The Information Commissioner v Halpin: [2019] UKUT 29 (AAC) [2019] UKUT 29 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2019] UKUT 29 (AAC)Case No GIA/2288/2018, EA/2017/0197
Between
The Information CommissionerAppellantHalpinRespondent
Before
Upper Tribunal Judge K Markus QC TheDate 23 January 2019Category: Information rightsSubcategory: Information rights freedom of information absolute exemptions
[1]This appeal arises from a request made by Mr Halpin to the Devon Partnership NHS Trust (‘the Trust’) under the Freedom of Information Act 2000 (‘FOIA’) for information about two named social workers employed by the Trust. He said:
“I would like to know the dates that they have undertook training for doing assessments under the Care Act 2014 section 9 and also the training they have received for implementation of Care Act 2014 and any qualifications so achieved.”
[2]The Trust refused the request, relying on section 40(2) of FOIA. The Trust’s position, as subsequently explained to the Information Commissioner and which was put before the FTT, was that it considered the level of detail sought would be overly intrusive, that neither individual was a senior manager nor holding a position within the Trust that warranted a greater level of accountability, and that professional registration could be verified by other means through professional bodies. The Trust stated that FOIA requests had been used to target individual members of staff by individuals dissatisfied with the care received and so would normally refuse that level of detail sought, although each case was considered on its merits.[3]The Information Commissioner agreed that that exemption applied. Mr Halpin appealed to the First-tier Tribunal (‘FTT’) which, in a decision dated 24th May 2018, decided that the information was not exempt.[4]I gave the Information Commissioner permission to appeal on two grounds. First, whether the FTT should have taken into account the possibility that, if disclosed, the information could come into the hands of people other than Mr Halpin and the possible consequences for the individual employees should that take place. Second, whether the FTT’s approach to the risks to the individuals was irrational.[5]I gave directions for Mr Halpin to provide a written response to the appeal and for a reply by the Commissioner, with which both parties complied. Mr Halpin sought to make further submissions in response to the Commissioner. By a separate ruling dated 10th January I refused to permit him to make further submissions, for reasons which I explained there. Mr Halpin has continued to communicate with the Upper Tribunal to express his dissatisfaction with the position, but he has put forward nothing which requires me to revisit that ruling. Nonetheless, when Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) GIA/2288/2018 2 considering and deciding this appeal I was alert to the possibility of allowing Mr Halpin to address any new point which arose and which he had not already been able to address. As it turned out, there was no need to do so.[6]Mr Halpin requested that I determine the appeal on the papers, without an oral hearing. He explained his difficulties in participating as a result of his limited financial resources and health issues. The Commissioner requested an oral hearing due to the “complexity of the issues in this case” and argued that holding a hearing in the absence of Mr Halpin, but taking into account his written submissions, would not disadvantage him. I decided to determine the appeal without an oral hearing, for reasons explained in the Ruling of 10th January: in essence, because I did not consider that the issues were of a complexity that called for an oral hearing, the parties had both provided full written submissions, and in the particular circumstances of this case it would not be fair to do so. Legislation and case law[7]FOIA provides for a number of exemptions from the general right to information in section 1(1) FOIA. This case is concerned with the exemption in section 40(2). The effect of this subsection, along with section 40(3) and the relevant provisions of the Data Protection Act 1998 (or, since 24th May 2018, the Data Protection Act 2018 but which makes no material difference for present purposes), is that information which is the personal data of a third party is exempt from disclosure if disclosure would not be compatible with the data protection principles in the Data Protection Act (‘DPA’). It is common ground in this appeal that the information requested is “personal data”.[8]The first data protection principle provides that “personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless (a) at least one of the conditions in Schedule 2 is met”. The condition in question in this case is condition 6(1) which provides “The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”[9]Whether this condition is met involves consideration of three questions (see Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55; [2013] 1 WLR 2421 at [18]):(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?(ii) Is the processing involved necessary for the purposes of those interests?(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?[10]In Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC) Upper Tribunal Judge Wikeley set out eight Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) GIA/2288/2018 3 propositions derived from case law as to the approach to answering the above questions. The Information Commissioner’s decision[11]The Commissioner decided that disclosure of the information would not be fair. Taking into account that the individual social workers did not hold senior positions or public facing roles, disclosing that level of information would not be within their reasonable expectations. Although the Trust had not provided specific evidence in support of its claim that staff had been targeted in the past after releasing information in response to FOIA requests, the Commissioner accepted that the nature of the information could lead to employees being put under unreasonable pressure. The Commissioner accepted there was a general public interest in transparency of public bodies and that, although Mr Halpin had not specified why he was requesting the information, there was a legitimate interest in ensuring that employees are sufficiently trained and qualified to undertake their role. However, there was no specific mandatory training for staff and the Trust had provided assurance that the two employees were suitably trained and qualified. Therefore the Commissioner concluded that disclosure of the information was not of sufficient wider public interest to warrant overriding the rights and expectations of the individuals. The First-tier Tribunal’s decision[12]Before determining the appeal, the FTT had directed Mr Halpin to explain why he wanted the information. It summarised his response in its reasons. Mr Halpin had said that he was a mental health patient, explained some of the risks that he faced, and said that in any appeal against a Care Act assessment the “capacity and skill set” of the assessing officers was highly relevant. He made some general points about the right of patients to be treated by appropriately qualified staff. He did not say that he had been or was to be assessed under the Care Act, nor did he say what if any professional relationship the two employees had to him, although the FTT said “it may be surmised that he has asked for information… because they are, or may become, his social workers (directly or in a managerial capacity) and/or responsible for his needs assessment”.[13]At paragraph 58 the FTT correctly noted that a purely private interest was capable of amounting to a legitimate interest under condition 6(1). The majority of the FTT addressed fairness and the application of condition 6(1) together. They noted the importance to an individual of assessment under the Care Act and of those carrying out the assessments having the necessary skills and being appropriately trained, and of the risks to Mr Halpin if his needs were not properly met. Mr Halpin had a legitimate interest in knowing what training social workers who would be carrying out his assessment had had, and this could not be achieved in a less intrusive way. Therefore disclosure of the information was reasonably necessary to promote that interest. They found that the individuals did not have a reasonable expectation that the information would not be disclosed, in particular because the Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) GIA/2288/2018 4 information was not particularly personal, and that the risk of the individuals being targeted did not outweigh Mr Halpin’s interest in disclosure.[14]The minority member disagreed with the majority in that he considered that disclosure was not warranted in the light of the effects on the individuals of the information being widely available and taking into account that there was no wider public interest in the information being generally available. Submissions[15]I gave permission to appeal on two grounds advanced by the Information Commissioner, both relating to the FTT’s approach to the third question that arises under condition 6(1). Ground 1 is that the FTT did not in substance take into account the effect of disclosure of the information to the world at large. Ground 2 is that the FTT’s approach to the effects of disclosure was irrational.[16]In his submissions sent in response to the appeal, Mr Halpin argues that, as FOIA does not limit the use that a person can make of information provided to them, the effect of the possible uses cannot be relevant to disclosure under FOIA. He says that there are many forms of distress and stress, it is not clear what the Commissioner was concerned with in this case and no evidence of the effects on individuals was provided. He makes various submissions about the reasonableness of his request and that the information relates only to the individuals’ professional roles. He acknowledges that being questioned about qualifications can place strain on an individual but that this comes as part of a professional’s job and is not unreasonable in the circumstances.[17]Mr Halpin says that there is value in information about a person’s qualifications being made publicly available: it may be “a great asset in clinical negligence cases”; activists can use the information to “bring pressure on an organisation to maintain a good service”; and it might assist others in making complaints about services. He challenges the notion of seeking to avoid “inappropriate” complaints, as the complaints process itself will determine appropriateness. Discussion Ground 1.[18]The first substantive question addressed by the FTT was “Does Mr Halpin have a legitimate interest in the information such that disclosure is ‘necessary’”. I note that this elides the first and second questions that arise under Condition 6(1) of Schedule 2 of DPA. The FTT referred to the Information Commissioner’s guidance, “Requests for personal data about public authority employees”, and noted that the guidance stated that “a FOIA disclosure is to the world at large and information released under FOIA is free from any duty of confidence”. Having criticised the Commissioner’s guidance for conflating legitimate interest with prejudice to the rights and freedoms of others (I observe in passing that the criticism in my view is misplaced, but I do not need to address that further here) the FTT continued at paragraph 58 as follows: Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) GIA/2288/2018 5 “…the whole world principle is not inviolable and a measure of common sense needs to be applied to it. The world would only find out the requested information if either the Trust or Mr Halpin publicises it. The Trust controls what it publicises. There would be no obvious motive for Mr Halpin to publicise the information.”[19]The above passage formed part of the FTT’s consideration of whether Mr Halpin had a legitimate interest in the information but it is clear that its approach to what it described as the “whole world principle” also influenced its approach to the third of the three questions arising under Condition 6(1): whether disclosure was unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. In addressing that issue the FTT made no mention of the fact that on disclosure under FOIA the public authority would lose control of the information. Instead the FTT considered solely how Mr Halpin might use the information (paragraphs 75 and 76). The FTT failed to address the possible consequences of the information being disclosed to individuals other than Mr Halpin.[20]This was the wrong approach in law. In GR-N v Information Commissioner and others [2015] UKUT 0449 (AAC), Upper Tribunal Judge Jacobs said at [23] that, in addressing the second and third stages of condition 6(1), it is important to take into account that disclosure under FOIA would be free of any duty of confidence. The FTT’s observations at paragraph 58, cited above, miss the point. On disclosure under FOIA the Trust would no longer control the information and so could not ensure that it was not publicised. Mr Halpin’s reason for wanting the information was relevant to whether his interest was legitimate but not to the potential effects of disclosure to the world at large. In the latter respect, his lack of motivation to publicise the information was irrelevant. It is important to note that section 40(3)(a) of FOIA is concerned with disclosure to “a member of the public” rather than to a particular person or for any particular purpose. In this context there is no significance in the statutory language referring to “a member of the public” rather than the public at large.[21]This error is fundamental to the FTT’s approach to this appeal and the decision cannot stand in the light of it. Ground 2[22]The majority of the FTT addressed the possible effects of disclosure at paragraphs 75 and 76. In summary, the FTT decided that the effects would not constitute an excessive interference in the rights of the data subjects because:
“76. …If someone makes inappropriate complaints, they can no doubt be summarily dismissed. If someone, armed with information, targets individual members of staff for the alleged inadequacy of the care they provide, the merits of the individual case have to determine what happens. The Tribunal, whilst accepting the legitimacy of Mr Halpin’s interest in the requested information, has already commented that he would be unwise to place too much weight on whether particular employees have had particular ongoing training: his use of the information should be proportionate and if it is not he may find that his representations are not heeded.”
[23]This reasoning fails to address the core of the concerns raised by the Trust and accepted by the Information Commissioner. While the Trust may well be able to Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) GIA/2288/2018 6 manage complaints and other issues raised through its own processes, that would not of itself relieve individual staff members of the stress of being made subject to inappropriate complaints nor of being targeted in other ways. The FTT did not address the case which was put before it in this regard and, for that, was in error.[24]It seems to me that the error in the FTT’s approach here is at least in part a consequence of the error identified under Ground 1. As I have said, it is apparent from paragraph 75 that the FTT considered the consequences of disclosure to Mr Halpin only and so did not have in mind that there may be others who are inclined to use the information for other purposes.[25]I fully accept that the case put before the FTT as to the effects of disclosure was rather thin, being based on the Trust’s assertions at page 54 of the FTT bundle, but I cannot conclude that it would have made no difference had the FTT addressed it. It was for the FTT to assess the likely effects of disclosure, affording such weight as it thought appropriate to the Trust’s description of previous experiences. I note the points made by Mr Halpin about the value of disclosure and the possible effects on individuals. Those are points which he may make to the next tribunal. Conclusions[26]In the light of these errors, and in particular the first under Ground 1 which goes to the heart of the FTT’s evaluation of the questions which arise under condition 6(1) in schedule 2 of the DPA, the FTT’s decision must be set aside. I am not able to remake the decision. The appeal will have to be determined again by a different tribunal, and so I have remitted it for that purpose.[27]The next tribunal will consider the appeal afresh. It will not be bound in any way by the findings of the last tribunal. The fact that I have allowed the appeal does not give any indication as to what the result will be next time. That is entirely a matter for the tribunal that considers the appeal. Some other observations[28]In considering the grounds of appeal in this case, I detected a fundamental misconception in the FTT’s approach to the relationship between the DPA and FOIA, and it is appropriate to mention this so as to assist the next FTT in approaching the case on a correct basis.[29]At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”. FOIA creates a general right to information subject to the exemptions in Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) GIA/2288/2018 7 section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”
[30]It seems to me that the FTT’s failure to recognise the different focus of FOIA and the DPA may have led it astray in its assessment of Mr Halpin’s interest in the information, an example being its statement at paragraph 63 that “the point about FOIA is that members of the public are, subject to the exemptions, entitled to information held by public authorities so that they can make their own judgements.”[31]Finally, although when I gave permission to appeal I did not consider that there was an arguable error of law in the FTT’s failure to mention the guidance in Goldsmith, I am concerned that its approach to necessity may have been unduly narrow. The next tribunal would be well-advised to have regard to the Goldsmith guidance which makes it clear that the question whether there are alternative measures (Proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing social need and that there are no other means of meeting it (see the Information Commissioner’s guidance, “Personal information” at paragraph 110).[32]I should make clear that these observations are made for the assistance of the next tribunal. The parties did not make submissions on these points in this appeal and they do not form any part of my reasons for allowing the appeal. Signed on the original K. Markus QC on 23rd January 2019 Judge of the Upper Tribunal

Cited in 5 later judgments