Morton v 1. Information Commissioner, 2. Wirral Metropolitan Borough Council: [2018] UKUT 295 (AAC) [2018] UKUT 295 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2018] UKUT 295 (AAC)
Between
MortonAppellant1. Information Commissioner, 2. Wirral Metropolitan Borough CouncilRespondent
Before
Upper Tribunal Judge K Markus QC The appeal is dismissedDate 10 September 2018Category: Information rightsSubcategory: Information rights freedom of information absolute exemptions
[1]In 2008 Wirral Borough Council (‘the Council’) conducted a competitive tender exercise for the provision of highway and engineering services and a contract was awarded to the successful bidder in October 2008. A number of individuals who were employees of the Council at the time of the tendering exercise raised concerns with the Chief Executive regarding the conduct of that exercise. These individuals have been described in many of the documents and by the Commissioner as “whistleblowers”. Mr Morton does not accept the accuracy of the term as he does not consider that the individuals acted in good faith, although he too has nonetheless occasionally referred to them as “whistleblowers”. Despite this disagreement, it is convenient to refer to the individuals as “whistleblowers” in these reasons because that is the most common terminology used and to adopt a different term could lead to confusion. Crucially, it is the terminology used in the report which is the disputed information in this appeal.[2]As a result of the whistleblowers’ concerns, Wirral carried out an internal investigation. The whistleblowers were not satisfied and approached the Audit Commission. In June 2012 the Audit Commission found “significant failings” in the way in which the contract had been awarded. This resulted in four senior council officers, including the Director of Technical Services (‘DTS’), being suspended pending an investigation by an independent external investigator, Richard Penn, into the role of the DTS in the procurement exercise and whether disciplinary action should follow. Mr Penn interviewed various witnesses including some or all of the whistleblowers. He produced a very detailed report (‘the Penn Report’) in December 2012. It was founded on evidence as to which he made clear findings of fact. He concluded that there was no case to answer in respect of each of the allegations which he had investigated. The DTS was reinstated shortly afterwards.[3]In July 2012 one of the whistleblowers was inadvertently publicly identified by the Council as one of those who had reported concerns about the procurement exercise. At that time the individual strongly objected to having been identified, claiming it would ruin his career. The Council issued a public apology.[4]In March 2014 the whistleblowers alleged that there had been a breach of confidentiality, arising from the Council disclosing their identities to the successful bidder in the procurement exercise in 2008. In response, the Council appointed Nicholas Warren to review the circumstances surrounding those allegations. Nicholas Warren is a former judge of the First-tier Tribunal and President of the Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 2 General Regulatory Chamber of that tribunal. He retired as a judge very shortly before he was commissioned to conduct the Review. The terms of reference of the Review referred to Nicholas Warren as ‘R’ and included the following: “8. R’s report would be confidential to Wirral Council but a summary of it, consistent with any of Wirral’s obligations in respect of confidentiality and other legal obligations, will be agreed between R and Wirral Council and will be supplied to the complainants…[11]The following conditions apply to the review and R’s appointment: 11.1.1 R will not disclose any information obtained as part of the R to any person unless it is necessary to do so in order to undertake the review… 11.1.3 The duty of confidentiality shall not apply to information which is in the public domain nor to any information which R is required by law to disclose. 11.1.4 The Council will indemnify R against the reasonable costs of defending any defamation action or threat of defamation action against R in his role as the R and any damages awarded against R in any such action…”[5]On completion of the Review, Nicholas Warren provided a report to Wirral (‘the Warren Report’ or ‘Report’) in October 2015. No part of the Warren Report was made public.[6]On 5 August 2016 Mr Morton asked the Council for a copy of the Warren Report. The Council did not respond to the request but, on internal review, refused to disclose the Report, relying on section 36(b)(i) and (ii) of the Freedom of Information Act 2000 (‘FOIA’). That refusal was maintained following an internal review. Mr Morton complained to the Information Commissioner. In response the Council maintained its reliance on section 36(2) of FOIA and in addition relied on section 40(2).[7]On 27 April 2017 the Commissioner decided that the Council was entitled to rely on section 40(2) to withhold the majority of the Report but that the remainder (to which only section 36 applied) was to be disclosed. The relevant parts of the Decision are as follows: “15. The thirty four page report (including its appendix) was produced by an external consultant following his investigation in to the consequences for a group of whistleblowers following their raising of concerns over the process following [sic] by a senior officer during a procurement excise which resulted in the outsourcing of Council services. It includes findings on the actions of senior officers towards the whistleblowers and details the repercussions for those whistleblowers. It contains significant biographical information, particularly about the whistleblowers themselves and expressions of opinion about both managers and whistleblowers.[16]The Commissioner is satisfied that the majority of the report relates to both managers and whistleblowers. Since much of the reports explains the events following the whistle-blow it describes how one party behaved to another or one person’s perception of another. Therefore, more often than not information about these parties is intertwined. The most notable exception to this being the short appendix to the report which sets out the personal consequences of their actions for each of the whistleblowers in turn. This, obviously, relates solely to the particular whistleblower in question.[17]The Commissioner has conducted basic internet searches. The whistleblowing generated a great deal of local media interest and there is still easy access to newspaper reports on those events. These reports name the most senior manager Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 3 involved. There are also reports of earlier investigations on line and, unfortunately, one of the whistleblowers’ identity was disclosed in Council papers by error. The Commissioner is therefore satisfied that some of the main parties discussed in the report can be easily identified. There is also sufficient biographical information about other parties contained in the report which would assist a determined member of the public to identify the job roles of the other individuals concerned. There is a realistic possibility that this information could be combined with information contained in number of internet blogs which focus on the Council, or obtained through other local enquiries, to identify the remaining parties. The Commissioner is therefore satisfied that those parts which relate to mangers and whistleblowers can be combined with other information to identify them. This information constitutes personal data as defined by the DPA.[18]The next question is whether the disclosure of this personal data would breach the first data protection principle. …[21]The request for the report was prompted by an earlier request which resulted in the terms of reference of the report being disclosed. It is clear from these terms of reference that it has been alleged that the names of the whistle blowers were disclosed by Council officers (this is apart from the accidental disclosure of one whistleblower’s name in Council papers, see para 17). One of the issues at the heart of the report is the consequences for the whistleblowers of being identified as such and details the impact on the careers of those whistleblowers. From this it is very clear that being identified as a whistleblower can have serious ramifications. Therefore, having accepted that the contents of the report would allow a determined individual to identify the whistleblowers, the Commissioner is satisfied that its disclosure would renew interest in the issues and so increase the potential for the whistleblowers to suffer discrimination. The Commissioner is satisfied that there is a risk that those involved would have real concerns over the disclosure of this information and would suffer distress as a result.[22]As well as examining the treatment the whistleblowers received from the Council and it is also clear from the terms of reference that its conclusion would assist the Council to determine what if any action it should take to address the situation, including the award of compensation. Commissioning of the report was recognition of the concerns over how the whistleblowers were treated and therefore it would be strange to disclose the report if this was to add to the problems which it is claimed they suffered. In light of this the Commissioner is satisfied that the whistleblowers would not have any expectation that any of their personal data would be disclosed. This is particularly so in respect of the appendix to the report which discusses the impact being a whistleblower has had on their private and family lives.[23]Moving on to the third test of fairness bulleted in paragraph 20, the Commissioner recognises that there is a legitimate interest in the public having access to information that would shed light on the Council’s actions and the conduct of some of its senior officers. The provisions of the Public Interest Disclosure Act 1998 provides protection to whistleblowers and this is recognition of the value of having a mechanism in place which allows employees to raise genuine concerns in a responsible manner. Therefore there is a public interest in disclosing information which reveals how the Council did or did not safeguard the interests of these whistleblowers.[24]However the consequences for the whistleblowers could be significant if their personal data was disclosed. The Commissioner finds that protecting their interests override the public interest in releasing the information. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 4[25]The Commissioner will now consider the personal data of the senior council officers referred to in the report. Although not named in the report itself the Commissioner is satisfied that its disclosure would enable their identification, and in one particular case the officer concerned could be identified by the most rudimentary of internet searches. When considering the fairness to these individuals of disclosing their personal data it is important to note that much of their personal data is inextricably linked to that of the different whistleblowers, so it would be difficult to release it without exposing the whistleblowers to the risks already discussed.[26]The consequences of disclosing the personal data for the senior officers involved would potentially be twofold. It would place the report’s findings in respect of their conduct in the public spotlight again. This could be an uncomfortable and stressful experience for them. Secondly their association with the events in question could have an impact on their professional careers.[27]The issues addressed by the report relate to the professional conduct of these senior officers. The normal expectation of someone who was the subject of allegations about their conduct would be for any investigation to be conducted in confidence and that its findings would only be disclosed to those with responsibility to action any findings. Furthermore, it is very clear from correspondence between one of the officers and the Council that he had no expectation that information about his involvement in these matters would be made public by the report’s disclosure.[28]Looking at the third test, there is an important public interest in understanding the way the Council treated the whistleblowers. However this again has to be balanced against the impact on the senior officers. Although more finely balanced than when applying this test to the case of the whistleblowers, the Commissioner is satisfied that the right of senior officers to have their expectations that an investigation into their actions would remain confidential respected, outweighs the legitimate interest of disclosing the information.[29]In conclusion the Commissioner finds that disclosing the personal data of either the whistleblowers or the senior officers, which is often intertwined, would be unfair and so breach the first data protection principle of the DPA. It is therefore exempt under section 40(2) of the FOIA.[30]Although the Commissioner has found that the Council is entitled to withhold the personal data from the report there is other information within it which does not constitute personal data. It is therefore necessary to consider whether this information can be withheld under section 36…[38]The information being considered under section 36 is that which does not constitute personal data. Although it relates to the whistleblowers, its focus is on the Council and there is insufficient information within it to aid any one identify the whistleblowers. The information is very limited and consists of the reports introduction1, an assessment of the benefits to the Council’s procedures which came about as a result of the whistleblowers’ actions and a very brief conclusion. In total this amounts to a little under three and a half pages, from the total of thirty four pages.”[8]The Council disclosed those parts of the Report which the Commissioner had decided were not exempt.[9]Mr Morton appealed to the First-tier Tribunal (‘FTT’). On 24 October 2017 the President of the FTT (General Regulatory Chamber), with the concurrence of the “1 One sentence from paragraph 4 has been removed under section 40(2) on the basis that its inclusion could assist someone determined to identify the whistleblowers.” Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 5 President of the Administrative Appeals Chamber of the Upper Tribunal, directed that, as Nicholas Warren had been President of the General Regulatory Chamber until a few weeks before he began work on the Report, the case was transferred to the Administrative Appeals Chamber of the Upper Tribunal under Rule 19(3) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2008. The effect of that direction is that the Upper Tribunal considers the appeal at first instance, standing in the shoes of the FTT, and so undertakes a complete reconsideration of the Commissioner’s decision.[10]An oral hearing of the appeal took place before me on 26th April 2018. Mr Morton represented himself and Mr Hopkins of counsel appeared for the Council. I am grateful to them both for their written and oral submissions. The Information Commissioner made written submissions only.[11]I was provided with a bundle of closed material, including the Warren Report, and I conducted a relatively short closed hearing at which Mr Hopkins was able to make submissions by reference to the closed material. I was satisfied that, in accordance with the guidance in Browning v Information Commissioner [2014] 1 WLR 3848 it was strictly necessary to have sight of the closed material and to hear closed submissions in order to determine the issues in the appeal. It was possible to give Mr Morton only a very limited gist of what took place in the closed hearing. Mr Morton did not object to this procedure.[12]Before I had completed my decision, an email was received by the Upper Tribunal from the solicitor for the Information Commissioner notifying the Upper Tribunal and the other parties that he had been contacted by one of the whistleblowers referred to in the Warren Report who had indicated that the whistleblowers would be likely to consent to the release of their personal data. The Commissioner’s solicitor advised the individual to contact the Upper Tribunal directly to confirm the position, and one did so to say that he and three other whistleblowers “would potentially like to see the report made public”. They wished to see the Report first, to enable them to decide. Subsequently the whistleblower asked to participate in the proceedings.[13]Following written submissions from the parties, none of whom thought it either necessary or desirable that the whistleblowers participate in the appeal, on 11th July 2018 I decided that they should not do so and that the Upper Tribunal would determine the appeal in the light of the written and oral submissions of the parties. The whistleblowers were not able to say whether they consented to disclosure of their personal data without seeing the Report but it was not appropriate to order disclosure of the Report to them in order to enable them to firm up their position for the purposes of this appeal. I decided that even if, having seen the Report, they said that they wanted the Report to be made public, that would carry little weight in this appeal because it would be inconsistent with their previous position and because it would not be relevant to disclosure of other data including that which is the mixed personal data of the whistleblowers and council officers. Moreover, the Report was the disputed information with which the appeal is concerned and should not be disclosed prior to determination of the appeal. It was open to the whistleblowers to seek their own personal data under the Data Protection Act. I decided that it was too late for them to seek to participate in the proceedings, it would be unlikely to assist in the determination of the issues in the appeal, and it would cause further delay and expense. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 6[14]As a result of the whistleblowers’ intervention, I had put on hold completion of the decision in the appeal and, as I informed the parties when I gave the above Ruling, due to other judicial commitments and vacation further delay was thereafter unavoidable. I sent the draft decision to the Respondents in order to give them an opportunity to comment on what I was proposing to publish, but they were not permitted to and did not comment on the substance of the draft decision. Mr Morton’s case[15]Mr Morton’s grounds of appeal challenged the Commissioner’s decision regarding section 36(2)(b) as well as section 40(2). However, as the Commissioner had required disclosure of those parts of the Report that did not constitute personal data, by the time of the hearing Mr Morton addressed only the application of section 40(2).[16]Mr Morton provided considerable detail as to some highly contentious issues with which he had been personally concerned, within the Council and the wider political sphere locally. He had been but is no longer employed by the Council, having been made redundant in 2012 but not having attended work for a considerable period of time before that. He had been a whistleblower along with the group of whistleblowers with whom the Warren Report was concerned, in relation to different allegations at an earlier time. He had previously been in regular contact with one of the whistleblowers between November 2010 and January 2015, although he said that he ceased contact with all of them following concerns which he had about their motivation. Specifically, Mr Morton had made complaints of bullying and abuse of power which had led to two investigations and reports in which he was named. In addition, he and other whistleblowers had made allegations of misconduct by Wirral councillors which had resulted in two independent investigation reports, in 2012 and 2015. The other whistleblowers did not participate in those investigations. This is only a flavour of the background provided in considerable detail by Mr Morton. Mr Morton was clear that he did not ask the Upper Tribunal to make findings of fact regarding the allegations. In any event, I am not in a position to do so on the evidence provided.[17]Nonethless, it is apparent from these background matters that the circumstances giving rise to the Warren Report took place in a highly charged political atmosphere which has itself generated a number of concerns held by Mr Morton. He believed that there have been cover-ups regarding misconduct within the Council. He believed that the whistleblowers had not been motivated to act in the public interest but to pursue other political or personal objectives. He questioned why the whistleblowers were willing to cooperate with the Warren Review but not previous investigations into the conduct of councillors which he considers was or may have been criminal. He believed that, in commissioning the Review, the Council was motived by a desire to “pacify a group of whistleblowers without a legal claim for compensation but who have an incriminating recording evidencing Misconduct in Public Office.” He was concerned therefore that the Report may have led to, or may lead to, expenditure of public funds for improper purposes. Mr Morton also had concerns about the appointment of Nicholas Warren to investigate the breach of confidence allegations, because he considered that Nicholas Warren was close to Frank Field MP, who was a close supporter of the whistleblowers. Mr Morton’s concerns had been fed by the refusal to disclose the Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 7 Warren Report and it was against this background that he advanced his grounds of appeal.[18]Mr Morton’s first ground of appeal was that, even if the information in the Report constituted personal data of some of the individuals mentioned (but, he said, not all), the Report could be redacted by deleting names, job titles and the appendix, so as to render identification “extremely remote”. He said that an average member of the public could not identify the whistleblowers, save for the one who had already been publicly identified. That individual could not fairly complain about being identified, given the publicity which he had sought. He accepted that officers could be identified from the Report, but they had already been identified in the Penn Report and in press reports.[19]Mr Morton’s second ground was that it was not unfair to the individuals concerned to disclose the Report. There was no evidence that the whistleblowers had objected to disclosure. Mr Morton challenged the Commissioner’s conclusions regarding likely damage or distress to the individuals. He said that the Commissioner relied on the consequences for an individual of being identified as a whistleblower, but disputed that the individuals in this case were genuine ‘whistleblowers’ acting in the public interest, and said that officers or elected members had not expressed the same concerns as the whistleblowers. Mr Morton pointed to the background and his concerns which I have summarised above.[20]Mr Morton denied that disclosure would impact adversely on the individuals, in the light of the Council’s case that they had done nothing wrong and that the officers had been exonerated. Moreover, given the amount of information which was already in the public domain through the published Penn Report and the Audit Commission report, newspaper articles and the whistleblowers themselves having talked to the press, it was difficult to see why publication of the Warren Report would have any additional adverse impact on them.[21]Moreover, although Mr Morton knew who the individual whistleblowers were, it would be highly unlikely that either he or local journalists would ascertain information which they were not already aware of. He relied on Peter Dun v the Information Commissioner and the National Audit Office (EA/2010/0060) at paragraph 55.[22]Mr Morton further submitted that the whistleblowers had spoken publicly about the issues with which the Warren Report was concerned and that other reports (the Audit Commission report, the Penn Report and the Thynne Reports, to name a few) into matters related to the procurement exercise and surrounding matters had been published, some of them identifying the whistleblowers. He said that they could reasonably have expected the Warren Report, similarly, to be published.[23]He said that the conduct of the whistleblowers indicated that they wanted the Report to be published and, while the question for the tribunal was as to their reasonable expectations rather then their actual wishes, this was evidence of what was reasonably expected. In that regard, Mr Morton relied on press reports that Frank Field MP, who was a supporter of the whistleblowers, had publicly called for publication of the Report and was reported to have said “It is an insult to the whistleblowers and to the people of Wirral, who have a right to know what has been going on”. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 8[24]He submitted that, in the light of their seniority, the officers named in the Report should also have had a reasonable expectation of disclosure. Moreover some of them had already been named in the Penn Report which also set out the allegations against them and evidence relevant to those allegations.[25]Mr Morton submitted that non-disclosure of the Warren Report could not be reconciled with the disclosure of other reports relating to the treatment of him as a whistleblower. In one of those reports, he was named but the names of others were redacted. The report dealt with very personal matters such as his sickness absence and being bullied at work.[26]Mr Morton said that the agreement by Wirral to indemnify the author against defamation claims showed that Wirral acknowledged that the Report would be made public. He said that there was a pressing social need to make the report public, in the interests of openness, accountability and public transparency, as it concerned the performance of public duties by public officials spending public money. The need for publication was made more pressing by the fact that the Report was completed in around October 2015 and yet the negotiations about compensation to the whistleblowers were continuing at the time of the request, and continue to date. This indicated that the issues which the Report addressed were highly contentious and so it was all the more important that the public was told what they were.[27]Mr Morton submitted that there was no other way of achieving the legitimate aim pursued by him. There was no other information available which shed light on the matters about which he was concerned.[28]He submitted that a proportionate approach, recognising the interests of the individual data subjects, would be to disclose the Report but with the redaction of council officer job titles, all names, and the appendix which concerned the impact of whistleblowing on the individuals. The Information Commissioner’s case[29]In written submissions, the Information Commissioner relied on her Decision Notice. In addition the Commissioner submitted that the other reports which referred to the whistleblowers included limited anonymised information, and the report concerning Mr Morton’s whistleblowing related to a separate matter. The Warren Report contained detailed information relating to the whistleblowers and Council officers. Although there have been previous disclosures made in error, the reports generally sought to reduce and anonymise information relating to the whistleblowers. The fact that some information had previously become available did not necessarily indicate that the individuals had consented to or reasonably expected the contents of the Warren Report to enter the public domain. The Warren Report concerned matters which were very personal to the whistleblowers and Council officers involved. The terms of reference said that the Report would be confidential.[30]The Commissioner recognised that there was a legitimate public interest in understanding the way in which the Council treated the whistleblowers, but it was outweighed by the individuals’ right to privacy. Although the case of the senior Council officers was weaker, the information about them was inextricably linked to that of the whistleblowers. Even if disclosure was fair, there is no pressing social need for the personal data contained within the Warren Report to be disclosed Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 9 and disclosure was not warranted in the light of the prejudice to the individuals concerned. Wirral Council’s case[31]For the Council, Mr Hopkins agreed with the Commissioner’s case. He pointed out that Mr Morton knew the identities of at least some of the whistleblowers. Moreover, it was likely that he and others knew which Council managers were referred to in the Warren Report. There had been extensive local publicity about the allegations. It was not possible to preserve the anonymity of any individuals discussed in the Report through redaction.[32]Mr Morton’s case was founded on his beliefs as to the conduct of the whistleblowers, councillors and officers but the Warren Report would not shed any light on those beliefs. Mr Morton placed considerable reliance on his view that the whistleblowers deserved publicity because they had not acted entirely in good faith, but he had not asked the Tribunal to make findings as to that and in any event he had advanced no objective basis upon which the Tribunal could make such a finding of fact. Nor would disclosure shed light on the financial aspects of the Council’s interactions with the whistleblowers. Against that backdrop Mr Hopkins submitted that disclosure of the report would contravene the first data protection principle. It would contravene the Council’s duty of confidence owed to the data subjects and their rights under Article 8 of the European Convention on Human Rights, given their reasonable expectation of privacy. It would cause distress to the whistleblowers, who had done nothing wrong, and to the Council officers who were entitled to put behind them the allegations from which they were exonerated. In any event information about the officers could not be disclosed without revealing information about the whistleblowers. There was no pressing social need justifying the interference with the rights of the data subjects. Legal framework[33]Information within section 40(2) of FOIA is subject to an absolute exemption from the duties under section 1 FOIA. Section 40(2) provided at the relevant time:
“(2) Any information to which a request for information relates is also exempt information if - (a) it constitutes personal data which do not fall within subsection (1), and (b) either the first or the second condition below is satisfied. (3) The first condition is - (a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene – (i) any of the data protection principles...”
[34]In this case Wirral relied on the first data protection principle in Part I of Schedule 1 of DPA:
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless- (a) at least one of the conditions in Schedule 2 is met…”
[35]The decision as to whether disclosure is fair involves striking a balance between the competing interests of the data subject, the data controller, and the wider Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 10 public: Corporate Officer of the House of Commons v Information Commissioner and Norman Baker [2011] 1 Infor LR 935.[36]The Information Commissioner’s guidance provides that relevant considerations are:
“ - the possible consequences of disclosure on the individual; - the reasonable expectations of the individual, taking into account: their expectations both at the time the information was collected and at the time of the request; the nature of the information itself; the circumstances in which the information was obtained; whether the information has been or remains in the public domain; and the FOIA principles of transparency and accountability; and - any legitimate interests in the public having access to the information and the balance between these and the rights and freedoms of the individuals who are the data subjects.”
[37]If disclosure is fair and lawful, then the information may only be processed only if one of the conditions in Schedule 2 applies. It is common ground that the only relevant condition in play in this case is condition 6(1):
“The processing is necessary for the purposes of legitimate interests pursued by...the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
[38]The approach when considering the application of condition 6(1) has been explained by Upper Tribunal Judge Wikeley in Goldsmith International Business School v The Information Commissioner & Home Office [2014] UKUT 0563 (AAC) at [34]-[42] as follows (with citation of authorities omitted):
“35. Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three questions to be asked: (i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”
[36]Proposition 2: The test of “necessity” under stage (ii) must be met before the balancing test under stage (iii) is applied.[37]Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity.[38]Proposition 4: Accordingly the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality, although this may not add much to the ordinary English meaning of the term.[39]Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.[40]Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part test. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 11[41]Proposition 7: Where Article 8 privacy rights are in issue, the question posed under Proposition 1 can only be resolved after considering the excessive interference question posted by stage (iii).” Discussion and conclusions[39]I am considering whether the information was exempt at the time of refusal of the request. At that time, there was a certain amount of relevant information in the public domain. The terms of reference of the Review had been disclosed at the time of the request. These explained the context in which the Review was commissioned. The Audit Commission report is a public document. The Audit Commission report which is in the bundle referred to previous Audit Commission criticisms of the Council’s whistleblowing arrangements, noted that changes had been made by the Council and recommended review of the adequacy of the arrangements and corrective action to be taken. I was not shown the previous findings by the Commission regarding whistleblowing, but it is likely these would have shed further light on how the Council dealt with whistleblowing. The Penn Report addressed the conduct of the procurement exercise in considerable detail, the actions of the whistleblowers and the allegations of detrimental treatment of the whistleblowers.[40]Although the Warren Review was not concerned with the conduct of the procurement exercise, the reports that addressed this provided context to the whistleblowing allegations as well as directly addressing some aspects of the treatment of the whistleblowers.[41]At the relevant time no part of the Warren Report had been published. Following the Information Commissioner’s decision, the Council disclosed the parts of the Report which the Information Commissioner decided were not exempt. Those extracts provide the brief relevant factual background to the procurement exercise in 2008, the fact that the whistleblowers made a disclosure and, when dissatisfied with the Council’s response, went to the Audit Commission, and the broad findings of the Audit Commission that the Council had altered and improved its position as a result. The extract also includes the Conclusion to the Report:
“The Whistleblowers have not received sufficient credit for exposing poor practice within Wirral. The “informal” nature of the first investigation resulted in them having to work under great stress for several months. While they were still Wirral employees, their names were disclosed to their new employer as being in some way untrustworthy. Their health and their jobs were adversely affected over the extended period.”
Personal data[42]The definition of “personal data” in section 1(1) of DPA is as follows:
‘“personal data” means data which relate to a living individual who can be identified – (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.’
[43]The DPA implemented Directive 95/46/EC. The definition of “personal data” in section 1(1) gave effect to recital 26 of the Directive which provided: Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 12 “(26) Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable;…”[44]Redacting names or removing other identifying features will not necessarily render information sufficiently anonymous. In R (Department of Health) v Information Commissioner [2011] EWHC1430 (Admin) Cranston J said at [66] that the assessment of whether identification is likely involves “assessing a range of every day factors, such as the likelihood that particular groups, such as campaigners, and the press, will seek out information of identity and the types of other information, already in the public domain, which could inform the search.”[45]The Information Commissioner’s Anonymisation Code of Practice adopts the test of the ‘motivated intruder’. This includes, at pages 22-23:
“The ‘motivated intruder’ is taken to be a person who starts without any prior knowledge but who wishes to identify the individual from whose personal data the anonymised data has been derived. This test is meant to assess whether the motivated intruder would be successful. The approach assumes that the ‘motivated intruder’ is reasonably competent, has access to resources such as the internet, libraries, and all public documents, and would employ investigative techniques such as making enquiries of people who may have additional knowledge of the identity of the data subject or advertising for anyone with information to come forward. The ‘motivated intruder’ is not assumed to have any specialist knowledge such as computer hacking skills, or to have access to specialist equipment or to resort to criminality such as burglary, to gain access to data that is kept securely. Clearly, some sorts of data will be more attractive to a ‘motivated intruder’ than others. Obvious sources of attraction to an intruder might include … political or activist purposes, eg as part of a campaign against a particular organisation or person…”
[46]This test has been approved by the Upper Tribunal in Information Commissioner v Magherafelt District Council [2013] AACR 14 at [37]-[40] and [87], and more recently by me in Information Commissioner v Miller [2018] UKUT 229 (AAC). It is a useful synthesis of the correct approach in accordance with recital 26 and case law of both the Upper Tribunal and the High Court.[47]As to the level of risk of identification required, the CJEU has said that it should “in reality…be insignificant”: Breyer v Federal Republic of Germany, Case C-582/14, [2017] 1 WLR 1569.[48]Mr Morton knew who the identities of the whistleblowers referred to in the Report. At the hearing he said that he knew the full names of two of them and the first names of two. He had been in touch with them regarding previous matters which were of mutual interest to them. He worked in the Council until 2008 and was employed by the Council until 2012. It is likely that some of the whistleblowers would have been employed at the same time as he was. I have no doubt that Mr Morton would be able to identify the whistleblowers from the information in the Report, even if their names and job titles were redacted. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 13[49]The Warren Report provides enough detailed factual context to enable others who work or have worked in the Council, or who have a knowledge of the background events, to identify the whistleblowers. Even if their names and their job titles were redacted, it is obvious from the Report which departments the individuals worked in. Alternatively, those who worked in or had knowledge of those departments would be able to work it out. The Report gives a sufficient idea of the individuals’ connection with or knowledge of the procurement process to enable a person with working knowledge of the Council to identify them. The Report provides a narrative of the events considered, and it is replete throughout with clues as to the identities of the individuals mentioned.[50]The same is true of the Council officers referred to in the Report. Even if their names and job titles were redacted, anyone with a working knowledge of the Council’s staff and operations would be able to work out who is referred to. Some present or former employees would know about the events surrounding the procurement process and so would be particularly well placed to identify them.[51]I have explained the above by reference to the closed material, in the Confidential Annex.[52]This is not a case in which those “in the know” would only discover that which is already known to them. Any person who knew some of the story would be likely to be provided with information as to the accounts or views of others of which they were not previously aware. Moreover, they would obtain information as to the assessment by Nicholas Warren which they would not previously have been aware of.[53]In relation to both whistleblowers and council officers, an individual with a working knowledge of the Council’s operations would gain added assistance from the Audit Commission report which is and was at the time publicly available. That report refers to events and individuals, by job title, which could be cross-referenced to the Warren Report and provide an additional means of identifying the individuals referred to. For example, the Audit Commission gives the date on which the whistleblowers raised concerns and states which department they worked in. The report specifically identifies the DTS as one of the individuals responsible for the procurement exercise and refers to meetings between the DTS and others, some of whom are identified in part by their role, the dates and purpose of such meetings.[54]The Penn Report also refers by name to the key Council officers including the DTS, and provides a considerable amount of detail as to their roles in the procurement exercise. It considers the allegations made by the whistleblowers and some of the circumstances of making them. It would be easy for someone with a redacted copy of the Warren Report to link the information in that Report to that in the Penn Report and identify the individuals to whom the Warren Report referred.[55]Even if current or former Council employees, or employees of the bidding contractor, were not motivated to attempt to identify the individuals referred to in the Warren Report, I consider it highly likely that an investigative journalist would have been so motivated. The award of the contract and surrounding matters had been a matter of considerable local controversy. There had already been press interest, as evidenced in some of the materials provided to the Upper Tribunal. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 14 The coverage by the Liverpool Echo and the Wirral Globe of the publication of the name of one of the whistleblowers in 2012, which formed the background to the decision to commission the Warren Review, was a clear indication of the press interest. The BBC and the Liverpool Echo covered the Penn Report, named the four officers who had been suspended, and reported that the DTS was to return to work. The particular issue identified in the terms of reference for the Warren Review, namely the treatment of the whistleblowers and whether any further action (which included compensation) should be taken, had been the subject of coverage in the Wirral Globe in October 2014. In January 2015 the Wirral Globe reported on the decision to appoint Nicholas Warren to conduct the Review and the subject matter of the Review, and there was further press coverage in July 2015 regarding the non-publication of the Report, including discussion of the treatment of the whistleblowers, the suspension of four officers, and the outcome of the Penn inquiry.[56]There can be no real doubt that the publication of the Report would have attracted local press interest and it would not take much to prompt a local journalist to dig deeper to identify those referred to in the Report, even if their names and job titles had been removed. There would be a real interest in being able to pick up the story previously covered and link it to the evidence and conclusions in the Report. Thus, even if Mr Morton chose not to investigate further, I am satisfied that others would do so and would be likely to identify some of the individuals referred to.[57]There was no serious suggestion that the data in the Report did not relate to individuals. It touches directly on their privacy, in relation to their personal and professional conduct, their professionalism and probity, and affects or is capable of affecting their reputations. The First Data Protection Principle: Fairness[58]The next question I have to decide is whether disclosure is fair. The Information Commissioner’s guidance cited above is a helpful starting point although of course it is not an exhaustive list of relevant factors and the tribunal should consider any matters which are relevant to the assessment of fairness.[59]First, I consider the possible consequences for the individuals of publication of the Report.[60]The Report, if published, would publicly identify individuals as whistleblowers. When one of the whistleblowers was inadvertently identified in 2013, he said publicly that he was getting phone calls from people asking if he was a whistleblower and that “This will ruin my career. I feel absolutely sick, they are messing around with people’s lives…”. The Review was concerned with the consequences for all the whistleblowers of having being identified as such. They were seeking compensation. It is clear that the whistleblowers considered that the consequences were serious. Disclosure of the Warren Report would identify those individuals as whistleblowers and it was highly likely, given the local interest in the issues as I have already outlined, that there would be renewed interest in the subject matter of the Report and the individuals referred to. This could have resulted in unwelcome contact from others, as had happened in 2013, and could have had repercussions for the individuals in their work. Indeed, Frank Field MP (who had frequently spoken publicly on behalf of the whistleblowers) said to the Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 15 press in January 2015 that their whistleblowing had caused damage to their careers.[61]As far as the Council officers are concerned, the publication of the report would once again place in the public arena the allegations as to their conduct which had already been subject to extensive investigation. They had been suspended and then exonerated. In fairness, they should have been able to treat those matters as closed and get on with their professional and personal lives without the shadow of interest in those matters being aroused again. I agree with the Commissioner that, given the previous media interest in these matters, it is likely that publication would cause stress and anxiety to the individuals, and impact on their present work with possible longer term repercussions for their careers. In reaching this conclusion (as well as in my consideration of the whistleblowers’ expectations, below), I have disregarded the recent contact from the whistleblowers because, as I have explained earlier in these Reasons, their position was tentative and, in any event, shed little if any light on what their position was at the time of request or the refusal of the request.[62]There is also material in the closed bundle at pages 81-82 and 85 which supports these conclusions in relation to both the whistleblowers and the council officers.[63]Next I consider the reasonable expectations of the data subjects.[64]The terms of reference for the Warren Review stated that the Report would be confidential to Wirral Council.[65]The reaction of the one whistleblower in July 2012 and the comments made on behalf of all of the whistleblowers by Frank Field MP is strong indication that they did not expect their identities as whistleblowers to be revealed publicly. The impetus behind the Warren Review was the claim to compensation by all four whistleblowers for breach of confidence. At the time of the refusal of the request for information, the Council was still in negotiations with the whistleblowers regarding compensation. This must all have been premised on their not having consented to or expected that they would be identified. It is largely because of their clearly expressed position at that time that I took the view that their tentative suggestion, when they contacted the Tribunal after the hearing, that they might want the Report to be disclosed cast little if any light on their position at the time of the refusal of the request.[66]In July 2015 the Wirral Globe reported that Frank Field MP was critical of the Council for not having published the Report by then. The press report also citeds from a “spokesman for the whistleblowers” commenting on their “shabby” treatment by the Council and that they had though they “would finally get an answer”, but it did not say that they wanted the Report itself to be made public. It is not clear from this article whether at that time the whistleblowers wished the Report to be made public, in the way that it would if disclosed under FOIA, rather than being made available to them or others on a more limited basis. I do not know what Frank Field meant by “publication”. I do not find this press report particularly helpful in deciding what the whistleblowers would have wanted at the time of the request. It is notable that the whistleblowers did not reveal their identities when speaking with the press, which it seems they did through a “spokesman” and Frank Field. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 16[67]I reject Mr Morton’s suggestion that, because whistleblowers should act in the public interest, they would want the Report to be published in the public interest. It does not follow that, because there is public interest in the subject-matter of a disclosure, there must also be public interest in the identities of the whistleblowers or their treatment.[68]Mr Morton argued that, as the whistleblowers had already been identified as such in previously published reports, they could not have thought that publication of the Warren Report would make any difference to them and it would not have been reasonable for them to have expected that the Warren Report would not be published. I do not agree. The Penn Report did not refer to the whistleblowers by name and, although the inadvertent identification of one of the whistleblowers had occurred by then, the remainder were publicly anonymous at that time and, it appears, remained anonymous. The Audit Commission report did not refer to the whistleblowers by name and it does not appear that they were identified consequent on the publication of that report. The reports relating to the treatment of Mr Morton and the Thynne Reports were concerned with separate matters. Mr Morton has not suggested that he did not consent to publication of the reports concerning him. There has been no suggestion that assurances of confidentiality were given to those who were identified in the other reports, and the clear assurance that the Warren Report would be confidential marked a different approach to that Report as compared to the earlier reports.[69]Mr Morton made similar points in relation to the Council officers’ expectation in the light of the publication of previous reports. I reject this submission. The Audit Commission report contained less detailed information about the relevant Council officers than does the Warren Report. There are significant differences in the scope of inquiry, approach to evidence and fact-finding taken in the Penn Report as compared to that in the Warren Report. Indeed, as I explain in the Confidential Annex, the background of the Penn Report reinforces my conclusion that officers would not have reasonably expected the Warren Report to be published. The other reports to which Mr Morton referred were concerned with separate matters and related to different personnel within the Council.[70]Although the Council officers referred to in the Warren Report held senior positions and so, generally, might have expected their conduct of Council business to be subject to a degree of public scrutiny, their conduct of the procurement exercise had already been scrutinised in the earlier reports. The terms of reference for the Warren Report were agreed against that background. It was reasonable for the officers to rely on the terms of reference giving a clear assurance of confidentiality of the Warren Report. In the Confidential Annex I explain other factors which I take into account in deciding that the expectations of the officers were reasonable.[71]I reject Mr Morton’s submission that the fact that the terms of reference provided for the Council to indemnify Nicholas Warren in the event of a defamation action shows that publication was anticipated. The indemnity clause may well have been inserted in order to cover the possibility of unintended publication.[72]I turn then to the interests of the public in having access to the disputed information. The Information Commissioner and the Council accepted that Mr Morton pursued a legitimate interest in seeking disclosure. I agree with the Commissioner at paragraph 23 of the Decision Notice that there was a public Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 17 interest in having “information that would shed light on the Council’s actions and the conduct of some if its senior officers…information which reveals how the council did or did not safeguard the interests of these whistleblowers”.[73]In addition, Mr Morton said that there was a public interest in having the information because “the alleged detriment suffered by the [whistleblowers should] be open to question and interpretation” and to provide transparency and public accountability regarding compensation payments made out of public funds. I agree with this, in principle. It is important to note that the Warren Report did not address compensation. Nonetheless, at the time of the refusal of the request it may have been thought the conclusions of the Report could have informed subsequent negotiations and decisions as to compensation.[74]I am not clear whether Mr Morton also asserted a legitimate interest in having information about the conduct of the procurement exercise but, if he did, I reject it. The conduct of the procurement exercise was not within the terms of reference of the Warren Review. And to the extent that the Warren Report addressed the conduct of the procurement exercise, there was little if any public interest in those aspects of the Report being disclosed. Those issues had been addressed extensively in other reports which were in the public domain. Moreover, to the extent that the Warren Report expressed views on those issues, these were not soundly based on evidence. I explain this further in the Confidential Annex. The Warren Report sheds no light on Mr Morton’s concerns regarding the appointment of Nicholas Warren.[75]Even if there was substance to Mr Morton’s’s background concerns about the conduct of Council officers or councillors in relation to other matters, not connected with the procurement exercise, the Warren Report is simply irrelevant to those matters and so these cannot add to the weight of the public interest in disclosure.[76]The weight of the arguments in favour of publication is diminished by the fact that there was a considerable amount of material which was already accessible to the public regarding the treatment of the whistleblowers. I have already referred to this.[77]I am satisfied that the public interest in knowing more detail about the treatment of the whistleblowers or the basis of the recommendations in the Report, by disclosure of either the full Report or the Report with redactions as suggested by Mr Morton, was substantially outweighed by the interests of the whistleblowers and the Council officers. My reasons are as follows.[78]Although the expectations of individuals are not determinative, the clear commitment made in the terms of reference to the Report being confidential carries considerable weight. Although Wirral staff were required to cooperate with the Review, many of the data subjects were no longer employed by the Council and it is likely that the commitment to confidentiality would have encouraged some of them to cooperate with the Review. Others chose not to engage with the Review, and this too may have been informed by their belief that the Report would not be published. It would be grossly unfair to them subsequently to publish the Report where they had decided whether and how to engage with the Review in the light of that commitment. Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 18[79]As I have already explained publication was likely to cause considerable damage or distress to the individuals. My assessment is that, taking into account the matters addressed here, this is a weighty factor.[80]In the Confidential Annex I explain why I consider that the expectations of and the consequences of disclosure for one individual are particularly weighty. I also explain, a number of other weighty factors which I take into account in deciding that disclosure of the Report would be unfair. These are:(i) There would be considerable substantive unfairness to that particular individual;(ii) The Warren Report covered issues beyond that indicated by the terms of reference, yet decisions were made as to participation in the Review on the basis of what it was expected to cover;(iii) Therefore factual findings contained in the Warren Report were reached without having relevant evidence having been available.[81]As I have said, these considerations apply with particular force to one individual. The references to that individual are scattered throughout the Report. Even where not expressly referred to, it would be possible to identify that that person or their role was being discussed in large parts of the substantive content of the Report. It is not possible to disentangle those parts of the Report from the remainder. However, my conclusion does not turn solely on the issues related to that individual.[82]There is some considerable doubt whether Nicholas Warren would have approached his investigation as he did had he thought that the Report would be published. His statement at paragraphs 5 and 6 of the disclosed Introduction, that he had not dealt with all the evidence because he wanted to keep the Report short and readable, and that he had used hindsight, suggests that he may have approached the task somewhat differently had he been commissioned to conduct a fact-finding investigation which would be made public. The terms of reference did not suggest that that was the nature or intended purpose of the Review.[83]At the time of refusal of the request discussions between the Council and the whistleblowers regarding possible compensation were still ongoing. It is not clear what the effect of publication of the Report could have been, but it had the potential to interfere with negotiations in relation to private claims. Although any compensation would be paid out of public funds, it would not be in the interests of the parties nor the public interest for negotiations concerning the private rights of the individuals to be conducted in the glare of publicity that would be likely to follow from the publication of the Report and which might distort the outcome of the negotiations.[84]Finally, as set out above, the public had access to some information about the treatment of whistleblowers, recommendations for improvement and the Council’s response.[85]I have considered whether it is possible to identify particular paragraphs or sentences and, by redacting the rest, avoid disclosure of personal data. It is not possible to do this, at least in any sensible and proportionate manner. Personal data is inherent in the content of the Report. If it was removed, all that would be left would be isolated words, phrases or a few sentences which would be meaningless and would not serve any of the interests identified. I would not as a matter of discretion require the Council to go through that exercise. It would be a Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 19 tortuous process, taking much time and effort and leaving little if anything of value. I have explained this in more detail in the Confidential Annex[86]In the light of the above, I have concluded that it would not be fair to disclose the Warren Report. I do not need to consider lawfulness, but to the extent that it involves consideration of interference with article 8 rights, that is in any event addressed below. First data protection principle: condition 6(1)[87]It follows that it is not necessary to go on to consider whether condition 6(1) in Schedule 2 applies. However, I do so for the sake of completeness and to dispel any concern that, had I reached a different conclusion on fairness, it may have affected the overall outcome. It would not, for reasons which I now explain. There is considerable overlap in this appeal between the relevant considerations regarding condition 6(1) and fairness, and given my conclusion on fairness my reasons in this section are brief.[88]I have identified the public interest in publication of the Report, which is clearly legitimate. Mr Morton’s beliefs as to the conduct of the whistleblowers and others, to which I have referred, add nothing of relevance to this.[89]I understand why it might be thought that disclosure of the Report would increase transparency by shedding light on the treatment of the whistleblowers and on the basis on which the Council has approached compensation to them.[90]Whether it is necessary (in the sense discussed in Goldsmith and the authorities cited there) to disclose the Report for those purposes is finely balanced, in the light of what was already in the public domain and my conclusion that the Review did not have all relevant evidence available to it thus casting doubt on whether the Report would truly enlighten the public as to the events covered. I do not consider that knowledge of the content of the Report would substantially enhance the public’s understanding of the relevant events. Whether or not the test of necessity, in the ordinary sense of the word, is satisfied, for these reasons I do not consider that disclosure of the Report would meet a pressing social need. Furthermore and in any event, disclosure would be disproportionate given the excessive interference with the article 8 privacy rights of the individuals involved. This follows from the conclusions that I have already reached in balancing the competing interests for the purpose of deciding fairness. Signed on the original K. Markus QC on 10th September 2018 Judge of the Upper Tribunal Morton v 1. Information Commissioner; 2. Wirral Metropolitan Borough Council [2018] UKUT 295 (AAC) GI/3037/2017 20

Cited in 3 later judgments