TS v The Information Commissioner and The Chief Constable of Essex Police: [2016] UKUT 455 (AAC) [2016] UKUT 0455 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2016] UKUT 0455 (AAC)Case No GIA/2041/2014
Between
TSAppellantThe Information Commissioner and The Chief Constable of Essex PoliceRespondent
Before
Gwynneth Knowles QCDate 11 October 2016Category: Information rightsSubcategory: Information rights data protection, Information rights freedom of information exceptions
[1]The principal point of interest in this appeal lies in whether the First-tier Tribunal [“the FTT”] failed to examine carefully the reasoning behind the Information Commissioner’s Decision Notice as to whether data was or was not the personal data of the Appellant [Mr Smith] and thus erred in law by reaching a conclusion on the basis of inadequate and indeed inaccurate reasoning. In this case, the Information Commissioner [“the IC”] had decided that the requested information did not constitute the Appellant’s personal data and thus his Decision Notice focussed on the reliance by the public authority - Essex Police – on section 40(5)(b)(i) of the Freedom of Information Act 2000 [“FOIA”] as a basis for its refusal of information to the Appellant. During the course of this appeal the IC conceded that the requested information did in fact constitute the personal data of the Appellant in addition to that of a third party. If the information was the Appellant’s personal data all along, was the tribunal in error of law in reaching the decision it did?[2]It is clear that the ownership of this data was an issue upon which the two Respondents were at odds in this appeal. Essex Police maintained that the data requested was entirely unconnected to the Appellant and thus reliance alone on section 40(5)(b)(i) of FOIA was entirely accurate. The requested data was the activations of Essex Police’s Automatic TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 2 Number Plate Recognition [“ANPR”] system in relation to a particular vehicle during the entirety of 28 February 2008.[3]I conclude that, first, the data requested did constitute the Appellant’s personal data along with that of a third party. However, this had no material impact on the outcome of this appeal before the FTT since the tribunal correctly concluded that it would be unfair to process the same by way of confirmation or denial. The fact that the information would also be personal data of the Appellant would only have provided a further and more absolute basis – namely reliance on section 40(5)(a) of FOIA – to refuse the appeal.[4]I gave permission to appeal on other grounds but these are of less significance. I deal with these grounds toward the conclusion of these Reasons. None of them founds the basis for a successful appeal against the tribunal’s decision.[5]The Appellant, Mr Terence Smith, represented himself. The IC was represented by Mr Rupert Paines of counsel and the Chief Constable of Essex Police (acting in the interests of that force) was represented by Mr Christopher Knight of counsel. I am grateful to all of them for their written arguments which I have found enormously helpful. With the agreement of the parties, it has not been necessary for me to hold an oral hearing of this appeal.[6]I have read the First-Tier Tribunal and the Upper Tribunal bundle carefully before coming to my conclusions. Background[7]What follows is a summary pertinent to this appeal. The requester and Appellant was Mr Terence Smith. Mr Smith is a serving prisoner having been convicted of conspiracy to rob following trials in 2009 and 2010. He maintains his innocence of the charges on which he was convicted and states that the activities which led to his arrest – following a cash transit van – represented research for a book which he was writing. I should mention that Mr Smith was, prior to his conviction, a writer specialising in stories of true crime focussed on professional armed robbery. He had published a number of books and had also made media appearances in connection with his writing.[8]On 28 February 2008 Mr Smith claimed that he was conducting research for a book and that, as part of that research, he was the driver of a Vauxhall Vectra car number plated R529VLH and was following an old type Mercedes Loomis cash-in-transit van in Basildon, Essex. The owner and registered keeper of the Vauxhall Vectra was Mr Smith’s passenger. Mr Smith claimed to have followed the Loomis van through Basildon and then along the A127 towards London. He said he TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 3 eventually stopped following that vehicle, having turned off the A127 towards Brentwood. Mr Smith and his passenger were later arrested and charged with conspiracy to rob. It was Mr Smith’s case that Essex Police tampered with the evidence at his trial by substituting details of a newer van model for the old Loomis van he says he was following. When he sought disclosure of archive CCTV footage and ANPR data to support his version of events, he claimed that Essex Police suppressed the evidence and fabricated ANPR data via the police “Holmes” computer system. In short, he said he was deprived of a fair trial as part of a police “fit-up”.[9]Mr Smith made a FOIA request on 11 April 2012 to Essex Police. The request [“the Request”] was in these precise terms: a) According to the National ANPR Data Centre [NADC – my addition], all ANPR data which is generated by automatic number-plate readers in Essex, belongs to and is owned by the Chief Constable to Essex Police. The NADC are merely the “controllers” of the data. b) On that basis, please can you provide me with the archive national ANPR details for all activations in relation to Vauxhall Vectra (index R529VLH) in Essex on 28 February 2008, in which it was confirmed by Essex Police that I was a passenger on that particular day. c) Should it be the case that this ANPR data has become deleted from the NADC database, please can you inform me, on whose authority was the data deleted and the precise date of the deletion. d) Just so there is no ambiguity or confusion as to the correct registration of the vehicle and the precise date of the information required. It is Vauxhall Vectra “Romeo-five-two-nine-Victor-Lima-hotel” on the Twentyeighth of February Two-thousand-and-eight (see page 01 in the bundle attached).[10]Essex Police refused to confirm or deny whether it held this information. In refusing this Request, Essex Police relied on section 40(5)(b)(i) of FOIA, namely that confirming or denying would contravene the data protection principles.[11]Mr Smith contacted the IC on 31 July 2012 to complain about the way his request for information had been handled. For the reasons set out in his Decision Notice dated 27 June 2013, the IC found that Essex Police were entitled to rely on the exemption in section 40(5)(b)(i) of FOIA. Mr Smith appealed to the FTT on 9 July 2013. The Tribunal Decision[12]The FTT considered the appeal on the papers alone as had been agreed by Mr Smith and the IC, Essex Police playing no part in the proceedings. On 7 November 2014 the FTT dismissed the appeal, agreeing with the IC that the refusal by Essex Police to confirm or deny whether information was held in reliance on section 40(5)(b)(i) of TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 4 FOIA was lawful since to do so would contravene the data protection principles in relation to the personal data of a third party.[13]The FTT noted the background to the Request and Mr Smith’s belief that the information would assist him to demonstrate that he was the victim of a miscarriage of justice. It noted that Mr Smith appeared to have, in fact, obtained the requested information during the course of the criminal proceedings against him. On 24 April 2009 the Crown Prosecution Service had informed Mr Smith’s solicitors that Essex Police had no ANPR records for a vehicle registered as R529VLH travelling on 28 February 2008. The FTT noted that, even if this were so, Mr Smith was still properly entitled to make the Request as disclosure in response to a Request was disclosure to the world at large.[14]The FTT identified that the issue was whether confirming or denying if the information was held would breach the data protection principles because the information would reveal personal data of the registered keeper of the vehicle. The IC had held that disclosure would be unfair and thus would breach the first data protection principle. The FTT ruled that fairness required a balance of the interests at play but the interests of the data subject required a high degree of protection [see paragraph 28 of the FTT’s Reasons].[15]The FTT considered whether the information was already in the public domain by reason of the criminal trial and concluded that it was not. The personal data of the third party was not specifically referred to in any of the newspaper reports about both trials and was not mentioned in the Indictment. The FTT found that there was “nothing to suggest that the allegation that the vehicle in question was being driven in Essex on that day was so fundamental to the charge against Mr Smith and the third party that the fact of the trial and the convictions can be said to have put that information into the public domain” [paragraph 29, FTT Reasons]. There would thus be some harm to the third party if the information were to be disclosed in response to a FOIA request though that harm – an invasion of privacy - would be relatively minor given that the information had been part of a criminal trial.[16]The FTT endorsed the general expectation that information of this nature, being personal data, would not be disclosed by a public authority without a strong competing public interest in favour of disclosure. Each case had to be considered on its particular facts in order to determine whether disclosure would be fair in relation to the subject of any personal data [paragraph 32, FTT Reasons].[17]Having regard to the competing interests in favour of disclosure, Mr Smith stated that the requested information would help him challenge his conviction and expose the wrong-doing of Essex Police. The FTT TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 5 accepted that, if Mr Smith had been wrongfully convicted, this would be a matter of considerable public interest. However the FTT held that it was beyond its remit to make findings on such an issue and that there was no proper evidence before it which would support such a finding. There were other and more appropriate channels for Mr Smith to seek redress of any miscarriage of justice in relation to his conviction. It observed that “the mere allegation that he has been wrongfully convicted is not enough to outweigh the interest of the data subject” [paragraph 33, FTT Reasons].[18]The FTT concluded that, although on the particular facts the invasion of privacy would not be considerable, disclosure would not be fair. It was thus not necessary to consider whether any conditions in Schedule 2 of the Data Protection Act 1998 [“the DPA”] were met. The Appeal to the Upper Tribunal[19]The First-tier Tribunal refused permission to appeal on 24 March 2014. Mr Smith then applied to the Upper Tribunal for permission to appeal on 15 April 2014 and Upper Tribunal Judge Jacobs refused permission to appeal on the papers on 22 May 2014. As provided for by rule 22(4)(a), Mr Smith applied for his application to be reconsidered at an oral hearing. His request was granted by Upper Tribunal Judge Lloyd- Davies on 12 August 2014 and a hearing was listed to take place before me on 29 January 2015. Unfortunately that hearing had to be postponed because of problems transporting Mr Smith from prison to court.[20]Having reviewed the papers in preparation for the hearing I directed some written submissions from the IC on a legal issue which had not hitherto been contentious. I observed that Mr Smith, the IC and the FTT had all accepted that the information which might be revealed by Essex Police constituted the personal data of a third party. What did not appear to have been considered is whether that information would also constitute personal data belonging to Mr Smith because either(a) that information was processed by Essex Police during the course of an investigation in order to learn something about both the third party and Mr Smith and/or(b) the third party’s personal information was personal data affecting another individual.[21]In response to that direction, the IC filed submissions which accepted that the information requested by Mr Smith did in fact constitute both his personal data and the personal data of the third party. In those circumstances he stated that the exemption in section 40(5)(a) of FOIA would also apply, since the requested information was personal data of which Mr Smith was the data subject. If that exemption did apply, the IC said it would have been more appropriate for Mr Smith to seek it by means of a subject access request pursuant to section 7 of the DPA. TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 6[22]At my invitation, Mr Smith made written submissions in response to the IC’s concession. In summary these made reference to a subject access request he had made to Essex Police in July 2012 for his personal data. He said that he never formally made that application since Essex Police told him on 31 July 2012, “before you submit your application, that Essex Police will not provide you with any information that relates to Automatic Number Plate Recognition (ANPR) systems under the Subject Access Process” [Upper Tribunal bundle (UTB), page 51]. Mr Smith interpreted the response to his Subject Access Request as sinister and suggested that his Request for information had been re-routed down the wrong processing pathway by Essex Police in order to provide sufficient time for the data to be automatically deleted. I note that the automatic weeding facility for ANPR data was enabled in April 2012 and prior to this date police forces were given the opportunity to request the extraction of any data they required to be retained [UTB, page 52].[23]Unfortunately, for a variety of logistical reasons, it was not possible to arrange a hearing other than by way of telephone until 26 November 2015. The IC indicated that he did not wish to participate in that hearing and so I heard from Mr Smith alone. I granted permission to appeal limited to the grounds set out in my ruling and reserved my position as to whether Essex Police should be joined as a party to the proceedings until I had read the submissions of the IC. Having considered those submissions and with the consent of both Mr Smith and the IC, I joined Essex Police as a party to this appeal on 22 April 2016.[24]After setting out the legislative framework, I will deal with the main grounds of appeal in order of importance. The Legislative Framework[25]Section 1(1)(a) of FOIA states that a person making a request for information is entitled to be told in writing whether the public authority holds that information. Section 1(6) refers to this as the public authority’s duty to confirm or deny. If the information is held and none of the exemptions in FOIA apply, the public authority should communicate the information to the requester. The issue was whether Essex Police was required to confirm or deny that it held the information requested or whether it was exempt from the duty to do so by reason of the provisions of section 40 of FOIA.[26]Section 40(1) provides that any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. Section 40(5) reads as follows:
“The duty to confirm or deny - TS v (1) The Information Commissioner (2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 7 (a) does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1) and (b) does not arise in relation to other information if or to the extent that either – (i) the giving to a member of the public of the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene any of the Data Protection Principles or section 10 of the Data Protection Act 1998 or would do so if the exemptions in section 33A(1) of the Act were disregarded, or (ii) by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1)(a) of that Act (data subject’s right to be informed whether personal data being processed).”
[27]The effect of section 40(5)(b)(i) is that if, by simply confirming or denying that it holds the information, any of the data protection principles or section 10 of the DPA (processing likely to cause damage or distress) would be contravened, the public authority is exempt from the duty to do so.[28]The first data protection principle provides that personal data shall be processed fairly and lawfully and in particular shall not be processed unless at least one of the conditions in Schedule 2 of the DPA is met. The term “process” is defined in section 1 of the DPA and includes disclosure to a third party or to the public at large.[29]Finally, the definition of personal data is set out in section 1(1) of the DPA. It is:
“data which relates to a living individual who can be identified - (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.”
That definition imposes two requirements: identifiability and the relation between the individual and the data. Grounds 4 and 5 30 When giving permission to appeal, I noted that the FTT had jurisdiction to undertake a full review of the merits of the IC’s decision and to substitute its own view if it considered that the IC’s decision was wrong. The IC’s Decision Notice determined that the requested information did not constitute Mr Smith’s personal data. Given that the IC had conceded that the information did constitute Mr Smith’s personal data, I considered it arguable that the FTT failed in its inquisitorial function to examine carefully the reasoning behind the Decision Notice about the TS v (1) The Information Commissioner (2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 8 nature of the data in question. It simply failed to address it. That had some relevance since the FTT might have found the information should have been sought via a Subject Access Request pursuant to section 7 of the DPA and Mr Smith could have been advised accordingly. If that were the case, the FTT might also have made enquiry as to whether Essex Police had provided appropriate assistance and advice to Mr Smith when he made his request for information in accordance with its duty under section 16(1) of FOIA. The Parties’ Arguments[31]The IC conceded that the requested information was also Mr Smith’s own personal data. In so doing, he had regard to the context of the Request; noted that the Request specifically stated that Mr Smith was a passenger in the vehicle at the relevant time; considered that confirmation or denial would reveal(a) the precise times at which Mr Smith and the third party were at specific locations and(b) that Essex Police were or were not investigating the activities of the vehicle; and considered that, in the light of this, the information was indeed the personal data of Mr Smith as well as the third party. He submitted that, in those circumstances, section 40(5)(a) of FOIA also applied so as to exempt Essex Police from the duty to confirm or deny.[32]Further he submitted that the FTT had not erred in law by not investigating the matter since there was a well-established convention that, where a matter is not in issue, a tribunal has no obligation to go behind the parties’ agreement on that matter. Mr Smith’s Notice of Appeal disclaimed any reliance as to whether or not the DPA regime was more appropriate than the FOIA regime. Indeed, The IC said this was not a case where the applicability of the DPA was obvious. Confirmation or denial of the fact that Essex Police held a licence plate number would on its own only identify personal data of the registration holder. It was only in combination with the Request, stating that Mr Smith was a passenger in the car at the relevant time, that it was apparent that confirmation or denial might also reveal Mr Smith’s personal data. Finally, given that both sections 40(5)(a) and 40(5)(b)(i) were absolute exemptions, Mr Smith would not have been assisted in obtaining the information by an FTT decision either that section 40(5)(a) applied or any consideration whether Essex Police had complied with its duty to provide advice or assistance to him. The chronology showed that Essex Police had in fact given Mr Smith information about the possibility of a Subject Access Request under the DPA and had expressed its view about the likely outcome of such a request.[33]Essex Police accepted that it had not found it easy to determine whether the requested information was Mr Smith’s personal data at all. It was accepted that, where Mr Smith was identifiable from the context, TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 9 that context also revealed something about him but it was submitted that this link might not be sufficient to warrant classification as biographical information in a significant sense (applying the leading authority of Durant v Financial Services Authority [2003] EWCA Civ 1746). If the IC’s concession was correct, this had no material impact on the outcome of the appeal.[34]Essex Police submitted that the information would be mixed personal data – of Mr Smith and the third party – and, in those circumstances, the data controller was not obliged to attempt an analysis as to which of them was the more significant and then to recognise that person’s right to protection. Upholding the exemption by reference to the information being the personal data of a third party was a complete answer to Mr Smith’s appeal. The fact that it was also his data would only have provided a further lawful basis on which to refuse the appeal.[35]Finally Essex Police agreed with the IC that the FTT was not obliged to go behind the manner in which the appeal was put by the parties. There was no need to consider this matter where the issue which the parties did want determining had the effect of resolving both issues. There was no error of law or alternatively none which was material to the outcome.[36]For the avoidance of doubt, Essex Police denied any police wrongdoing.[37]Mr Smith’s submissions focussed in considerable detail on the process whereby he came to be convicted and on what he considered to be a less than adequate response to requests for information made by both him and by his legal team of Essex Police during the course of the criminal trial. He averred that Essex Police had failed to fulfil its statutory function to provide advice and assistance to him pursuant to s.16(1) of FOIA. Essex Police had sent him down the wrong data request access pathway – that was a means to stall him so that it could expunge the ANPR data relating to his case. The Upper Tribunal’s Analysis[38]It is no part of my role to pass an opinion on the overall conduct of Essex Police towards Mr Smith nor to venture any opinion on either the merits of or the circumstances surrounding his conviction.[39]Was Mr Smith’s Request for his own personal data? In determining whether information constituted personal data, Mr Knight referred me helpfully to the relevant case law. When determining whether information constitutes personal data because of the likelihood of identification, the tribunal’s approach should be to take account of “all the means likely reasonably to be used either by the controller or by TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 10 any other person to identify the said person”. This is the wording of recital 26 of directive 95/46/EC which formed the basis for the DPA and which was adopted by Judge Mullan in Information Commissioner v Magherafelt District Council [2012] UKUT 263 (AAC) at paragraphs 63,79, and 86. It is also necessary for the FTT to consider the context in which the data appears (see paragraph 18 of the decision of Judge Jacobs in Farrand v Information Commissioner & London Fire and Emergency Planning Authority [2014] UKUT 310 (AAC)). It must also follow that the Request itself forms part of the context against which identification takes place.[40]Durant v Financial Services Authority [2003] EWCA Civ 1746 continues to be the leading authority on whether data “relates” to an individual so that it is personal data. To summarise: first, the information must be biographical in a significant sense and second, it must have the putative data subject as its focus. Thus it must be possible to identify a living individual and that person must either be among the focuses of the information or the information must be biographical in a significant sense [see the analysis of Auld LJ in paragraph 28 of Durant]. Mr Knight suggested that another way of thinking about this test was to consider(a) if the information said anything non-anodyne about an individual or(b) if the individual was merely incidental to or a bit-part in that information.[41]In this case, Essex Police accepted that Mr Smith was identifiable from the context and that the context also revealed something about him. However, it submitted that the link was insufficient to warrant classification as biographical in a significant sense. At most confirmation or denial might tell the public that Mr Smith was in a vehicle in Essex on a particular day which was picked up on ANPR camera(s). Where the car did not belong to Mr Smith and there was nothing to suggest how long he was inside the vehicle, Essex Police submitted that “it was something of a stretch” to say that confirmation or denial could affect his privacy in a material sense.[42]The IC submitted that confirmation or denial of whether the information was held at the time of the Request would effectively reveal the precise times at which Mr Smith and the third party were at specific locations and, importantly, that the police were or were not investigating the activities of the vehicle and who was travelling in it at the relevant time. This was because it was likely that the information would have been deleted if the police had not been processing that information for investigatory purposes.[43]Mr Smith submitted that the requested material was clearly his personal data as well as that of the third party. He emphasised the fact that he was actually the driver of the vehicle rather than the passenger but I have decided nothing material turns on that issue TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 11 when considering if the requested information was also his personal data.[44]On this issue, I accept in large part the submissions of the IC. The Request made clear that Mr Smith was an occupant of the named vehicle on the date in question. He was thus identifiable from the context. Confirmation or denial that, at the time of making the Request [my emphasis], Essex Police held the ANPR data requested would have revealed that the police were or were not investigating the activities of the vehicle and by implication, the activities and identities of both of its occupants. Given those circumstances, it is difficult to envisage that the requested information was not biographical about Mr Smith in a significant sense. To use Mr Knight’s suggested test, Mr Smith was not merely incidental to the information and it said something non-anodyne about him, namely that he might or might not be the subject of a police investigation. The context and the timing of the Request are the two crucial factors which drive my analysis, in the circumstances of this case, towards the conclusion that the requested data was also Mr Smith’s own data. However, I find that the IC goes too far in suggesting that confirmation or denial would effectively reveal the precise times at which Mr Smith and the third party were at specific locations since the Request makes reference only to presence in Essex in a vehicle on a particular date.[45]What is the effect of that analysis on the FTT’s decision? There are two issues to consider:(a) the way in which the FTT approached its task on appeal and(b) the effect in law of a finding that the requested information also constituted the personal data of Mr Smith.[46]I have been referred to case law about the function of the FTT and accept that this is at least, in part, investigatory rather than adversarial [see paragraph 33 of Browning v Information Commissioner and the Department for Business, Innovation and Skills [2014] EWCA Civ 1050]. I also accept that it is the task of the FTT to decide the case before it unless it sees reason to investigate further.[47]In this case Mr Smith did not dispute that the requested information would constitute the personal data of a third party. His Notice of Appeal disclaimed reliance on any issue as to whether or not the DPA regime was more appropriate than the FOIA regime. The IC also submitted that this was not a case where the applicability of the DPA was obvious since it was only apparent that confirmation or denial might also reveal Mr Smith’s personal data when considering the information requested in combination with the Request itself.[48]Mr Smith contended that the FTT erred in law on this issue and he relied on what he said was the FTT’s failure to address the evidence of alleged police wrong-doing. Unfortunately that submission does not TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 12 grapple with the issues of law I have to address. The FTT had to consider the applicability of section 40(5) to the requested information – the complex history of dealings between Mr Smith and Essex Police was not a matter on which it was necessary for the FTT to either find facts or to express a conclusion.[49]I disagree with the IC that the applicability of the DPA was not obvious. In coming to that view I accept that the Farrand decision - relating to the context in which the requested data appears - post-dated the decision under appeal. However, I note that the tribunal asked itself the following in paragraph 26 of its Reasons:
“In our view, the proper starting point is to identify what personal data would be disclosed if the Public Authority were to confirm or deny whether it holds the requested information”
. The tribunal went on to analyse what the ANPR data might reveal but it is clear that its conclusions were shaped by the parties’ agreement that the information was the personal data of the registered owner. I find it very surprising that the FTT did not, when undertaking the task it had set itself, ask whether the requested data also constituted the personal data of Mr Smith. It knew he was an occupant of the vehicle and had clear evidence before it to that effect. The test in Durant would have been well known to it. Identifying what personal data might be disclosed also, as a matter of logic, engages consideration of whose personal data that might be.[50]Ultimately, however, I observe that the manner in which the FTT approached its task will be of no consequence unless the effect in law of a finding that the requested data was also Mr Smith’s data would have altered the tribunal’s ultimate conclusion, namely that Essex Police did not have to disclose the information.[51]There can be no doubt that the data was both that of Mr Smith and of the third party, that is, mixed personal data. Fenney v Information Commissioner (EA/2008/0001) supports the proposition that if information incorporates the personal data of more than one person, the data controller is not required to attempt an assessment as to which of them is the more significant and then to recognise the rights to protection of that individual and ignore the rights of the other data subjects. Thus, applying Fenney, the presence of Mr Smith’s data in the requested information made no difference to the FTT’s conclusion that the exemption in rule 40(5)(b)(i) should apply as the information was personal data of a third party.[52]Further, if the requested data was also the personal data of Mr Smith, the FTT could also have lawfully dismissed the appeal on the basis that the exemption in section 40(5)(a) applied. Thus, I conclude that any error of law on the part of the FTT about the nature of the information was immaterial to the outcome of this appeal. TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 13[53]Finally, in my grant of permission I suggested that, if the requested data was also personal data which should have been the subject of a Subject Access Request, Mr Smith could have been advised accordingly and enquiry might have been made by the FTT as to whether Essex Police had provided appropriate advice to him in accordance with its duty under section 16(1) of FOIA when he made the Request.[54]Having reviewed the material in the FTT bundle, I have come to the conclusion that Essex Police did, for example, provide advice to Mr Smith about requesting his personal data under the DPA in its letter dated 19 July 2012. Indeed, the lengthy correspondence between all three parties prior to the FTT appeal concerned whether the request was made under the DPA or FOIA and thus which was the appropriate approach to the appeal. It is also clear that Mr Smith had in the past made a number of Subject Access Requests to Essex Police and clearly knew of this parallel route as a means to obtain information.[55]Given my conclusion set out in paragraph 52, there is nothing of substance in ground 5 of my permission grant. I hereby dismiss grounds four and five of my permission grant. Grounds 1 and 2[56]I considered that it was arguable that the FTT had failed to apply the test of “reasonable necessity” in condition 6(1) of Schedule 2 to the DPA and had instead applied a public interest test and, further, that it had erred either(a) in failing to apply the test set out in Goldsmith International Business School v the Information Commissioner and the Home Office [2014] UKUT 563 or(b) by providing inadequate reasons for its decision.[57]Section 40(5)(b)(i) engages consideration as to whether the data protection principles would be contravened by disclosure of the requested information. As previously noted, the First Data Protection Principle sets out three requirements for the processing of nonsensitive personal data. Processing must be fair, lawful and must not be done unless at least one of the conditions in Schedule 2 is met. If processing is not fair or lawful, the first data protection principle is breached regardless of whether a Schedule 2 condition is satisfied.[58]Here both the IC and the FTT considered the question of whether disclosure of the personal data would be fair and concluded it would not. The FTT considered the merits when reaching its conclusion and thus stated that it did not need to consider whether any conditions in Schedule 2 were met. TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 14[59]I accept the submissions made by the IC and Essex Police that the FTT’s review of the merits on the issue of fairness and its conclusion in that regard was a decision properly open to it and not erroneous in law. In those circumstances, it was not necessary for it to consider Schedule 2 or the test in Goldsmith. I also accept that the FTT did not err in applying a form of public interest balance when deciding the question of fairness. It considered the harm to the third party; that party’s reasonable expectations; and the countervailing public interest, all of which were proper matters for it to take into account.[60]I note that Mr Smith did not make detailed submissions on these grounds. I dismiss grounds one and two. Ground Three[62]I questioned whether the FTT could have been improperly influenced by its belief that Mr Smith had other more appropriate channels available to him to seek redress for a claimed miscarriage of justice. I was unclear about the evidential foundation for that finding.[63]The FTT noted that Mr Smith had set out at length his arguments in favour of disclosure which he said would help him challenge his conviction and expose police wrong-doing. It also noted the view of the IC that challenging his conviction was a personal interest and exposing police wrong-doing was speculative.[64]The FTT accepted that there was a public interest in reversing wrongful convictions but it had no jurisdiction to determine whether Mr Smith had been wrongfully convicted. It went further by stating that there was no proper evidence before it that could support the proposition that Mr Smith had been wrongfully convicted. There were other more appropriate channels for Mr Smith to seek redress for any miscarriage of justice. The mere allegation that he had been wrongfully convicted was insufficient to outweigh the interest of the data subject given that there might be some harm to the data subject flowing from disclosure.[65]I accept that the FTT would have been aware of the routes whereby miscarriages of justice might be challenged. The IC supported by Essex Police, drew my attention to the FTT’s finding that, despite the public interest in reversing wrongful convictions, there was no evidence before it to support the proposition that Mr Smith had been wrongfully convicted. I agree those were findings which he says the FTT were entitled to make on its review of the material before it and were sufficient to found its conclusion that Mr Smith’s beliefs did not TS v(1) The Information Commissioner(2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC) GIA/2041/2014 15 constitute a public interest in disclosure that could outweigh the interests of the third party.[66]On reflection, I accept those submissions. I have considered carefully the submissions made by Mr Smith which centre on his bluntly expressed belief that Essex Police have behaved wrongfully by “fitting him up”. I reiterate that I express no view on that allegation and nor am I in a position to make findings on it. I can only consider whether the FTT erred in law in its approach to the balancing exercise on this issue. For the reasons set out in paragraph 65, I have come to the clear conclusion that this ground of appeal has no merit and accordingly I dismiss it. Conclusion[67]I have determined that the FTT did not materially err in law when reaching its decision in this appeal and I dismiss this appeal for the reasons I have given. Gwynneth Knowles QC Judge of the Upper Tribunal 11 October 2016. [signed on original as dated]