“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
“52. The word ‘necessary’ is to be understood in the sense discussed in Corporate Officer of the House of Commons v IC[2008] EWHC 1084 (Admin) at [43]. The word is stronger than ‘reasonable’ or ‘desirable’ but not as strong as ‘indispensable’. There must be a pressing social need and the interference must be both proportionate as to means and fairly balanced as to ends. 53. We have considerable sympathy with the College, and with the difficulties that it has faced. But we are not persuaded that Condition 6 is satisfied. Our factual finding is that the College has legitimate reasons, both for its own purposes, and for the public purposes of supporting the integrity of the sponsorship and immigration system, for wishing to see the contents of immigration decisions issued to its prospective students. Based on this finding, we can see the desirability, even the strong desirability, that the College should have been given access to the notices of immigration decisions in response to its request. But desirability is not necessity. 54. As regards the two particular notices in question, if they were of substantial significance for the College’s position we would expect them to be sufficiently disclosed in the judicial review proceedings. We were not given any reason to believe that they are in some way more important or more significant than the 62 which the College was able to obtain in the judicial review proceedings. There are other ways in which the legitimate interests of the College can be or could have been advanced. The judicial review proceedings are one way. In addition, we see no reason why it was not open to the College to require prospective students, at the time of applying to the College, to provide their consent to disclosure, so that condition 1 would be satisfied. It would also have been possible for the contract with the student to be so framed as to bring into play condition 2. 55. Given our conclusion on the question of necessity, we do not need to go on to consider the balance under condition 6 between the legitimate interests of the College and the rights and freedoms or legitimate interests of the data subjects. 56. We would add that it seems conceivable that the Home Office’s disclosure of visa application outcomes to Highly Trusted Sponsors could be made pursuant in some way to condition 6, given the legitimate interests of the Home Office, as data controller, in running a tight regime with the Highly Trusted Sponsors. If this were the case, it would not be inconsistent with our decision that condition 6 cannot be relied on by the College to escape the impact of the exemption in FOIA s40(2). It merely underlines that the Home Office should have advised the College at the outset that the appropriate procedure would be for the Home Office to consider the College’s request not in relation to a member of the public under FOIA but as part of its dealings with a Tier 4 sponsor.”
“ Reporting duties 461. Unless stated otherwise, you must report the following information to us within 10 working days using the sponsor management system. It tells us about students who do not attend, do not comply with our requirements, or disappear. We use the information to take enforcement action against them when necessary. 462. You must report on students even if they are on a pre-sessional course at a partner institution named on their CAS or a work placement which forms part of their course. Students who do not enrol 463. You just tell us if a student you have assigned a CAS to does not enrol on their course within the enrolment period. You must report this no later than 10 working days [after] the enrolment period has ended. You must include any reason the student gives for not enrolling for example if they: · missed their flight; · have decided not to come to the UK; · have decided to take up a course with a different sponsor; or · have had their application for permission to come to, or stay in the UK refused.”
“(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”
“32. The Home Office makes available to Highly Trusted Sponsors a premium service at a cost of£8,000 per annum. The College alleges that, as part of the premium service, the Home Office notifies Highly Trusted Sponsors of the outcome of immigration applications, and that this is inconsistent with its reliance on FOIA s40(2). 33. The rather scanty available information concerning the premium service does not show that the reasons for refusal are notified to the Highly Trusted Sponsor, except where the prospective student has given express consent, but it does appear probable that the outcomes of visa applications (presumably without the reasons) are notified to the Highly Trusted Sponsor. If that is so, it is not clear to us how that is done consistently with the Home Office’s data protection obligations, but this does not affect our decision, because we have to apply the law to the circumstances of the case before us, not to a different set of circumstances. (We comment on this further at paragraph 56 below.)”
“56. We would add that it seems conceivable that the Home Office’s disclosure of visa application outcomes to Highly Trusted Sponsors could be made pursuant in some way to condition 6, given the legitimate interests of the Home Office, as data controller, in running a tight regime with the Highly Trusted Sponsors. If this were the case, it would not be inconsistent with our decision that condition 6 cannot be relied on by the College to escape the impact of the exemption in FOIA s40(2). It merely underlines that the Home Office should have advised the College at the outset that the appropriate procedure would be for the Home Office to consider the College’s request not in relation to a member of the public under FOIA but as part of its dealings with a Tier 4 sponsor.”