG in its further written submissions on late exemptions subsequent to the hearing, made at our invitation in response to the promulgation of the decision in DEFRA (Supra) , moved to a harder line, contending that there was no proper basis for the introduction of reliance upon s23 in relation to the detainee information. While we sympathise with APG’s sense of frustration that s23 was raised so late, we consider that the public importance of s23 in the circumstances of the present case is such that it is just and reasonable for the MOD to rely upon it, consistently with the statutory purposes, if that is the test.

[101]So far as joint operations in Iraq are concerned, having considered in closed session the extent of the information within the scope of the request that is held by the Ministry of Defence and the application of s23, we have concluded that there is no remaining information available for potential disclosure. Our reasons are further explained in the closed annex to this decision. In regard to Iraq, we therefore allow the appeal of the Ministry of Defence in relation to item [6] and dismiss APG’s appeal in relation to item [7].

[102]There is information within the scope of the request which relates to Afghanistan and is unaffected by s23. Our detailed identification of this information is in the closed annex. Accordingly, in order to consider the appeal and cross-appeal in relation to joint forces in Afghanistan, we need to consider the exemption based on the protection of personal data, which has been relied on throughout by the MOD. The information unaffected by s23 relates to a small number of individuals, detained for very short periods; this feature affects the arguments concerning the application of s40. S.40 exemption

[103]In the context of the arguments addressed to us the relevant provisions of FOIA s40 are as follows:

“(2) Any information to which a request for information relates is … exempt information if- (a) it constitutes personal data …, and (b) … the first … condition below is satisfied. (3) The first condition is- (a) … that the disclosure of the information to a member of the public otherwise than under this Act would contravene- (i) any of the data protection principles … (7) In this section- “ the data protection principles” means the principles set out in Part I of Schedule 1 to the Data Protection Act 1998, as read subject to Part II of that Schedule and section 27(1) of that Act; … “personal data” has the same meaning as in section 1(1) of that Act.”

The definition of personal data in s1(1) of the Data Protection Act is: “personal data” means data which relate to a living individual who can be identified- (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual”.

[104]The meaning of “personal data” as defined was discussed in Durant v Financial Services Authority

[2003] EWCA Civ 1746

, paragraphs 21-31. To constitute personal data the information should have the data subject as its focus and affect the subject’s personal privacy.

[105]The first data protection principle is that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the Data Protection Act is met. In the case of “sensitive personal data” a Schedule 3 condition must also be met. [3] In this connection we remind ourselves that the Data Protection Act 1998 was intended to give effect to Council Directive 95/46/EC, and we are required to interpret the DPA, so far as possible, in the light of, and to give effect to, the Directive’s provisions: see Durant at paragraph 3 and Common Services Agency v Scottish Information Commissioner

[2008] UKHL 47

[2008] 1 WLR 1550

at paragraph 3.

[106]Recital 72 of the Directive provides:

“Whereas this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in the Directive …”

. It seems to follow that the principle of public access to official information, which in the United Kingdom is enshrined in FOIA, may properly be taken into account, where appropriate, when assessing compliance with the data protection principles. Such assessment must, however, be in the wider context that

Article 8 of the European Convention on Human Rights

(right to private life) is an important source of inspiration for the Data Protection Directive, and the principal object of the Data Protection Act is to protect personal data and to allow it to be processed only in defined circumstances (see also Common Services Agency at paragraphs 7 and 68).

[107]It is common ground that the names of individual detainees are not to be released. There are two elements of information in dispute. The MOD contends that, contrary to the Commissioner’s decision, it should not be required to state the numbers of individuals transferred to particular detention facilities or particular kinds of detention facilities. APG contends that, contrary to the Commissioner’s decision, the MOD should additionally state for each individual case the dates of detention and the dates and locations of any transfers. In addition APG seeks explanation of what has been treated as detention and capture for the purpose of answering the questions. APG’s appeal

[108]We consider first APG’s appeal. The Commissioner found that information giving for each individual case the dates of detention and the dates and locations of any transfers would enable identification of individuals, and therefore constituted personal data. On appeal APG contended:(1) With appropriate redaction, this information would not render any individual identifiable; it was therefore not personal data. This was supported by reference to the disclosure in the legal proceedings in the case of Evans of a database showing all of the prisoners detained throughout the conflict in Afghanistan, with prisoner names redacted and replaced by a reference number.

(2) Even if individuals would be identifiable, so that the information would constitute personal data, disclosure was permitted because it would not contravene the data protection principles. Disclosure would be fair and lawful, in particular because it would be for the individuals’ benefit since it would help ensure that they were treated lawfully and that their wellbeing was safeguarded.

(3) Schedule 2 conditions 4, 5(a), 5(d) and 6(1) would be satisfied. Alternatively the exemption in DPA s35(2) would apply.

[109]It was common ground before us that the more specific information is about time and place of capture, the greater the risk that putting it in the public domain would lead to people being identified with the consequence that anonymous statistics become personal data. APG submitted however that the test was whether individuals “can be identified” not merely whether there was a real risk of identification. We do not consider that the case of Evans is of any real relevance in this respect, as this concerned disclosure in the course of litigation rather than under FOIA. We have to make an assessment of whether release of this information into the public domain would enable identification of individuals. [4] Having heard the open and closed evidence that was given, we are not satisfied that stating for each individual case the dates of detention and the dates and locations of any transfers would enable identification of individuals, and therefore constitute personal data. Our reason for this conclusion is based on the particular content of the information in question (especially the shortness of the detention periods) and the absence of any evidence to show that individuals would be identifiable from the information by reason of other knowledge held in the relevant communities.

[110]In case we are wrong about that, we go on to consider the various arguments put forward by APG in support of its contention that disclosure would not be in contravention of the data protection principles, even if individuals are identifiable. APG’s submission that disclosure would be for the individuals’ benefit, since it would help ensure that they were treated lawfully and that their wellbeing was safeguarded, seems to us to be somewhat inconsistent with APG’s acceptance that names should be redacted. While we understand APG’s contention that disclosure of detention information might assist, in so far as it would tend to promote assurance that the UK Government was complying with its obligations under national and international legal and policy obligations, if that is correct then disclosure of the names of individuals would be of even more assistance, since that would make it easier to identify them and easier for their cases to be taken up if necessary.

[111]Against APG’s argument, Ms de Bourcier of the MOD gave evidence in open session that disclosure of their identities “could be immensely damaging to these individuals as their association with capture by UK forces would attract attention and notoriety to their person, might prove injurious to their reputation and standing in the communities in which they currently live, and might even endanger their lives”. As a general proposition, the risks identified by Ms de Bourcier (which were not effectively challenged in cross-examination) would in our view more than outweigh the speculative benefits contemplated by APG. This would, however, be fact dependent. Where, for example, a person was detained for a single day and then promptly released, the natural implication would be that the detention was found to be unjustified and we do not consider that it would carry the risks of opprobrium to which Ms de Bourcier referred. This certainly applies to all but one of the small number of individuals. In the case of the one, the quality of information which would be released appears to us to be too vague for us to conclude that there would be a risk of the type to which Ms de Bourcier referred. Accordingly we do not consider that there would be material unfairness in the disclosure of the information.

[112]The Schedule 2 conditions relied on by APG were condition 4 (disclosure necessary in order to protect the vital interests of the data subject), condition 5(a) (disclosure necessary for the administration of justice), condition 5(d) (disclosure necessary for the exercise of any other functions of a public nature exercised in the public interest by any person), and condition 6(1) (disclosure necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject).

[113]The reliance on these conditions gave rise to arguments concerning whether they could ever be relied on in the context of a freedom of information request. The MOD submitted, with partial support from the Commissioner, that the words used in FOIA s40(3)(a) “disclosure of the information to a member of the public otherwise than under this Act” did not refer to disclosure to the information requester for the particular purpose that the requester had in view but referred to disclosure to the general public, as if the words used were “disclosure of the information to any member of the public”. If this were right, then the gateway permitted by s40(3) would be a very narrow one, since it will often only be particular members of the public whose requests would be capable of fulfilling many of the Schedule 2 or Schedule 3 conditions.

[114]While it is true that disclosure under FOIA is effectively disclosure to the world, not simply to the information requester, so that there is good reason for s40(3) to require consideration of the effect of public disclosure, we consider that the MOD’s submission goes too far. The test in s40(3) is not whether disclosure to the world under FOIA might contravene the data protection principles; the test is whether disclosure to a member of the public otherwise than under FOIA would contravene the data protection principles.

[115]Whether a person is making the request as a member of the public in circumstances which satisfy a Schedule 2 or 3 condition and do not contravene the data protection principles, is a question to be considered in each case. It is right to say that there are some conditions which it will never be possible for a member of the public to fulfil, except in circumstances where the data controller is himself the person whose functions are referred to in the condition. Examples are Schedule 2 conditions 5(b) (exercise of functions conferred on a person by an enactment), 5(c) (exercise of functions of the Crown, a Minister or a government department) and 5(d) (exercise of functions of a public nature exercised in the public interest). By definition, a member of the public cannot have those particular functions. In contrast, there are other conditions which can in suitable circumstances readily be fulfilled by a member of the public, even though they are not fulfilled by the public in general.

[116]Returning to the particular conditions relied upon by APG in the present case, we cannot see any case for the application of condition 5(d), for the reasons stated above [5] . APG’s case under each of conditions 4 and 5(a) falls short because, irrespective of other difficulties, the disclosure is not “necessary” for the purpose mentioned in the condition. The meaning of “necessary” in this context was discussed in Corporate Officer of the House of Commons v Information Commissioner [2008] UKIT EA 2007 0060 ,

[2008] EWHC 1084 (Admin)

(on appeal from EA/2007/0060), where the requests by members of the public were in circumstances which fulfilled condition 6(1). Reminding ourselves that the relevant time is the time when the request was dealt with by the MOD, on the evidence which we have heard, both open and closed, we are simply unable to find that the appropriate degree of necessity was established. In regard to condition 4, we have no reason to think that the vital interests of the few individuals whose detentions fall within the scope of the request and outside the protection of s23 were under threat such that disclosure of the details sought in respect of their detentions (which in nearly all cases were for a single day) would have protected them. In regard to condition 5, we do not consider that APG’s request was made for the purpose of the administration of justice.

[117]In regard to condition 6(1), we have no doubt that APG is pursuing a legitimate interest as members of the public in ascertaining, so far as it can, how detainees were treated, and that such interest can only be advanced by obtaining the release of relevant information. We remind ourselves that we are considering this condition on the hypothesis that (contrary to our finding) the individuals would be identifiable from the information. If we had accepted that Ms de Bourcier’s evidence (summarised above), concerning the risks to the individuals if they were identified, was applicable to the small number of detentions in question, we would have agreed with the Commissioner that the interference with the rights of the data subjects would be unwarranted. But, having regard to the particular circumstances of those detentions as indicated above at [111], we do not consider that there would be real prejudice to the rights and freedoms or legitimate interests of the data subjects. Accordingly, if we had decided that the information which is the subject of APG’s appeal was personal data, we would have taken the view that condition 6(1) of Schedule 2 was satisfied.

[118]APG made an alternative submission based on DPA s35(2).

[119]By FOIA s40(7), the reference to the data protection principles in s40(3) means the principles as read subject to DPA s27(1). Section 27(1) brings in the exemptions in Part IV of the DPA, one of which is s35(2): Personal data are exempt from the non-disclosure provisions where the disclosure is necessary-(a) for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), or

(b) for the purpose of obtaining legal advice, or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

[120]The “non-disclosure provisions” are defined in DPA s27(3)-(4). The effect of the definition in the present context is that, where s35(2) applies, the disclosure does not have to comply with the first data protection principle except to the extent that the principle requires compliance with a Schedule 2 condition. We have found above that condition 6 of Schedule 2 would be satisfied.

[121]APG submitted that by reason of what had emerged into the public domain about extraordinary rendition, and by reason of the contradictions in statements made by the UK Government at different times, it could now be seen that at the time when the request was dealt with there was a pressing need to establish the legal rights of those detained jointly by UK and other forces. It pointed to the approach of the Divisional Court in Evans and similar litigation where individuals acting in the public interest sought judicial review in order to vindicate the rights of others who might not be in a position to do so themselves.

[122]The Commissioner argued, supported by the MOD, that disclosure was not necessary for the purposes of establishing the legal rights of those detained, because the nature of their rights was already well established. This argument treated the word ‘establishing’ as if it meant theoretically establishing by looking up the rights up in a legal text and did not extend to establishing something in the sense of vindicating it in legal proceedings. We consider it is clear from the phrase “establishing, exercising or defending’ that the latter sense is included in s35(2). However, in view of the particular nature of the information in question relating to the twelve detentions, it does not seem to us that the release of that information can be said to be necessary for the purposes of establishing, exercising or defending legal rights.

[123]We therefore summarise our conclusions on APG’s appeal on detainee information as follows:(i) As a result of the application of FOIA s23 we are now only concerned with the dates of detention and dates and locations of any transfers of a small number of individuals in Afghanistan, all but one of whom were detained for only a single day.

(ii) The information is not personal data because the individuals would not be identifiable from the information.

(iii) In case we are wrong about that, our further findings are that there would not be material unfairness in the disclosure of the information, and condition 6(1) of Schedule 2 would be satisfied. Disclosure could therefore have been made and can now be made without contravening the first data protection principle.

(iv) DPA s35(2) is not applicable on the facts.

(v) As a result of the effect of FOIA s23, the MOD’s answer to the request will necessarily have to say that “at least” a certain number were detained, since the total number cannot be given.

(vi) Since the information is to be disclosed, the MOD must also say what it has treated as detention and capture for the purpose of meeting the request. MOD’s appeal on s.40 124 The Commissioner found that the information of the numbers of individuals transferred to particular detention facilities or particular kinds of detention facilities did not constitute personal data of any individual because individuals would not be identifiable from it. The MOD on appeal raised two arguments. First, in reliance on paragraph (b) of the definition of personal data, it was said that this information remained personal data, even when anonymised, because the individuals remained identifiable by the MOD from other information in the possession of the MOD (ie, the unredacted information). Secondly it was said that, where small numbers of persons were involved, redaction of the names was insufficient and that individuals would be identifiable from information known to the public in areas where the detainees had been located prior to their detention. We note in passing that the Commissioner referred in argument to whether there was an “appreciable risk” of identification; this does not appear to us to be the statutory test, which uses the phrase “can be identified”.

[125]The MOD’s first argument requires consideration of the reasoning of the House of Lords in Common Services Agency (Supra). [6] That reasoning contained three different approaches to the interpretation and relevance of paragraph (b) of the definition of personal data in a case where the processing that is in view is the disclosure of information that is redacted to protect identities: that of Lord Hope at paragraphs 23-27 (adopted by Lord Hoffmann at paragraph 1), that of Lord Rodger at paragraphs 75-78, and that of Baroness Hale at paragraphs 91-92. We note Lord Mance’s statement that, while he preferred the reasoning of Lord Hope, he did not decide the point because, as he said, it was not necessary to do so (paragraphs 96-97). Since the point was not necessary to the decision in the case, and there was not a majority decision on it, the reasoning is not binding on us and the matter remains open.

[126]We consider there is force in Baroness Hale’s analysis, which Mr Hickman strongly urged us to adopt. It is difficult to imagine any situation where disclosure of anonymised information about living individuals, whose identities were known to the data controller, would not be regarded as disclosure of personal data, if one were required to take into account, in determining whether individuals were identifiable, the data controller’s own knowledge of their identity. At first sight, that cannot be right, since it would have the result of retaining protection for anodyne information not affecting anyone’s privacy (what Lord Rodger called “plain vanilla data”). The Commissioner similarly urged on us that the MOD’s construction would give rise to absurdities. Mr Hooper submitted that on the MOD’s construction, the number of individuals who had died of heart disease in the UK over the last decade would amount to “personal data” if this number were in the hands of a data controller that held the underlying records identifying each individual concerned, however large that number might be, but it would plainly not be a sensible construction of the DPA to require all processing of such a wholly general piece of information to comply with the data protection principles.

[127]We cannot accept the Commissioner’s argument in full. As we understand the reasoning of Lord Hope, it is important to remember in this context that the definition of ‘processing’ does not only cover disclosure. Information or data are also processed when they are merely held, or indeed when they are destroyed (so that no one can any longer be identified). Anonymisation by redaction is itself a form of processing. If the data controller carries out such anonymisation, but also retains the unredacted data, or retains the key by which the living individuals can be identified, the anonymised data remains “personal data” within the meaning of paragraph (b) of the definition and the data controller remains under a duty to process it only in compliance with the data protection principles. On this basis, therefore, and contrary to the submissions of the Commissioner, we consider that the analysis of the essence of Lord Hope’s reasoning by the Information Tribunal in Department of Health v Information Commissioner and Pro0life Alliance EA/2008/0074 (15 October 2009) at paragraphs 30-43 was probably correct.

[128]However, we remain concerned at the use of this analysis in such a way as would have the effect of treating truly anonymised information as if it required the protection of the DPA, in circumstances where that is plainly not the case and indeed would be absurd. Lord Hope’s reasoning appears to lead to the result that, in a case where the data controller retains the ability to identify the individuals, the processing of the data by disseminating it in a fully anonymised form, from which no recipient can identify individuals, can only be justified by showing that it is effected in compliance with the data protection principles. Certainly the whole of the information still needs the protection of the DPA in the hands of the data controller, for as long as the data controller retains the other information which makes individuals identifiable by him. But outside the hands of the data controller the information is no longer personal data, because no individual can be identified. We therefore think, with diffidence given the difficulties of interpretation which led to such divergent reasoning among their Lordships, the best analysis is that disclosure of fully anonymised information is not a breach of the protection of the Act because at the moment of disclosure the information loses its character as personal data. It remains personal data in the hands of the data controller, because the controller holds the key, but it is not personal data in the hands of the recipients, because the public cannot identify any individual from it. That which escapes from the data controller to the outside world is only plain vanilla data. We think this was the reasoning that Baroness Hale had in mind, when she said at [92]: “For the purpose of this particular act of processing, therefore, which is disclosure of these data in this form to these people, no living individual to whom they relate is identifiable”.

[129]The MOD’s second argument raises a question of fact, which we have addressed in the closed annex. On the evidence that we have received, our conclusion on the balance of probabilities is that publication of the information the subject of the MOD’s appeal will not render individuals identifiable. We have also had regard to the evidence before us of a Parliamentary answer dated 6 July 2009 Column 549 where the Secretary of State for defence referring to the Departmental practice of not revealing personal data gave information about two detentions. We conclude that we are entitled to take this information into account without impugning any proceedings in Parliament. [7]

[130]We consider that the publication of fully anonymised data or other plain vanilla data, from which individuals cannot be identified, does not involve a processing of personal data.

[131]If, contrary to our view, we are bound by the full import of Lord Hope’s reasoning as Interpreted by the MOD, we have to consider whether the publication of information, which does not enable individuals to be identified by persons outside the MOD, can be effected consistently with the data protection principles. On the basis that individuals cannot be identified, we can see no objection in regard to fairness or lawfulness. The material question would be whether a Schedule 2 condition is met.

[132]It seems to us that condition 6(1) is met. Because individuals cannot be identified by the public, there is no prejudice to the rights and freedoms or legitimate interests of the data subjects. The legitimate interests pursued by third parties, namely APG, are the public interests in transparency and accountability in relation to treatment of detainees in accordance with national and international obligations which we have referred to above. The processing is necessary (in the relevant sense) for those purposes, since without such disclosure those purposes cannot be advanced. We therefore conclude that this element of information is not protected by FOIA s40(2) and we dismiss the MOD’s appeal so far as it relates to information not protected by s23.

[133]Providing an answer to this request also includes making clear which other force was acting jointly with UK Forces.

[134]The MOD accepted that if any part of the request concerning detainee information fell to be answered then the question about what was meant by detention and capture would be answered in relation to it.

[135]For these reasons we have unanimously reached the conclusions set out at the head of this judgment. Signed The Hon Mr Justice Blake Andrew Bartlett QC Rosalind Tatam 18 April 2011 [1] As explained in these judgments this is the principle that a person who supplies information to another can control its further dissemination [2] The Tribunal Procedure (Upper Tribunal) Rules 2008 as amended 2008 No 2698 Rule 2 . [3] For completeness, we record that the MOD at one stage submitted that the detainee information was sensitive personal data. APG and the Commissioner disagreed, for what appeared to us to be good reasons, and the MOD did not press its submission. [4] The relevant time at which this question has to be considered is primarily the time when the request was dealt with by the MOD; but in order to protect the rights of data subjects we also have to consider what would now be the effect of releasing the information . [5] At one point in his oral argument Mr Hickman mentioned also condition 5(aa) (exercise of functions of either House of Parliament). We cannot see how a request by a member of the public could ever be in circumstances which would fulfil condition 5(aa), unless the data controller was acting on behalf of a House of Parliament, which was not the case here. [6] Logically, the MOD’s first argument would have been applicable also as part of its opposition to APG’s appeal concerning detainee information. However, in relation to APG’s appeal, the MOD chose to rely on the Commissioner’s statement of case, which did not advance that contention. [7] R ota Age UK v SS Business Innovation and Skills

[2009] EWHC 2336 (Admin)

[2010] 1 CMLR 21

at [50-58])

Cited in 22 later judgments

and 13 more of the most senior