Driver and Vehicle Licensing Agency v Information Commissioner and Williams: [2020] UKUT 334 (AAC) [2020] UKUT 334 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2020] UKUT 334 (AAC)Case No GIA/779/2019
Between
Driver and Vehicle Licensing AgencyAppellantInformation Commissioner 1stRespondent
Before
Upper Tribunal Judge WikeleyDate 26 November 2020Category: Information rightsSubcategory: Information rights freedom of information absolute exemptions, Information rights freedom of information qualified exemptions, Information rights information rights practice and procedure
[1]I direct that the DVLA and the Commissioner should provide the Upper Tribunal with agreed further directions for the disposal of this appeal within 14 days of receiving this decision (including any request that I move any content into or out of the closed decision, or simply disclose the closed reasons as they stand to Mr Williams).[2]Subject to Direction 1 above, the confidential Annex B to this Decision must not be published or disclosed to any person other than the DVLA, the Information Commissioner and the First-tier Tribunal without the permission of the Upper Tribunal, until at least one month after the date this decision is issued to the parties (or such later date as is required by rule 44(4)(b) or (c)) or, if any party seeks permission to appeal against this decision, until final disposal of the permission application and any ensuing appeal or any contrary order by the Court of Appeal. See rule 14 of the Tribunal Procedure (Upper Tribunal) Rules 2008. This decision follows a remote hearing which had been consented to by all the parties. As required, I record that:(a) the form of remote hearing was V (Skype for Business). A face to face hearing was not held because it was not practicable in the light of Government guidance on urgent matters of public health and the case was suitable for remote hearing, involving as it did pure matters of law. Further delay would not be consistent with the overriding objective;(b) the documents that I was referred to were contained in the electronic bundles: the FTT core bundle (649 pp.), the UT core bundle (141 pp.) and the agreed authorities bundle (451 pp.). I was also in part working off the FTT paper file which it was confirmed contained all the same material as the electronic FTT core bundle;(c) the order and decision made are as set out above.

(V) 3 REASONS FOR DECISION Introduction

[1]Disputes over car parking charges are contentious subjects in society at large. This is especially so as regards disputes about financial penalties levied by private land-owners for actual or alleged breach of car parking conditions. When data protection issues are thrown into the pot, the resulting mixture becomes positively combustible. As the DVLA’s witness Mr Robert Toft said in evidence before the First-tier Tribunal, this is “a highly charged area of public debate” (First witness statement at §50). This controversial policy area is the background to the present FOIA appeal.[2]In very broad summary, the appeal raises the following issues. The first matter concerns the proper interpretation of the exemption in section 31 of FOIA (law enforcement) and in particular sections 31(1)(h) read with section 31(2)(a) and (b). This also involves consideration of what is meant by a public authority’s “functions” for the purpose of section 31(1)(h). The second issue revolves around whether the First-tier Tribunal erred in law in refusing the DVLA’s application for permission to rely on a further exemption (section 35, formulation of government policy) at a late stage in the tribunal proceedings. The third area of dispute is whether the Tribunal correctly applied the FOIA exemptions in sections 40(2) (personal data) and 41 (breach of confidence).[3]As explained further below, there are two annexes to this decision. Annex A is a copy of the gist of the closed session before the Upper Tribunal. Annex B (not published with these open reasons) comprises the closed reasons for my decision insofar as they relate to the third area of dispute identified in the previous paragraph. The parties in this appeal[4]The Appellant in this Upper Tribunal appeal is the Driver and Vehicle Licensing Authority (the DVLA). This is an executive agency of the Department for Transport. As the DVLA has no separate legal personality, it is perhaps more accurate to say that the Appellant is the DVLA (Department for Transport). The Appellant is represented by Ms Christina Michalos QC, as it was for the latter part of the proceedings before the First-tier Tribunal, where the DVLA was the Second Respondent.[5]The First Respondent is the Information Commissioner, a role she also had in the First-tier Tribunal proceedings. The Commissioner is represented by Mr Will Perry of Counsel. He has been instructed late in the day in these Upper Tribunal proceedings (owing to the sudden unavailability of the Commissioner’s original barrister).[6]The Second Respondent is Mr Edward Williams, a litigant in person. I think it is fair to describe him (for reasons that will become apparent) as a concerned citizen. He was the Appellant before the First-tier Tribunal and is now the Second Respondent in these proceedings.[7]Given the various changes in roles and hence the scope for possible confusion, I refer to the parties in this decision simply as the DVLA, the Commissioner and Mr Williams.

(V) 4 The remote hearing of this Upper Tribunal appeal

[8]I held a remote hearing of this appeal by Skype for Business on 4 and 5 November 2020. I heard oral submissions at the hearing just as I would have done had we all been sitting ‘face to face’ in the tribunal hearing room. The occasional and very minor IT glitch was resolved by the relevant point being repeated. I am indebted to both counsel and to Mr Williams for their well-focussed oral submissions. DVLA’s appeal was resisted (subject to one small matter of detail) by the Commissioner, and for the most part Mr Williams in turn was content to adopt Mr Perry’s submissions.[9]The hearing and the form in which it was to take place had been notified in the ‘daily cause list’, along with information telling any member of the public or press how they could observe the hearing at the time it took place through Skype for Business. In the event I am satisfied that no member of the public or press sought to attend the hearing. I should add that I directed at the start of the hearing, under s.29ZA(1)(b) of the Tribunals, Courts and Enforcement Act 2007 (inserted by section 55 of, and paragraph 2 of Schedule 25 to, the Coronavirus Act 2020), that the Upper Tribunal was to use its reasonable endeavours to make a recording of these proceedings using the Skype for Business recording facility. This is to be preserved for a reasonable time in case a member of the public wishes to view the proceedings.[10]I was satisfied in all the above circumstances that the hearing therefore constituted a public hearing (with members of the public and press being able to attend and observe the hearing, were they so minded), that no party had been prejudiced and that the open justice principle had been respected.11. In that context I should also record that the remote hearing included a short closed session in the late morning of the second day (dealing with aspects of the two grounds of appeal relating to the third of the First-tier Tribunal’s three decisions). Mr Williams, as the requester, was excluded from the closed session, which was conducted in accordance with the principles and procedure approved by the Court of Appeal in Browning v Information Commissioner and DBIS [2014] EWCA Civ 1050; [2014] 1 WLR 3848. When we returned to the open session, Mr Williams was provided with an agreed oral gist of the closed session, a copy of which he was later sent and which is also appended to this decision as Annex A. The closed reasons are Annex B, but for the time being they remain closed to all concerned save the Upper Tribunal, the First-tier Tribunal, the DVLA and the Commissioner.12. There is one other matter relating to the format of the remote hearing that I should mention in opening. The DVLA had helpfully provided, in accordance with my case management directions, electronic core bundles of the documents before both the First-tier Tribunal and Upper Tribunal respectively. Shortly before the virtual hearing Mr Williams indicated that he considered himself at liberty to publish such materials (e.g. on the web) as a means of soliciting free legal advice to assist him as a litigant in person. This prompted the DVLA to apply for an order under rule 14(1)(a) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698; “the UT Rules 2008”) prohibiting him from doing so. Having considered the parties’ written representations, I issued a ruling in advance of the hearing and granting that application for an order (subject to one minor amendment). In doing so, I indicated at the time that I DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 5 proposed to annex that order to the current decision. In the event, given wider interest in the rule 14 order, I have directed that the rule 14 decision should be issued with a separate NCN and posted on the Upper Tribunal’s website for decisions in its own right (see now DVLA v Information Commissioner and Williams (Rule 14 Order) [2020] UKUT 310 (AAC)). As a result, the rule 14 order is not appended to this Upper Tribunal decision as that would be unnecessary duplication. I direct that the one-month time limit (see rule 44(4) of the UT Rules 2008) for applying for permission to appeal to the Court of Appeal against either the rule 14 order and/or this decision runs from the date this substantive decision is issued to the parties. The background to this appeal[13]The First-tier Tribunal helpfully summarised the background to this appeal as follows (at paragraphs 6-8 of its third and final decision (footnotes have been omitted)): “6. The DVLA provides vehicle keeper details to private entities where they have ‘reasonable cause’ for wanting them. It uses an electronic service for this process called the KADOE (‘Keeper At Date Of Event’) service, which allows authorised organisations (Customers) to obtain vehicle keeper details electronically through an automated system. The facility is provided under the KADOE contract.[7]The terms of the KADOE contract are in the public domain and include provision for disclosure of data received pursuant to the KADOE contract by a Customer to be disclosed to a sub-contractor by that Customer if there is a written contract that requires the sub-contractor as Data Processor of the Customer to abide by:• the requirements in Schedule 2 of the KADOE contract,• the FCA Debt Collection Guidance and• the terms for sub-contractors set out in schedule 3. The prior written agreement of the DVLA is also required.[8]The DVLA became aware in 2015 that some parking companies were providing vehicle keeper information that had been provided by the DVLA to them under the KADOE contract, onwards to MIL Collections Ltd, a debt collection company that buys unpaid debts from private car parking companies. It is the Appellant’s case that these Penalty Charge Notices are then pursued aggressively and unfairly leading to significant additional cost and distress to a motorist. The DVLA commenced an investigation to consider these debt-purchasing arrangements, and whether or not they were done in compliance with the KADOE Contract. This investigation has considered:• Contractual compliance,• The position of the sub-contractor as data controller or processor,• The contractual arrangements between the party to the KADOE Contract (Customer) and MIL Collections Ltd. DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 6 We are satisfied from the oral and written evidence that at the date of the DVLA’s consideration of the request, the investigation was not yet complete.”[14]The First-tier Tribunal also provided a helpful overview of the KADOE scheme in its first decision at paragraphs 20-28. For present purposes it is sufficient to note the explanation provided at paragraphs 20-22 (footnotes again omitted; NB the reference to “s.27” is a reference to regulation 27 of the Road Vehicles (Registration & Licensing) Regulations 2002, considered in more detail at paragraph 32 below): “The KADOE contract[20]An application pursuant to s.27 for vehicle keeper details by private entities can be done manually where a written application is made accompanied by supporting evidence of ‘reasonable cause’ which is checked prior to disclosure. Additionally, the DVLA has set up the KADOE (‘Keeper At Date Of Event’) service, which allows authorised organisations to obtain vehicle keeper details electronically through an automated system.[21]An organisation that wishes to be use the KADOE service must first become a member of an Accredited Trade Association (ATA) and comply with their code of practice, register with the ICO as a data controller and then spend a probationary period using the manual system. During this period the DVLA would monitor how the information was used, whether there were complaints, or if the ATA had concerns. If they pass this level of scrutiny they are approved to use the KADOE service and enter a contract.[22]From the terms of the KADOE contract each ‘customer’ (organisation requesting vehicle keeper details) may use the data supplied under the contract ‘only for the Reasonable Cause for which it was provided’. Once a customer is using the KADOE contract, there is no further check of whether it has reasonable cause to request details each time a new request is made. However, the contract requires the customer to ‘gather evidence to demonstrate that it has Reasonable Cause to request that data…’. This can be subject to audit by the DVLA retrospectively.”[15]The KADOE system is big business: in 2016-17 alone there were over 4 million requests for vehicle registration data. The DVLA’s standard form KADOE contract can be located at https://www.gov.uk/government/publications/kadoe-keeper-of-a-vehicle-at-the-date-of-an-event-contract (or at least a relatively recent version of the contract can be). There is also further information on the KADOE arrangements available at https://kadoe.co.uk/. The FOIA request and the Information Commissioner’s Decision Notice[16]Mr Williams’s original FOIA request, made on 14 February 2017, was clear, short and to the point:
“Please provide all records relating to the action taken by the DVLA to prevent organisations selling driver details accessed under KADOE to MIL Collections Ltd.”
DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 7[17]Mr Williams’s argument – as he explained in forthright terms at the virtual hearing – is that the DVLA has been responsible for “a major leak” of personal data. He contended that the KADOE contract represented a “respectable fig-leaf” for the DVLA’s failure to ensure that private entities had “reasonable cause” to be provided with vehicle registration data. I simply observe that those wider issues are not directly before me. I am also conscious that MIL Collections Ltd are not a party to these proceedings. Accordingly, I make no findings in that regard.[18]The DVLA refused to provide the information requested by Mr Williams, citing FOIA section 31(1)(g) and (2)(b) (law enforcement). It maintained that refusal on internal review. Mr Williams then filed a complaint with the Commissioner. In Decision Notice [DN] FS50685170 (dated 14 August 2017), she agreed with the DVLA both that section 31(1)(g) and (2)(b) were engaged and that the public interest favoured maintaining the exemption. However, as we shall see, the Commissioner later abandoned that stance as regards the engagement of section 31. The appeal by Mr Williams to the First-tier Tribunal[19]On 15 August 2017, Mr Williams appealed to the First-tier Tribunal against the Commissioner’s DN. He set out six grounds of appeal, the first of which was as follows:
“DVLA is not concerned with law enforcement within the meaning of FOIA. There is no suggestion that DVLA is investigating crime. The ICO decision does not state what law it thinks the DVLA wants to enforce and how that law has been broken. The ICO did not make a finding that the DVLA is a law enforcement agency.”
[20]Mr Williams’s other grounds of appeal were concerned with the public interest balancing test and the adequacy of the Commissioner’s reasons. They need not be rehearsed here as they do not directly bear on the issues raised by DVLA’s further appeal to the Upper Tribunal. The adjudication history and the DVLA’s grounds of appeal in summary[21]This appeal has had what Ms Michalos QC has rightly described as a “somewhat convoluted procedural history” (DVLA skeleton argument at §3). In the event, the First-tier Tribunal issued three separate decisions on different aspects of Mr Williams’s appeal. There were then subsequently four permission determinations (one in the First-tier Tribunal and three in the Upper Tribunal), dealing with DVLA’s various grounds of appeal to the Upper Tribunal, resulting in what are now seven discrete grounds of appeal on which permission has been given (grounds 1-6 and 9, while grounds 7 and 8 were dismissed as not being arguable). It may assist at the outset to see the issues set out diagrammatically in summary form: DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 8 Date of FTT decision FOIA provisions in issue in appeal FOIA exemption DVLA grounds of appeal(1) 26 June 2018 FOIA s.31(1)(g) and s.31(2)(a) & (b) Law enforcement Grounds 1, 2 & 3(2) 21 August 2018 FOIA s.35 Government policy Grounds 4 & 5(3) 2 January 2019 FOIA ss.40 and 41 Personal data and breach of confidence Grounds 6 & 9[22]For obvious reasons, the First-tier Tribunal decisions of 26 June 2018, 21 August 2018 and 2 January 2019 are from now on called the First Decision, the Second Decision and the Third Decision respectively. The First Decision followed an oral hearing on 9 March 2018. The Second and Third Decisions were issued after consideration of the parties’ written submissions and without any further oral hearings. The headline findings from each of those Decisions are as follows.[23]In its First Decision, the First-tier Tribunal, allowing Mr Williams’s appeal against the Commissioner’s DN, concluded that the law enforcement exemption (FOIA section 31(1)(g) read with (2)(a) and (b)) was not engaged by the requested information.[24]In its Second Decision, the First-tier Tribunal allowed the DVLA’s application to amend the grounds of its response to include FOIA section 41 (breach of confidence) but refused its parallel application to rely on FOIA section 35 (government policy).[25]In its Third Decision, the First-tier Tribunal held that some information was exempt from disclosure pursuant to section 41 as well as under section 40(2) (personal data, an issue which had been raised by the Commissioner). This Decision, unlike the two earlier Decisions, included both an open decision and a closed annex; the latter sought to identify both the information required to be disclosed and that which should be withheld.[26]It seems to me the most helpful way to proceed is to consider each of the First-tier Tribunal’s component decisions in turn and in that way to address the relevant grounds of appeal as they arise. For convenience, I also summarise the various grounds of appeal under the respective headings for each of the three decisions. The First-tier Tribunal’s First Decision The three grounds of appeal in relation to the First-tier Tribunal’s First Decision Ground (1): The Tribunal erred in its construction of the word “functions” in s.31(1)(g) in that it construed the word too narrowly; wrongly drew an illusory distinction between ‘a power’ and ‘a function’; and wrongly concluded that the DVLA was not exercising its functions. Ground (2): The Tribunal erred in(a) concluding that s.31(1)(g) and (2)(b) [the purpose of ascertaining whether any person is responsible for any conduct DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 9 which is improper] were not engaged and(b) failing to adequately consider s.31(2)(b) separately from s.31(2)(a). Ground (3): The Tribunal erred in (a) concluding that s.31(1)(g) and (2)(a) [the purpose of ascertaining whether any person has failed to comply with the law] were not engaged and (b) failing to adequately consider s.31(2)(a) separately from s.31(2)(b).[27]These grounds of appeal in large part concern the proper analysis of the intersection between the relevant FOIA legislation (s.31) and the legislation governing vehicle registration data. The relevant FOIA legislation[28]The FOIA legislation in issue here is section 31, a qualified exemption. For reasons that will become apparent, it is helpful to set out the text of this exemption in full, although the present appeal only turns on those provisions which are highlighted in bold: “31.— Law enforcement(1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— (a) the prevention or detection of crime, (b) the apprehension or prosecution of offenders, (c) the administration of justice, (d) the assessment or collection of any tax or duty or of any imposition of a similar nature, (e) the operation of the immigration controls, (f) the maintenance of security and good order in prisons or in other institutions where persons are lawfully detained, (g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2), (h) any civil proceedings which are brought by or on behalf of a public authority and arise out of an investigation conducted, for any of the purposes specified in subsection (2), by or on behalf of the authority by virtue of Her Majesty's prerogative or by virtue of powers conferred by or under an enactment, or (i) any inquiry held under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 to the extent that the inquiry arises out of an investigation conducted, for any of the purposes specified in subsection (2), by or on behalf of the authority by virtue of Her Majesty's prerogative or by virtue of powers conferred by or under an enactment.(2) The purposes referred to in subsection (1)(g) to (i) are— (a) the purpose of ascertaining whether any person has failed to comply with the law, DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 10 (b) the purpose of ascertaining whether any person is responsible for any conduct which is improper, (c) the purpose of ascertaining whether circumstances which would justify regulatory action in pursuance of any enactment exist or may arise, (d) the purpose of ascertaining a person's fitness or competence in relation to the management of bodies corporate or in relation to any profession or other activity which he is, or seeks to become, authorised to carry on, (e) the purpose of ascertaining the cause of an accident, (f) the purpose of protecting charities against misconduct or mismanagement (whether by trustees or other persons) in their administration, (g) the purpose of protecting the property of charities from loss or misapplication, (h) the purpose of recovering the property of charities, (i) the purpose of securing the health, safety and welfare of persons at work, and (j) the purpose of protecting persons other than persons at work against risk to health or safety arising out of or in connection with the actions of persons at work.(3) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would, or would be likely to, prejudice any of the matters mentioned in subsection (1).[29]A helpful starting point is Ms Michalos’s submission that, as a matter of general principle, FOIA qualified exemptions (such as section 31) should be given a reasonably broad interpretation. The justification for this approach is that once the qualified exemption or gateway is engaged, the public interest balancing exercise (mandated by section 2(2)(b) of FOIA) then operates so as to ensure that disclosure will not be prevented without good reason. In support of this proposition, Ms Michalos relied upon DES v Information Commissioner and The Evening Standard (EA/2006/0006) (and in particular the passage at paragraph 53). I am not sure this takes Ms Michalos that far. In the first place, it is a decision of a first instance tribunal, and so carries no precedential status, being at best persuasive (see further paragraph 47 below). Furthermore, and more importantly, the tribunal in that case was dealing with section 35 of FOIA, which includes some very general and open-textured language, e.g. “relates to … the formulation or development of government policy”. This language stands in stark contrast to the more prescriptive drafting of section 31, which carefully sets out nine specific public goods in section 31(1), three of which (namely section 31(2)((g)-(i)) are then further defined by reference to the ten purposes specified in section 31(2). Given the very different drafting styles (of say sections 31 and 35), I consider the most that can be said is that some qualified exemptions will justify a broader construction than others.

(V) 11

[30]The proper interpretation of section 31 of FOIA itself is considered further in relation to the grounds of appeal relating to the First Decision. These grounds also involve consideration of the relevant vehicle registration legislation. The relevant vehicle registration legislation[31]The relevant vehicle registration statutory provisions involve both primary and secondary legislation. Section 22 of the Vehicle Excise and Registration Act 1994 [“the 1994 Act”] (or the relevant subsections for present purposes) provides as follows:
“22.— Registration regulations (1) The Secretary of State may by regulations— (a) make provision with respect to the registration of vehicles (including, in particular, the form of and the particulars to be included in the register of trade licences), … (c) provide for making any particulars contained in the register available for use by the persons prescribed by the regulations on payment, in cases so prescribed, of a fee of such amount as appears to the Secretary of State reasonable in the circumstances of the case, …”
[32]The Road Vehicles (Registration & Licensing) Regulations 2002 (SI 2002/2742) [“the 2002 Regulations”] were made under the 1994 Act. The relevant provisions of regulation 27 state as follows:
“27.— Disclosure of registration and licensing particulars (1) The Secretary of State may make any particulars contained in the register available for use— … (e) by any person who can show to the satisfaction of the Secretary of State that he has reasonable cause for wanting the particulars to be made available to him. (2) Particulars may be provided to such a person as is mentioned in paragraph (1)(e) on payment of such fee, if any, of such amount as appears to the Secretary of State reasonable in the circumstances of the case.”
[33]Section 22(1)(a) of the 1994 Act accordingly empowers the Secretary of State to make provision for the vehicle keepers registration scheme with which all motorists are familiar. Section 22(1)(c) then enables regulations to “provide for making any particulars contained in the register available for use by the persons prescribed by the regulations” and on payment of a fee as appropriate. Regulation 27(1)(a)-(d) of the 2002 Regulations (not extracted in the legislative citation above) unsurprisingly and understandably enable the Secretary of State to release vehicle registration data to a range of state actors, namely the police, HMRC and (in certain defined circumstances) local authorities. Regulation 27(1)(e) is the exception, in that it authorises the transfer of such data to the private sector, but only to “any person who can show to the satisfaction of the DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 12 Secretary of State that he has reasonable cause for wanting the particulars to be made available to him” (emphasis added). This formulation has the exercise of a statutory discretion written all over it.[34]As Edis J explained in R (on the application of Duff) v Secretary of State for Transport and The Master, Fellows and Scholars of Trinity College, Cambridge [2015] EWHC 1605 (an authority helpfully unearthed by Mr Williams in his researches, albeit one for which I have abbreviated the even more lengthy formal title for the first interested party):
“…The extra category in sub-paragraph (e) allows the Secretary to State to decide whether the applicant has a ‘reasonable cause’ for wanting the information. This, says Mr. Toft, is usually understood to relate to circumstances where the use of the vehicle has given rise to an alleged liability. This might include private individuals who claim to have suffered damage as a result of the use of a vehicle in an accident, insurance companies who seek to establish the identity of a tortfeasor, or petrol stations who have suffered loss as a result of fuel having been stolen from them. The majority of such requests are made by parking management companies who seek information in order to take enforcement action including the issuing of a parking charge notice or proceedings for trespass or breach of contract.”
[35]Having sketched the legislative context for the Tribunal’s First Decision, I turn to consider the DVLA’s first three grounds of appeal.[36]Ground (1): The Tribunal erred in its construction of the word “functions” in s.31(1)(g) in that it construed the word too narrowly; wrongly drew an illusory distinction between ‘a power’ and ‘a function’; and wrongly concluded that the DVLA was not exercising its functions.[37]The first two elements of this ground of appeal – that the Tribunal construed “functions” too narrowly and drew an unwarranted distinction between “functions” and “powers” can conveniently be taken together.[38]Before the First-tier Tribunal, the DVLA relied on section 22 of the 1994 Act and regulation 27 of the 2002 Regulations “as the statutory basis of the functions which it argues would be prejudiced by disclosure of the requested information” (First Decision, paragraph 17). The Tribunal in turn helpfully and concisely identified the respective positions of DVLA and the Commissioner in the following terms, also in its First Decision: “35. The DVLA argue that the function (disclosure of the information with reasonable cause) imposes a duty on DVLA to protect the vehicle and owner’s details against risks arising out of its provision of information; therefore that anything conducive or incidental to the function constitutes part of the function. The DVLA argue that the Tribunal should apply a broad interpretation of function as the subsequent public interest test (once the exemption is engaged) provides contextual limitation.[36]Whereas the Commissioner (who does not dispute the DVLA’s power to do things incidental and conducive to the discharge of those functions), maintains that they are not themselves the functions of the authority because they are not sufficiently linked to the issue of disclosure on the grounds of reasonable cause.” DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 13[39]The First-tier Tribunal adopted the Commissioner’s approach, ruling that “the construction of s.31(1)(g) comes down to whether an activity is within the power of an authority or whether it is a function” (First Decision at paragraph 37). Accordingly, the Tribunal concluded that a public authority’s powers and functions were not necessarily coterminous. In determining what constituted a “function”, the Tribunal adopted the formulation of Upper Tribunal Judge Turnbull in Stevenson v Information Commissioner and North Lancashire PCT [2013] UKUT 181 (AAC),1 namely that: “‘Functions’ must be understood as meaning any power or duty exercised by a public authority for a specified purpose whether conferred by or under statute, the common law or the Royal Prerogative” (see Stevenson at paragraph 55(3); emphasis, where the underlining occurs in the second place, added by the Tribunal at paragraph 37 of its First Decision).[40]Ms Michalos’s submission was that the Tribunal had misinterpreted Stevenson, not least as the passage cited from paragraph 55(3) was in fact part of the record of the parties’ arguments, rather than an integral part of the Upper Tribunal’s reasoning. In addition, it was said that insofar as Stevenson suggested that “functions” must be qualified by reference to purposes, that reading involved an error of law. Judge Turnbull’s decision, so it was said, had effectively read (the following underlined) words into section 31(1)(g), so that it stated instead: “the exercise by any public authority of its functions where those functions are conferred for any of the purposes specified in subsection (2)”.[41]I do not consider that the First-tier Tribunal misdirected itself as to the approach taken in Stevenson (which, of course, was binding on it). The passage it cited from paragraph 55(3) was indeed taken from counsel’s submissions in that case, but they were subsequently adopted by Judge Turnbull in his own reasoning (at paragraph 72). Nor do I consider that the Judge’s reading necessarily involved the interposing of the words as underlined in the previous paragraph. The reading in of that additional phrase would simply be tautologous. In addition, not every facet of the exercise of a public authority’s functions will necessarily be captured by the purposes enumerated in section 31(2) (see Stevenson at paragraphs 79 and 83). Judge Turnbull’s comparison with the position of a private employer was not premised on the scope of FOIA – rather, the Judge was making an analytical point about the interaction of the functions under section 31(1)(g) with the powers specified under section 31(2).[42]In adopting the Stevenson formulation, the Tribunal decided that the Commissioner was not imposing a “restrictive gloss”; rather the DVLA’s interpretation involved an unwarranted extension of the meaning of “function”. If the DVLA’s reading were adopted, then the scope of section 31(1)(g) would be opened up to encompass all of a public authority’s activities – not just the functions assigned to it, but also any incidental powers or functions. 1 The decision is listed as WS v Information Commissioner and North Lancashire PCT on the Upper Tribunal’s website and Bailii. It is not clear why this is so, given there appears to be no r.14 anonymity order in place and the decision was an appeal from the FTT decision in Stevenson v Information Commissioner and North Lancashire PCT EA/2011/0119, which is also readily available on Bailii, together with several of Mr Stevenson’s other appeals on related matters.

(V) 14

[43]The Tribunal further noted DVLA’s reliance on Schedule 2 of the KADOE contract, “which imports a requirement that a subcontract must ensure data must only be used for the reasonable cause for which it was obtained”. DVLA’s case was that this demonstrated that the DVLA investigation was centred on ‘reasonable cause’. The core of the Tribunal’s reasoning on this point was set out at paragraph 38 of the First Decision (see further below), where the Tribunal concluded that “Whilst establishing compliance with a contract is within the powers of the DVLA it is not part of its function.” Ms Michalos’s submission was that the Tribunal was setting up a false dichotomy between functions and powers in so ruling. She deployed the following principal arguments in support of this submission.[44]First, Ms Michalos argued that the Tribunal’s approach failed to follow the decision of the House of Lords in Hazell v Hammersmith and Fulham London Borough Council [1992] 2 AC 1, where it was held – in relation to the word “functions” in section 111 of the Local Government Act 1972 (“the 1972 Act”) – that functions embraced “all the duties and powers of a local authority; the sum total of the activities Parliament has entrusted to it” (per Lord Templeman at 29E-F). In her submission, Hazell was authority for the proposition that the term “functions” necessarily includes both duties and powers.[45]Taken at face value, the above extract from Hazell would indeed appear to be supportive of DVLA’s case. However, on closer examination that support falls away. As Mr Perry pointed out, the whole premise of the decision in Hazell was that there are powers that are part of a local authority’s functions and there are other powers that are ancillary to, or incidental to, those functions but not part of them. That much is evident from section 111(1) of the 1972 Act itself, which provides that “a local authority shall have power to do any thing … which is calculated to facilitate, or is conducive or incidental to, the discharge of any of their functions”. Thus, the statutory provision under consideration by the House of Lords in Hazell is predicated on the distinction drawn by Mr Perry. If all a local authority’s powers were part of its functions, there would be no need for section 111 in the first place. Stevenson (at paragraphs 78-79) likewise is premised on the view that a public authority may have the power to engage in an activity (listed within section 31(2)) but if that is not one of its functions then section 31(1)(g) is not engaged. This is juristically significant and not, as Ms Michalos would have me believe, a case of the Tribunal “slipping a cigarette paper” between the respective senses of “functions” in section 31 of FOIA and section 111 of the 1972 Act.[46]Second, DVLA placed reliance on other First-tier Tribunal decisions on section 31 which were said to be consistent with the broader approach it advocated. For example, Galloway v Information Commissioner (EA/2008/0036) [2009] BMLR 50 at [43] – [45] was a case where the tribunal deemed an NHS trust’s functions to include common law duties to investigate. Similarly, in Ryanair v Information Commissioner (EA/2012/0088 at [56]) the OFT’s functions were treated as including not just its statutory powers but the ancillary functions in relation to the collection of information.[47]The short answer to this submission is two-fold. These decisions are fact-specific and based on the evidence before those tribunals. They cannot be used to try and buttress a submission based on legal principle. Furthermore, and in any event, these first instance tribunal decisions have no status as precedents DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 15 (see further London Borough of Camden v Information Commissioner & YV [2012] UKUT 190 (AAC) at paragraph 20 and O’Hanlon v Information Commissioner [2019] UKUT 34 (AAC) at paragraph 17).[48]Third, Ms Michalos further submitted that the Tribunal’s interpretation of section 31(1)(g) was untenable in light of the wording of the following paragraph, section 31(1)(h), which is limited by reference to “Her Majesty’s prerogative or…powers conferred by or under an enactment” (see paragraph 28 above). As Parliament had decided to limit section 31(1)(h) to specified legal functions and had decided not to do so for section 31(1)(g), it was therefore inconsistent with Parliamentary intention to read into sub-paragraph (g) such an artificial limitation. However, section 31(1)(h) is concerned with purposes and powers, but makes no mention of functions as such. Moreover, as shown above, and properly understood, it is not all of a public authority’s powers that fall within the concept of its functions.[49]Finally, the DVLA argument that section 31 was broadly framed and widely worded also drew attention to the use of the word “any” in two places in section 31(1)(g), as in “the exercise by any public authority of its functions for any of the purposes specified in subsection (2)”. However, neither “any” can bear the weight that Ms Michalos sought to ascribe to them. As Mr Perry observed, the first “any” is simply to demonstrate that section 31(1)(g) does not apply solely to traditional law enforcement agencies (and so can include a PCT – see e.g. Stevenson). In like manner, the second “any” is stylistic, intended to show that any one of the several purposes in subsection (2) suffices. Thus, the word “one” or indeed the words “any one” could equally well have been substituted for the second “any”. Reliance on observations in Cabinet Office v Information Commissioner and Morland [2018] UKUT 67 (AAC); [2018] AACR 28 (at paragraph 18) as to the breadth of the word “any” does not assist, not least as the term served a very different purpose in the statutory context under consideration in that appeal.[50]The final limb of this ground of appeal was the claim that the Tribunal had wrongly concluded that the DVLA was not exercising its functions when carrying out its investigation into the way that car parking companies were acting under the contractual KADOE arrangements. The DVLA’s case, in essence, was that it was implicit in regulation 27 that it “must assess whether the requesting body will use this information for, and only for, a justified reason. It is also implicit that the DVLA must take steps to ensure it is not used beyond the authorised purpose nor turn a blind eye to situations where it is or may be used beyond it” (DVLA skeleton argument at §31.1). Accordingly, it was argued, the DVLA’s investigation took place pursuant to its implied function under regulation 27, and this function fell within section 31(1)(g).[51]The Tribunal disagreed. The core of the Tribunal’s reasoning on this point was set out at paragraph 38 of the First Decision:
“38. We are satisfied that any retrospective assessment of ‘reasonable cause’ would be immaterial here as the DVLA do not suggest that the customer did not have reasonable cause at the time of disclosure to them by DVLA. Although the Tribunal heard evidence relating to the totality of the DVLA’s audit and investigatory process, it is apparent to us from Mr Toft’s evidence and the wording of the information request that the focus DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 16 of the investigation is the onward subsequent use of information already disclosed under [reg.] 27(1)(e) which arises apart from the validity of any original reasonable cause. In our judgment, retrospective analysis whilst administratively relevant (relating to whether the KADOE contract can be used for future disclosures) is not material to whether future disclosures will themselves have reasonable cause since those facts have not yet arisen. As such it relates to the administrative framework for the method of disclosure and compliance with contract terms and the DPA [Data Protection Act] and not [reg.] 27(1)(e). Whilst establishing compliance with a contract is within the powers of the DVLA it is not part of its function.”
[52]On the further appeal to the Upper Tribunal, the DVLA’s case was that the Tribunal’s analysis, as well as being unduly narrow as regards the construction of section 31 (a submission rejected above), led to an untenable result: “It would mean that Regulation 27 conferred a power to provide access to a public authority database, consisting of data provided by compulsion of law, subject to strict safeguards as to access; but granted no power or function to ensure observance of those safeguards nor any protection to investigations seeking to ensure observance of those safeguards (notwithstanding the fact that the investigation may lead to a removal of Regulation 27 access)” (DVLA skeleton argument at §31.3).[53]The prime difficulty with this submission, as the First-tier Tribunal correctly identified, is that neither section 22 nor regulation 27 refer in any way to the subsequent monitoring of contracting parties or regulation of the onward use of vehicle registration data. The focus of section 22 is exclusively on the provision of information; as Mr Perry noted, it is not worded generally enough to include subsequent monitoring or regulation. The same is true of regulation 27, where the focus is on the circumstances in which such data may be disclosed. However desirable as a matter of good governance, there is no suggestion it includes ‘downstream’ audit as to the uses to which such data are put.[54]In this regard the DVLA also placed considerable emphasis on its gatekeeping role in ensuring there was “reasonable cause” within regulation 27(1)(e). As Mr Perry further observed, the DVLA’s characterisation of its role as a ‘gatekeeper’ is a useful one. The DVLA is tasked by legislation with providing vehicle registration information. Once the information has passed through the gate, the DVLA’s statutory function (under section 22 and regulation 27) is exhausted. The function of providing data to private entities who have “reasonable cause” is in part fulfilled through the KADOE contract. This requires those private sector organisations which contract with the DVLA to agree to use the information supplied only for the reasonable cause for which it was provided and in accordance with data protection legislation. However, the absence of any statutory function of monitoring and regulation is precisely why DVLA had to grant itself the express contractual powers e.g. to conduct investigations as to the onward use of data (see KADOE contract clauses D11.1-D11.6 and compare clauses B2.1 and B2.2). These investigations by definition only occur after the data has been provided under the KADOE arrangements, i.e. after the regulation 27(1)(e) function of providing information has been exercised. It follows that such ex post facto investigations cannot be the exercise of that statutory function. To use an idiom from a different age of transportation, it is a case of closing the stable door after the horse has bolted. As the Tribunal neatly DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 17 put it, “Whilst establishing compliance with a contract is within the powers of the DVLA it is not part of its function” (see paragraph 51 above).[55]It follows that Ground 1 does not succeed.[56]Ground (2): The Tribunal erred in(a) concluding that s.31(1)(g) and (2)(b) [the purpose of ascertaining whether any person is responsible for any conduct which is improper] were not engaged and(b) failing to adequately consider s.31(2)(b) separately from s.31(2)(a).[57]The main thrust of this ground of appeal (Ground 2(a)) is the submission that the First-tier Tribunal erred in its approach to section 31(1)(g) taken in conjunction with section 31(2)(b). Read together, and shorn of other provisions within section 31 which are not in point, the relevant statutory text is as follows:
“31.— Law enforcement (1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— … (g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2), (2) The purposes referred to in subsection (1)(g) to (i) are— (a) … (b) the purpose of ascertaining whether any person is responsible for any conduct which is improper.”
[58]The starting point is the finding in relation to Ground 1 above, namely that the DVLA’s investigation for the purpose of monitoring compliance is one of its powers but not one of its functions, properly so called. Even if the Tribunal was wrong about that, and such monitoring did involve the exercise of one of its functions, then the question arises as to whether it was for “the purpose of ascertaining whether any person is responsible for any conduct which is improper” within section 31(2)(b).[59]I start with the DVLA’s more general submission that section 31, as a qualified exemption, should be given a reasonably broad interpretation. This argument has already been addressed above in the context of Ground 1 (see above paragraph 29 and see further paragraphs 37-49). The same observations apply equally here. The fact is that section 31(2) sets out a total of ten specific purposes (see paragraphs (a)-(j) inclusive) that may apply for the purposes of section 31(1)(g)-(i) inclusive. It is an important tenet of statutory interpretation that the legislative wording in issue must be read in its context. Here, the context comprises ten specifically enumerated purposes. That level of statutory detail does not suggest that there is any warrant for giving each individual purpose an especially broad construction. Rather, the parliamentary intention would appear to be one of making some quite fine distinctions.[60]Section 31(2)(b) itself then raises two questions of definition at the outset: what is meant by “ascertaining” responsibility and what is meant by conduct which is “improper”? DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 18[61]“Ascertaining” is a term which appears in both section 31(2)(b) and (2)(a) – and indeed it is also used to qualify the other purposes set out in section 32(2) under heads (c)-(e) inclusive. There is no reason why “ascertaining” in the present context should mean anything different to its meaning in those other sub-paragraphs, and every good reason why it should be understood in the same way wherever it appears in section 31(2).[62]The First-tier Tribunal, relying on Stevenson (discussed above), concluded that to “ascertain” whether any person was responsible meant “to determine the issue” (paragraph 46). In short, the Tribunal continued, “although the DVLA argue that they are not an ‘ordinary’ data controller the results or conclusions of any investigation into data protection breaches will ultimately be determined by another organisation” – typically, of course, the Commissioner (or the courts) in the context of data protection.[63]On the basis of the ordinary English meaning of the word, and without needing to refer to the OED definitions which Mr Perry proffered, my initial response was that the Tribunal has correctly identified the meaning of to “ascertain”, namely to determine or decide an issue. That construction makes sense when read across the five paragraphs (a) to (e) in section 31(2). So, by way of example, section 31(2)(e) provides that section 31(1)(g) may come into play where the public authority is acting with “the purpose of ascertaining the cause of an accident” – and not “the purpose of collating evidence to enable the HSE to ascertain the cause of an accident”.[64]However, Ms Michalos submitted that the Tribunal had taken too strict a reading of “ascertaining” and one which was inconsistent with the case law. In this context she relied in particular upon dicta in Stevenson and also in Waugh v Rotherham NHS Foundation Trust (EA/2012/0145).[65]As regards the former authority, Ms Michalos sought reliance on the following passage in Judge Turnbull’s decision in Stevenson, arguing that it demonstrated that section 31(2)(b) could be deployed even where other regulators took the final decision (e.g. as to ascertaining whether a person was responsible for some issue): “75. The words ‘law enforcement’ were in my judgment intended as a broad summary or indication of the scope of and reason for the exemptions in section 31. It is plain from reading the activities listed in s.31(1), and the purposes specified in s.31(2), that they include activities and purposes which go beyond actual law enforcement in the sense of taking civil or criminal or regulatory proceedings. They include a wide variety of activities which can be regarded as in aid of or related to the enforcement of(i) the criminal law,(ii) any regulatory regime established by statute,(iii) professional and other disciplinary codes,(iv) standards of fitness and competence for acting as a company director or other manager of a corporate body(v) aspects of the law relating to charities and their property and(vi) standards of health and safety at work.[76]In my judgment the PCTs were a sufficiently important part of the overall structure designed to ensure a safe healthcare system to mean that inclusion of their functions of monitoring and improving the standard of healthcare within s.31(1)(g) and 31(2)(j) is consistent with the use of the words ‘law enforcement’ in the title. Those words were necessarily only a DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 19 very broad summary of the content of the section 31. It is entirely possible, indeed, that the carrying out by the PCT of its functions might lead directly to the taking of regulatory action by the CQC or even action by the HSE.”[66]As such, Ms Michalos submitted, the DVLA is within the ‘investigative arc’ for the purposes of e.g. data protection legislation, even if the ultimate regulator in that respect is the Commissioner.[67]However, I agree with Mr Perry that Stevenson does not support a general proposition that a public authority which assists a regulator can necessarily rely on section 31(1)(g) in conjunction with section 31(2)(a) or (b).

(g) read together with (in that case) section 31(2)(j):

“79. First, in my view they can apply only where protection of the public against health and safety risks are among the public authority’s purposes. It is in my judgment probably not sufficient that, in the course of carrying out its purposes (being purposes not directly related to health and safety), a public authority engages in some activity for health and safety reasons. Thus, I think that 31(1)(g) and 31(2)(e) (‘the purpose of ascertaining the cause of an accident’) would probably not apply to, for example, an internal investigation by a public authority, having no responsibility for investigating accidents more generally, as to why an accident to one of its employees had occurred. The public authority would in that example be doing no more than any private employer might do, and the fact that it was exercising statutory powers or powers given to it by its constitution would not bring the case within the words ‘the exercise by any public authority of its functions for …… the purpose of investigating an accident.’ Similarly, in my view a public authority whose purposes have nothing to do with health or safety at work could not pray s.31(1)(g) and 31(2)(i) in aid in relation to measures which it was intending to take for the health and safety of its own employees. It may well be that for this reason … the Bousfield case … was correctly decided on its facts. This is essentially the limitation for which the IC argued in its written submission in this appeal. The PCT in the present case clearly satisfies this condition.”
[68]The answer accordingly, if frustratingly, is ‘it all depends’. There is no ‘one size fits all’ approach. In each case it is a fact-specific enquiry to identify whether the public authority is “ascertaining” responsibility rather than e.g. simply gathering evidence for a regulator which then does the ascertaining. However, the Tribunal here was entitled to reach the conclusion it did. The DVLA is plainly a major data controller but it is not analogous to the PCT in Stevenson, given that the DVLA has no formal responsibility or role for ensuring compliance with KADOE (ultimately a matter for the courts), with the DPA 2018 (an issue for the Commissioner and the courts) or with the relevant Codes of Practice (a question for the relevant trade associations).[69]Ms Michalos also prayed in aid the first instance decision in Waugh, where the tribunal had expressed the view (at paragraph 27) that “the Commissioner adopted far too strict an interpretation of the word ‘ascertaining’”, there also in the context of section 31(2)(b). Mr Perry contended that the tribunal’s reasoning was too cursory and that it was unclear whether it was making a fact-specific DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 20 conclusion or seeking to lay down a broader legal principle. I would go further than that. As a decision of the First-tier Tribunal, Waugh carries no precedential weight (see above at paragraph 47) – and, in any event, the comment about “ascertaining” was by the way, as the appeal was in fact decided on an entirely separate point (see paragraph 24). Much more persuasive (albeit again not determinative) is the First-tier Tribunal’s analysis in Foreign and Commonwealth Office v Information Commissioner (EA/2011/0011), where it expressed the view that “the word ‘ascertain’ connotes some element of determination with regard to non-compliance with the law or responsibility for conduct which is otherwise improper” (at paragraph 33).[70]My conclusion, therefore, is that on closer examination neither Stevenson nor Waugh provides Ms Michalos with any assistance as to the meaning of “ascertaining”.[71]Even if – which I find is not the case – the DVLA were exercising its functions for the purpose of ascertaining something, that something would have to be “whether any person is responsible for any conduct which is improper”. “Improper”, unlike “ascertaining”, is a term which only appears in section 31(2)(b), and so does not appear elsewhere in the definitions of the various purposes enumerated in section 31(2). The meaning of the concept of “improper conduct” (or, strictly, “conduct which is improper”) in the FOIA legislative scheme does not appear to be the subject of any decided case law. The Commissioner’s own guidance, on which Ms Michalos placed reliance, states that it “relates to how people conduct themselves professionally. For conduct to be improper it must be more serious than simply poor performance. It implies behaviour that is unethical” (see the ICO guidance on FOIA, Law enforcement (section 31), at §50).[72]In this respect the First-tier Tribunal reasoned as follows:
“45. We are not satisfied that breach of contract falls within the definition of ‘improper conduct’. Breaches of contract can occur for a multitude of reasons including a misunderstanding of the law or misconstruction of the contract term. It is a civil wrong for which there is a civil remedy. The same applies to a breach of the ATA codes.”
[73]Ms Michalos submitted that the Tribunal had erred in law in taking that approach. She argued that the DVLA investigation necessarily fell within the scope of section 31(2)(b), as it was not simply an investigation into a potential breach of contract. Rather, as she put it in her skeleton argument (at §43):
“… In issue was a DVLA investigation into whether the actions of the parking companies in disclosing data obtained from DVLA when assigning (selling) debt cases to debt collection companies was improper or unlawful. The alleged breaches being investigated were not extraneous clauses, or breach of an ordinary commercial contract, but rather breaches that went to the heart of the DVLA’s public law duty to ensure that this database containing data of the general public was accessible and used only for the specified and agreed purpose/s….”
[74]Thus, Ms Michalos contended – having taken me through some of its key contractual terms – that KADOE required parties to comply with the law more generally (e.g. data protection legislation). Moreover, the onward transmission DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 21 of personal data in breach of the DPA 2018 could only be characterised as “improper conduct”. Such disclosure in the absence of the “reasonable cause” required by regulation 27 was necessarily improper. The statutory test under section 31(2)(b), she stressed, was improper conduct and not unlawful conduct.[75]There are at least three difficulties with the DVLA’s submission. The first is that it is circular in that it assumes what it seeks to prove. The second is that the “reasonable cause” issue is no more and no less than an issue of statutory discretion. It is not a question of propriety for the purposes of section 31(2)(b) (or indeed compliance with the law for the purpose of section 31(2)(a)). The third is that, quite simply, the DVLA is not in the business of ascertaining or determining whether a particular company acted in an unethical or unprofessional manner. The DVLA seeks to stretch the concept of “improper conduct” too far, as the First-tier Tribunal recognised in its reasoning. It is entirely understandable (and proper) that the DVLA wishes to ensure that the KADOE service is being used in accordance with the terms of that contract, but ultimately, shorn of all the noise, that is a contractual matter between it and its service users. Any breach may give rise to a civil breach remediable by a civil action between the parties.[76]It follows that the First-tier Tribunal was entitled to arrive at its conclusion that the DVLA was not exercising one of its functions “for the purpose of ascertaining whether any person is responsible for any conduct which is improper” within section 31(2)(b).[77]A subsidiary limb to this ground of appeal (i.e. Ground 2(b)) is the contention that the Tribunal erred in law in its First Decision by failing to consider section 31(2)(b) separately from section 31(2)(a). This can be dealt with quite shortly. On p.12 of its First Decision, the Tribunal posed itself the following question by way of a heading: whether DVLA exercises this function ‘for’ either the purpose specified in s.31(2)(a) or s.31(2)(b) (my emphasis by underlining added). It summarised the issues and its conclusion in paragraph 39. It then reviewed the DVLA’s submissions at paragraphs 40-44. Its own reasoning is summarised in paragraphs 45 (as regards section 31(2)(b)) and 46 (principally but not exclusively as regards section 31(2)(a)). That reasoning must be read in context, that context being both its prior conclusion on the ‘functions’ point under section 31(1)(g) and the backdrop of its discussion of the DVLA’s submissions on section 31(2)(a) and (b).[78]I also remind myself that the principles governing appellate review of adequacy of reasoning in tribunals are common across the board. In the context of employment tribunal proceedings, they were helpfully expressed as follows by the Employment Appeal Tribunal (EAT, Elias J (as he then was) presiding) in ASLEF v Brady [2006] IRLR 576 at para [55] (and the same principles apply equally here):
“The EAT must respect the factual findings of the Employment Tribunal and should not strain to identify an error merely because it is unhappy with any factual conclusions; it should not ‘use a fine toothcomb’ to subject the reasons of the Employment Tribunal to unrealistically detailed scrutiny so as to find artificial defects; it is not necessary for the Tribunal to make findings on all matters of dispute before them nor to recount all the evidence, so that it cannot be assumed that the EAT sees all the DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 22 evidence; and infelicities or even legal inaccuracies in particular sentences in the decision will not render the decision itself defective if the Tribunal has essentially properly directed itself on the relevant law.”
[79]There is a fuller and helpful discussion of the relevant authorities on adequacy of reasoning by Upper Tribunal Judge Markus QC in Oxford Phoenix Innovation Ltd v Information Commissioner and the Medicines and Healthcare Products Regulatory Agency [2018] UKUT 192 (AAC) at paragraphs 49-54. Reading paragraphs 39-46 of the First Decision as a whole, and acknowledging that the First-tier Tribunal had already dealt exhaustively with the section 31(1)(g) ‘functions’ point, the discussion on the two heads of section 31(2) comfortably meets that standard for adequacy of reasons. The reasons give rise to no suggestion that the Tribunal in some way conflated the juristically separate issues raised by section 31(2)(a) and (b) respectively. Indeed, quite the contrary as the heading and paragraph 39 spell out the Tribunal’s acceptance that the two heads were in the alternative – and the fact that they were dealt with for the purposes of presentation under the same heading is neither here nor there. Some overlap in the analysis was inevitable given the drafting deployment of “ascertaining” in both the relevant sub-paragraphs under section 31(2). This is, moreover, a First-tier Tribunal decision and its drafting should not be measured against the exacting linguistic standards expected of primary or secondary legislation.[80]Finally, the DVLA sought to rely on a different Commissioner’s DN under reference FS50693758 (dated 6 February 2018). In that instance the Commissioner had expressed the view that an “efficient audit process” was part and parcel of the DVLA’s functions flowing from regulation 27 (see DN paragraph 20). As such, the ICO accepted in that case that the section 31(1)(g) exemption could in principle be engaged (albeit on the facts of that case it was not). But the mere fact that the Commissioner took a different approach in another case cannot assist the DVLA here. Obviously, the Commissioner’s DN under reference FS50693758 in no way bound the Tribunal. In addition, as the Commissioner had pointed out in an e-mail to the Tribunal and parties (6 March 2018), the other DN had not been subject to ICO policy department analysis or review, whereas a review had been conducted in the instant case. If DN FS50693758 were subjected to the same review process, it was entirely possible that on reflection the Commissioner might change her stance on the conclusion about the DVLA’s functions in that case as well.[81]It follows from all of the above that I agree with Mr Perry and Mr Williams that neither limb of Ground 2 is made out.[82]Ground (3): The Tribunal erred in(a) concluding that s.31(1)(g) and (2)(a) [the purpose of ascertaining whether any person has failed to comply with the law] were not engaged and(b) failing to adequately consider s.31(2)(a) separately from s.31(2)(b).[83]The main thrust of this ground of appeal (Ground 3(a)) is the submission that the First-tier Tribunal erred in its approach to section 31(1)(g) read in conjunction with section 31(2)(a):
“31.— Law enforcement DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 23 (1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this Act would, or would be likely to, prejudice— … (g) the exercise by any public authority of its functions for any of the purposes specified in subsection (2), (2) The purposes referred to in subsection (1)(g) to (i) are— (a) the purpose of ascertaining whether any person has failed to comply with the law.”
[84]As with Ground 2, the starting point is the finding in relation to Ground 1 above, namely that the DVLA’s investigation for the purpose of monitoring compliance is one of its powers but not one of its functions, properly so called. Even if the Tribunal was wrong about that, and such monitoring did involve the exercise of one of its functions, then the question arises as to whether it was for “the purpose of ascertaining whether any person has failed to comply with the law” within section 32(1)(a). Thus, the purpose under section 31(2)(a) involves the “ascertaining” of something, the same verb as appears in the text of section 31(2)(b), discussed above. The analysis in paragraphs 61-70 above therefore applies in equal measure here.[85]Before the First-tier Tribunal the DVLA relied on two matters to demonstrate that section 31(2)(a) was engaged. The first was that data protection legislation made it an offence to obtain information unlawfully e.g. by stating it was wanted for one reasonable and lawful purpose when actually it is wanted for another illegitimate or unlawful purpose. The second, drawing on regulation 27, was its argument that in handling vehicle keeper data the DVLA was not acting as an ‘ordinary’ data controller as it had to be satisfied that the requesting person had “reasonable cause” for wanting the information.[86]The First-tier Tribunal agreed with the Commissioner’s submission, which distinguished “between ‘contractual compliance’ which is within the remit of the DVLA but does not constitute compliance with ‘the law’ and data protection breaches which are not a function of the DVLA but are a function of the Information Commissioner” (at paragraph 46).[87]Ms Michalos’s challenge to the Tribunal’s conclusion proceeded on two main fronts. The first turned on the meaning and proper application of ‘ascertain’, a submission which has already been considered above. The second was to reiterate the two arguments outlined in paragraph 85 above.[88]However, I accept the Commissioner’s submission that section 31(2)(a) should be interpreted relatively restrictively. It applies to those bodies entrusted with the specific function of ascertaining whether there has been a failure to comply with the law. As already noted above at paragraph 68, the DVLA has no regulatory responsibility for ensuring compliance with KADOE, the DPA 2018 or the trade associations’ Codes of Practice. Whilst undeniably a large data controller, the DVLA is not a part of the regulatory structure (contrast the PCT in Stevenson). Simply because a public authority may be assisting a regulator does not mean that it can invoke section 31(1)(g) in conjunction with section 31(2). Extending the scope of section 31(2)(a) to include a public authority DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 24 which seeks to determine whether there has been a breach of contract (however egregious) to which it is just one party would significantly extend the reach of the provision and go well beyond its ordinary meaning.[89]Finally, at least as regards the First Decision, Ground 3(b) – that the Tribunal erred in law by failing to consider section 31(2)(a) separately from section 31(2)(b) – fails for the same reason as the converse argument in Ground 2(b) (see above paragraphs 77-79).[90]It follows from all of the above that I agree with Mr Perry and Mr Williams that neither limb of Ground 3 is made out. The First-tier Tribunal’s Second Decision Introduction[91]The Tribunal’s Second Decision was its ruling to refuse the DVLA permission to rely in addition on section 35 of FOIA as a further exemption in relation to Mr Williams’s original request for information (although DVLA was allowed to rely on section 41 (breach of confidence)). The two grounds of appeal in relation to the First-tier Tribunal’s Second Decision Ground (4): The Tribunal erred in failing to grant permission to the DVLA to amend to rely on the additional ground of the exemption under s.35 (government policy) and failed to give any weight or consideration to the merits of the proposed amendment or its relative importance to the public authority. Ground (5): The Second Decision was internally inconsistent, did not comply with the overriding objective and was punitive to the DVLA because the Tribunal granted permission to amend to rely on s.41 and s.40 but refused permission to rely on s.35 in circumstances where the reasons for the late application and consequences to the parties were the same. The relevant FOIA legislation[92]The context to this ground of appeal is section 35, which concerns the formulation of government policy, and (as with section 31) is a qualified exemption (emphasis added):
“35.— Formulation of government policy, etc (1) Information held by a government department or by the Welsh Government is exempt information if it relates to— (a) the formulation or development of government policy, (b) Ministerial communications, (c) the provision of advice by any of the Law Officers or any request for the provision of such advice, or (d) the operation of any Ministerial private office.”
[93]Ground (4): The Tribunal erred in failing to grant permission to the DVLA to amend to rely on the additional ground of the exemption under s.35 (government policy) and failed to give any weight or consideration to the merits of the proposed amendment or its relative importance to the public authority.

(V) 25

[94]Ms Michalos’s central submission was that the First-tier Tribunal had acted fundamentally unfairly by refusing to allow the DVLA to amend its response so as to rely additionally on section 35 (government policy) in resisting Mr Williams’s appeal. Ms Michalos summarised the submission in her skeleton argument on grounds 4 and 5 as follows:
“50. Justice and fairness lie at the core of these grounds of appeal. It is a longstanding principle of fairness that amendments to a case should generally be permitted to enable a tribunal to adjudicate upon the matters in dispute. This is all the more so where in issue is freedom of information and there is an application to rely on s.35 (government policy). Any prejudice to the requester could be addressed by a short timetable; conversely, the prejudice to the public body if an exemption that actually applies is not even considered is potentially irremediable if disclosure of the information is permitted without regard to the wider impact.”
[95]In both her written submissions and her opening oral submissions on these two grounds of appeal, Ms Michalos placed great emphasis on the sequence of events in the week immediately leading up to the First-tier Tribunal’s hearing on Friday 9 March 2018. The events unfolded as follows. In this respect, and in line with the Upper Tribunal’s inquisitorial approach, I have reviewed the first instance bundle and not simply relied on the points made in oral submissions at the Upper Tribunal hearing:a. On Monday 5 March 2018 the DVLA e-mailed a letter to the First-tier Tribunal headed Urgent: application to adjourn the hearing on 9 March 2018 – Please bring this application urgently to the judge’s attention (I note this application was not e-mailed until 23:16 on 5 March, so in effect it was made on Tuesday 6 March). This letter explained that the DVLA was seeking to rely on two further exemptions, being sections 35 and 41 of FOIA.b. On Tuesday 6 March 2018 (at 11:22) Mr Williams replied to the effect that he did not consent to an adjournment, not least as there had already been one postponement.c. On Tuesday 6 March 2018 (at 12:09) the Commissioner indicated she was neutral as regard the application for an adjournment and referred to a number of considerations.d. On Wednesday 7 March 2018 (at 10:08) the GRC Registrar issued detailed case management directions (running to 3 pages) refusing the DVLA’s applications both for an adjournment and to add reliance on sections 35 and 41 (amongst other matters).e. On Wednesday 7 March 2018 (at 11:55) the DVLA applied under rule 4(3) for the Registrar’s directions to be reconsidered by a judge.f. On Thursday 8 March 2018 the First-tier Tribunal Judge issued directions to the effect that the hearing would go ahead on the Friday to consider the section 31 point. Furthermore, if the DVLA was unsuccessful on that point, the Judge indicated the Tribunal would hear oral argument as to whether DVLA should be permitted to rely on the additional exemptions.g. On Friday 9 March 2018 the First-tier Tribunal heard extensive oral argument on the section 31 point and made directions that the DVLA re-check its records DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 26 with regard to information that fell within the scope of Mr Williams’s original FOIA request. This was affirmed by the Judge’s directions dated 16 March 2018, which also confirmed that the DVLA’s application to amend its response so as to permit reliance on sections 35 and 41 remained outstanding and was yet to be determined.[96]However, the somewhat fraught exchanges between the parties in the course of the week of the First-tier Tribunal hearing cannot be viewed in isolation.[97]Going back several steps, the case files reveal the following chronology of key events:a. On 14 August 2017 the Commissioner issued her Decision Notice.b. On 15 August 2017 Mr Williams promptly lodged his appeal with the First-tier Tribunal.c. On 22 September 2017 the Commissioner filed her response, seeking to uphold her DN and (at that stage) supporting the DVLA’s reliance on section 31(1)(g) in conjunction with section 31(2)(b).d. On 13 November 2017 the DVLA filed its response to the appeal, which sought to rely additionally on section 31(2)(c) in conjunction with section 31(1)(h) (although this was explained only in closed submissions).e. On 25 November 2017 Mr Williams filed his reply to the responses.f. On 15 December 2017 the DVLA filed further submissions elaborating on its reliance on section 31(1)(g) with 31(2)(b) and now raising for the first time section 31(2)(a) (but also resiling from any reliance on section 31(2)(c)).g. On 12 January 2018 the Commissioner filed further submissions to the effect that section 31(1)(g) (in association with section 31(2)(b)) was not engaged.h. On 17 January 2018 the GRC Registrar issued detailed case management directions for the appeal, from which it was clear that reliance on any newly claimed exemptions would need the Tribunal’s permission (see e.g. paragraph 12).i. On 23 February 2018 the Commissioner filed further submissions to the effect that section 31(1)(g) (in association with section 31(2)(a)) was not engaged.j. On 1 March 2018 the Commissioner filed her skeleton argument, reaffirming that she took the view that the exemption in section 31(1)(g) was not engaged with either section 31(2)(a) or (b).[98]Ms Michalos has sought to rely on the Commissioner’s change of position on section 31 as being prejudicial to the DVLA and justifying the late application to amend its response to include reliance on section 35. I deal with this point in more detail later. However, at this stage it is sufficient to note that the writing was on the wall for the DVLA on 12 January 2018. This was the date on which the Commissioner had made it clear that, in her view, and contrary to her original position, section 31(1)(g) (in association with section 31(2)(b)) – i.e. the basis of her DN – was not in fact engaged. It was also some seven weeks before the week of the hearing – and I note the hearing date of 9 March 2018 had been confirmed in the Registrar’s case management directions of 17 January 2018. The Registrar also set out the parties’ positions in some detail and the need to seek permission for any new grounds to be argued (paragraphs DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 27 9-12). As the Tribunal’s Second Decision later observed, “Although the Commissioner’s response to s.31(2)(a) was not yet received at this date there was no indication at this time that the Commissioner agreed with the DVLA” (paragraph 10(xi)). Against that factual matrix, the following conclusion reached by the Tribunal in its Second Decision was plainly one that was open to it:
“14. The Tribunal Judge notes that it was apparent from 17.1.18 that the Appellant challenged the applicability of both s.31 exemptions and by that date the Commissioner had: • already indicated that she had reversed her position as regards to s.31(2)(b) • never indicated that she agreed with the applicability of s.31(2)(a) and as such there was no basis for the DVLA to assume that their case on this exemption would be supported by the ICO. As such their arguments that they were taken by surprise at a late stage by the Commissioner’s change of position is rejected by the Tribunal Judge.”
[99]In the event the First-tier Tribunal did not determine the DVLA’s application to rely on sections 35 and 41 at the hearing on 9 March 2018 but deferred the matter until later. The Tribunal’s First Decision (dated 26 June 2018) included further directions for any additional written representations to be made. This was followed by more procedural skirmishing between DVLA and Mr Williams over time limits. Eventually the Tribunal’s Second Decision, allowing the DVLA application to rely on section 41 but refusing the application in respect of section 35, was issued on 21 August 2018.[100]Aside from the chronology, there is one other matter I should address at the outset. Ms Michalos stressed that her submissions involved no personal criticism of the GRC Registrar herself. Rather, it was DVLA’s case that the Tribunal had made a series of procedural rulings, the cumulative effect of which had resulted in unfairness to the public authority. Ms Michalos submitted that ― given(i) the pressing time constraints;(ii) the DVLA’s specific request that the matter be put before a judge; and(iii) any ruling about reliance on sections 35 and 41 affected DVLA’s substantive rights ― then the DVLA application should in the first instance have been placed directly before a judge and not a registrar. It was, Ms Michalos argued, a registrar’s function to deal with ‘routine’ case management directions such as those relating to extensions of time and the provision of bundles.[101]I cannot accept that last proposition, which fails to give proper weight to the role of the GRC Registrars (who, I understand, are legally qualified). The Senior President of Tribunals has issued a Practice Statement on the Delegation of Functions to Registrar and Tribunal Caseworkers on or after 29 September 2017 in the First-tier Tribunal (General Regulatory Chamber) (dated 25 September 2017). The schema is clear. In short, it is GRC Tribunal Caseworkers who may make case management directions on what are, with respect, relatively low-level (or ‘routine’) issues such as extensions of time and the provision of documents (paragraph 2(a) and 2(b)). Tribunal Registrars in the GRC, on the other hand, have much wider case management powers (see paragraph 4(a)-4(p)), including the power to exercise any case management DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 28 powers under rule 5 and indeed the potentially draconian power to strike out proceedings under rule 8. The former by definition includes the power to permit a party to amend any document (see rule 5(3)(c)). The Practice Statement makes further provision on an application by any party for a Caseworker’s directions to be reviewed by a Registrar (see paragraph 3 and rule 4(3)) and for a Registrar’s directions in turn to be reviewed by a Judge (see paragraph 5 and rule 4(3)).[102]It follows that a GRC Registrar is certainly empowered to make case management directions which may affect a party’s substantive rights, subject only to review by a GRC Judge (or on appeal to the Upper Tribunal, if the rule 4(3) procedure is not initiated – if the rule 4(3) procedure is followed, the right of appeal is typically against the reviewing judge’s decision).[103]Thus, the suggestion that the First-tier Tribunal acted unfairly by taking no action on the DVLA’s request that the applications should be put before a judge, as a matter of urgency, is unpersuasive for reasons of both principle and practice.[104]On the issue of principle, the allocation of judicial (and quasi-judicial) resource is a matter for the First-tier Tribunal’s Chamber President to determine within the framework established by the legislation and the Senior President’s Practice Statement. For his part, Mr Williams, whatever he might insist (and he has not suggested as much to me), should have no reason to expect that any late application he might make should be placed directly before a judge when the GRC has a clear framework for managing interlocutory work. I struggle to see why the public authority should be in any better position. To give the DVLA a procedural advantage in this respect would hardly be consistent with the principle of equality of arms. As I have observed previously (albeit in a slightly different context), and notwithstanding the undoubted importance of the issues involved in terms of the public interest, “that does not mean Government departments are entitled to a free pass to the next level of the appellate hierarchy” (see Cabinet Office v Information Commissioner and Lamb [2016] UKUT 476 (AAC) at paragraph 36).[105]As a matter of practice, I am also aware that like many tribunals the GRC is heavily reliant on fee-paid part-time tribunal judges whose first commitment is necessarily to their ‘day job’ and who may well not be readily available to deal with the incessant ‘drip, drip, drip’ of interlocutory applications in those FOIA proceedings that are being fiercely contested. Furthermore, at the time in question I believe (and take judicial notice of the fact) that the Chamber had just one salaried judge and one registrar in post. In those circumstances it was entirely reasonable for applications for an adjournment and to rely on new exemptions should be considered in the first instance by a registrar. Indeed, in many cases at the interlocutory stage the registrar may be much more familiar with the case and the history of the previous case management directions than a fee-paid judge charged with presiding at the appeal hearing itself.[106]The DVLA’s submissions on this ground of appeal at times strayed into a substantive challenge to the First-tier Tribunal’s decision in the preceding week not to adjourn the hearing on 9 March 2018. Certainly, as noted above at paragraph 95d, the GRC Registrar refused the adjournment application on 7 March and the Judge affirmed this ruling (by necessary implication at least) in DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 29 her directions on 8 March. I simply make two observations. First, the DVLA has not been granted permission to appeal the Tribunal’s refusal of an adjournment – its fourth and fifth grounds of appeal are exclusively directed to the Tribunal’s refusal to permit reliance on the additional section 35 exemption. Secondly, and in any event, the refusal of the adjournment was well within the range of reasonable case management decisions that the Tribunal could take – it may have been robust, but it was not unfair.[107]The DVLA advanced a series of further arguments as to why it was said that the First-tier Tribunal had erred in law in refusing to grant the amendment to rely on section 35.[108]First, Ms Michalos relied on the well-known dicta in Cobbold v Greenwich LBC ([1999] EWCA Civ 2074 per Peter Gibson LJ), arguing that the Tribunal failed to place any real weight on the fundamental principle set out therein or to apply it:
“Amendments in general ought to be allowed so that the real dispute between the parties can be adjudicated upon provided that any prejudice to the other party or parties caused by the amendment can be compensated for in costs, and the public interest in the efficient administration of justice is not significantly harmed.”
[109]This submission is not persuasive. The application of this principle will always be fact- and context-specific. For example, Cobbold v Greenwich LBC itself was a case in which “the claimant has been well aware for many months of the point which Greenwich wished to take … That Greenwich should have sought leave to amend to plead this point did not take the claimant by surprise.” The circumstances of the present FOIA appeal were very different, as is evident from the chronology above. Accordingly, as the Court of Appeal subsequently observed in Swain-Mason v Mills & Reeve [2011] EWCA Civ 14, [2011] 1 WLR 2735, the statement from Cobbold v Greenwich LBC “does not provide sure guidance in a case such as this where the amendment had not been prepared for well in advance but came out of the blue, and where permitting the amendment to be made did require the trial to be adjourned” (at paragraph [85]). In addition, and in any event, the Court of Appeal’s statement of general principle in Cobbold v Greenwich LBC was qualified by reference to “the public interest in the efficient administration of justice” not being significantly harmed. Indeed, the principle in Cobbold v Greenwich LBC was expressed with approval in the following terms by Lord Clarke in Maharaj v Johnson [2015] UKPC 28 (dissenting as to the substantive issue in that Privy Council appeal, but not on this point, and with my emphasis added) “the basic principle (applicable in cases other than amendments sought close to trial, and which will result in the loss of a trial date) is that if an amendment has some prospect of success, and does not cause prejudice which cannot be compensated in costs, then it should be allowed: Cobbold v Greenwich London Borough Council [1999] EWCA Civ 2074.”[110]Secondly, Ms Michalos contended that the First-tier Tribunal had failed to give proper weight to the Court of Appeal authority of Birkett v DEFRA [2011] EWCA Civ 1606; [2012] AACR 32, namely that “a public authority may be permitted to rely on grounds not raised earlier and that a public authority is entitled to raise a new ground of exemption before the Tribunal at any stage” (DVLA skeleton argument at §53.2). Birkett certainly stands as good authority for the former DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 30 proposition. As for the latter, the proposition may be expressed too broadly (or too loosely). A public authority may well be entitled to raise a new exemption at any stage, but it does not mean it will necessarily be allowed to rely on it. As Sullivan LJ held in Birkett (at paragraph [28]), “the Rules ensure that any new exception, if it is to be relied upon, is identified at the outset of the appeal, and within a relatively short time. Any application by the public authority to rely upon a new exception made after the time limit for its grounds of appeal/response would be subject to the Tribunal's case management powers under rule 5.” As Upper Tribunal Judge Markus QC explained in Lownie v Information Commissioner, the FCO and The National Archives [2020] UKUT 32 (at paragraph 32):
“Given the importance of some of the public interests protected by FOIA, if a public authority mistakenly fails to rely on an exemption or wrongly limits its application, the tribunal is not precluded from considering it. As Birkett decided, it is for the tribunal to decide, in the exercise of its case management powers, whether to permit reliance on a new exemption.”
[111]Thirdly, as previously mentioned, Ms Michalos placed reliance on the Commissioner’s change of position on section 31(1)(h) and section 31(2)(b). The argument that this prejudiced the DVLA was put in two ways.[112]In the first place, Ms Michalos sought to persuade me that the Commissioner had abandoned her original position on section 31(1)(h) taken in conjunction with section 31(2)(b) without any adequate explanation. On closer inspection I am not persuaded that this was the case. The Commissioner’s DN itself was primarily focussed on the public interest balancing test. The DN’s treatment of the logically prior issue as to whether the section 31 exemption was properly engaged was at best cursory (see paragraphs 15-18). The Commissioner’s first response to the appeal (dated 13 November 2017, and not drafted by Ms Michalos) referred to that summary (see paragraph 9) and provided a very truncated account (see paragraphs 18-20). It did not properly unpack the notion of a public authority’s “functions”. Frankly, by this stage, the Commissioner had in effect assumed section 31 was engaged and had concentrated her attention on the public interest balancing test. However, we know that the DN was then subject to review by the ICO policy department (see paragraph 80 above), resulting in the much more thorough analysis in the Commissioner’s further response of 12 January 2018 (over three pages at paragraphs 6-14). So, the Commissioner had fully explained her change of stance.[113]In the second place, Ms Michalos rightly acknowledged that the First-tier Tribunal is not bound by the Commissioner’s view and that the parties are under an obligation to assist the Tribunal in securing the overriding objective. So, she submitted, “this does not include adding in additional work for the Tribunal and further exemptions if they appear to be unnecessary because the Information Commissioner supports the exemptions relied upon. It is entirely divorced from reality to suggest that it is not reasonable for a party to take into account the views of the Information Commissioner in assessing whether additional exemptions are necessary” (DVLA skeleton argument at §53.7). The difficulty with this submission is not the statement of principle itself but rather its application to the facts. As noted above at paragraph 98, the writing was on the wall on 12 January 2018, when the Commissioner had filed her (fully reasoned) submission recanting from her previous reliance on sections 31(1)(g) and DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 31 31(2)(b), which was the basis of her DN on Mr Williams’s complaint. The change of position was accordingly telegraphed seven weeks before the hearing. That was ample time for an application to be made in good time to adjourn and permit reliance on additional exemptions. The First-tier Tribunal’s consideration of the DVLA’s change of position argument (in its Second Decision at paragraphs [13]-[16]) discloses no error of law.[114]Fourthly, Ms Michalos pointed to several other factors which she submitted pointed to the conclusion that the First-tier Tribunal had erred in law. Thus, she argued that the Tribunal had failed to consider the merits and importance of the proposed amendment in terms of the wider public interest, not least given DVLA’s ongoing investigation. She also contended that there would have been no real prejudice to the other parties if the application had been granted. Finally, she pointed to the fact that the Commissioner had been forced to change counsel at a relatively late stage owing to diary conflicts (Ms Michalos herself was only instructed on 21 February 2018).[115]The difficulty for the DVLA is that none of these factors are especially persuasive, let alone determinative. They were all considered by the First-tier Tribunal in its careful reasoning (Second Decision at paragraphs [10]-[29]). Taking them in reverse order, the circumstances involving the change of counsel were unfortunate but equally were taken into account by the Tribunal (see e.g. at paragraphs [13] and [23]). The Tribunal also found that there was indeed real prejudice to the other parties (see paragraphs [20] and [21]) – it is not the place now for the DVLA to seek to unpick that finding of fact. Finally, although it quite properly did not engage in a ‘mini-trial’ of the merits of the argument that section 35 was engaged, the Tribunal had regard to the DVLA argument as to the prejudice to its case and the wider public interest (see paragraph [24]). Indeed, it was “satisfied that the strength of this argument should be weighed in the context of the DVLA’s failure to raise it despite numerous opportunities to review” (see paragraph [27]). Moreover, the Tribunal expressly had regard to “the material already in the public domain at the relevant date e.g. p 390 open bundle and paragraph 44 of the closed version of Mr Toft’s 3rd statement in assessing proportionality and the likely injustice if the application is refused”.[116]I am therefore satisfied that the First-tier Tribunal took into account relevant factors and did not have regard to irrelevant factors in reaching its conclusion not to permit the DVLA to argue the section 35 point. As the Tribunal concluded:
“23. When a professionally represented organisation has repeatedly changes its mind as to the basis of its case, fails to identify the issues in a timely fashion, and has allowed a case to be prepared on one basis before seeking to change it materially at a very late stage, the Tribunal Judge is satisfied that this causes significant harm to the administration of justice. Although there had been a late change of Counsel, the Tribunal Judge repeats her rehearsal of the numerous opportunities that the DVLA had had to review the case earlier.”
[117]My conclusion is therefore that Ground 4 is not made out.[118]Ground (5): The Second Decision was internally inconsistent, did not comply with the overriding objective and was punitive to the DVLA because the Tribunal granted permission to amend to rely on s.41 and s.40 but refused permission to DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 32 rely on s.35 in circumstances where the reasons for the late application and consequences to the parties were the same.[119]I can take Ground 5 relatively briefly. Insofar as this fifth ground of appeal argues that the First-tier Tribunal’s Second Decision was not in accord with the overriding objective and was moreover unfair (or “punitive”) to DVLA, it in essence traverses the same territory as Ground 4. In those respects, it is unpersuasive for the same reasons as discussed above.[120]Inasmuch as Ground 5 represents a discrete head of challenge, it is concerned with an alleged inconsistency in the First-tier Tribunal’s Second Decision. Ms Michalos’s case was that it was an irrational and arbitrary exercise of the Tribunal’s discretion to grant permission to the DVLA to rely on section 41 but at the same time to refuse permission to rely on section 35. This was said to be because in the circumstances of these proceedings the timing of (and the reasons for) the late application were identical, as were the consequences to the parties in terms of further submissions. I am not persuaded by this line of argument for two reasons.[121]First, given the principles set out in Birkett, and the breadth of the discretion vested in the First-tier Tribunal (both in terms of the overriding objective and its case management powers), the Tribunal could have permitted amendment to allow reliance on section 35 or section 41 or both. Very simply, it all depends. As it was, the First-tier Tribunal succinctly but cogently set out its reasons for giving DVLA the green light to section 41 but the red light to section 35 in paragraphs [25]-[28] of its Second Decision:
“25. The Tribunal Judge is satisfied that there is a qualitative difference between the prejudice associated with the 2 exemptions. The Tribunal Judge agrees with the Commissioner who observes that: “the interests of third parties who may have provided information in confidence should be given particularly careful consideration when determining whether to allow the DVLA’s late reliance on s.41. From a brief review of the material the Commissioner considers that there may be some merit in the application of s.41 to a limited amount of information.”
[26]S.41 involves the rights of 3rd parties who are not party to the appeal and unlike the DVLA have not had numerous opportunities to defend their interests. It is a discrete point that relates to a limited amount of information and the Tribunal Judge is satisfied that the resources in terms of time and cost of the Appellant and Commissioner that would be required to address this are not likely to be considerable. Consequently, it is in the interests of justice that this exemption should be argued before and adjudicated upon by the Tribunal.[27]In relation to the s.35 exemption, the DVLA argue refusal forces (pending appeal) the DVLA to disclose under FOIA material which it contends will damage the policy making process. The Tribunal Judge is satisfied that the strength of this argument should be weighed in the context of the DVLA’s failure to raise it despite numerous opportunities to review. Additionally, she has had regard to the material already in the public domain at the relevant date e.g. p 390 open bundle and paragraph DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 33 44 of the closed version of Mr Toft’s 3rd statement in assessing proportionality and the likely injustice if the application is refused.[28]Whilst the Tribunal Judge assesses the merits of the application when it was made which was before the substantive hearing on s.31, she considers that the DVLA have not helped the Tribunal to further the overriding objective namely to avoid delay. The timing of the application and the need for further evidence relating to the s.35 application as well as the need for time to consider the arguments meant that acceding to the request would inevitably have led to considerable delay. As set out in the chronology above, I am satisfied that the DVLA were in a position to make the application at a far earlier stage in January 2018 which would have avoided duplication of preparation and could have been expected to reduce or eliminate delay.”[122]The second and connected reason is that the essential question is whether the Second Decision was one within the band of reasonable case management decisions that the First-tier Tribunal could properly make. In that respect Mr Perry could have called upon a positive shedload of authorities (see e.g. those discussed in Wrottesley v HMRC [2015] UKUT 637 (TCC); [2016] STC 1123 at paragraphs 9-13). However, the Supreme Court’s decision in Al Saud v Apex Global Management Ltd [2014] UKSC 64 (per Lord Neuberger at paragraph [13]) suffices for his purposes:
“Given that it was a case management decision, it would be inappropriate for an appellate court to reverse or otherwise interfere with it, unless it was ‘plainly wrong in the sense of being outside the generous ambit where reasonable decision makers may disagree’ as Lewison LJ expressed it in Broughton v Kop Football (Cayman) Ltd [2012] EWCA Civ 1743, para 51.”
[123]This is not simply a question of the general principle that an appellate tribunal should be wary of interfering with a first instance tribunal’s handling of case management issues. As Farbey J has recently expressed the point in Crossland v Information Commissioner and Leeds CC [2020] UKUT 263 (AAC) at paragraph 34:
“The GRC is the specialist chamber of the First-tier Tribunal vested with the statutory authority to deal with information rights cases. Its case management decisions should be respected by an appellate tribunal unless they are unreasonable (Ashmore v Corporation of Lloyd’s [1992] 1 WLR 446 at 454) or unless it is quite clear that the GRC has misdirected itself in law (AH and others (Sudan) v Secretary of State for the Home Department (United Nations High Commissioner for Refugees intervening) [2007] UKHL 49, [2008] 1 A.C. 67, per Baroness Hale at para 30).”
[124]I accordingly agree with Mr Perry and Mr Williams that this fifth ground of appeal is also not made out. The First-tier Tribunal’s Third Decision Introduction[125]The final two grounds of appeal, Grounds 6 and 9, both related to the Tribunal’s Third Decision and turned on section 41 (breach of confidence) and section 40(2) (personal data). DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 34 The two grounds of appeal in relation to the First-tier Tribunal’s Third Decision Ground (6): The Tribunal adopted an erroneous approach in failing to conclude that once an individual document had been identified as having the quality of confidence about it, that it was treated as confidential as a whole and instead adopted the approach that each individual piece of information needed to be considered separately. Ground (9): The Tribunal erred in its approach to personal data under s.40 and ... (b) wrongly concluded as a matter of fact that an individual had a public facing role to a degree that warranted disclosure of their personal data when they did not and there had been no evidence on the issue in any event; and (c) wrongly failed to consider as a first step whether any legitimate interest in disclosure of this personal data to the requester existed, as required. Breach of confidence and section 41 of FOIA[126]Ground (6): The Tribunal adopted an erroneous approach in failing to conclude that once an individual document had been identified as having the quality of confidence about it, that it was treated as confidential as a whole and instead adopted the approach that each individual piece of information needed to be considered separately.[127]This ground of appeal concerned the proper application of section 41 of FOIA (breach of confidence). Section 41 of FOIA is an absolute exemption (see section 2(3)(g)). Only subsection (1) is relevant for present purposes:
“41.— Information provided in confidence (1) Information is exempt information if— (a) it was obtained by the public authority from any other person (including another public authority), and (b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.”
[128]The First-tier Tribunal found that some of the requested information had the necessary ‘quality of confidence’ (see Coco v A.N. Clark (Engineers) Ltd [1968] PSR 415) so as to engage section 41, but some of the information did not. This ground of appeal was dealt with partly in open and partly in closed. However, the general principles can be dealt with here in open, as indeed they were at the oral hearing. There is a separate closed annex (Annex B) dealing with the closed aspects of this decision.[129]Ms Michalos’s primary submission on this ground of appeal was that the First-tier Tribunal had erred in law by taking a line-by-line approach to the redaction process for confidential material in the requested information. She argued that the Tribunal’s approach was fundamentally inconsistent both with the common law relating to breach of confidence and with FOIA. So, Ms Michalos contended, the First-tier Tribunal had erred by adopting “an overly granular approach” to the exclusion of considering the relevant document as an entirety. In this context she prayed in aid dicta from Foreign and Commonwealth Office [FCO] v Information Commissioner and Plowden [2013] UKUT 275 (AAC), DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 35 Jockey Club v Buffham [2002] EWHC 1866 (QB); [2003] QB 462 and Hellard v Irwin Mitchell [2012] EWHC 2656 (Ch).[130]Mr Perry, for his part, acknowledged that both the law of confidence and section 41 of FOIA required consideration of the specific contents of a document alongside the document as a whole. However, he did not accept that if a document contained confidential information it necessarily followed that the entire document was confidential so as to engage section 41. Mr Perry submitted this was ultimately a fact-specific question such that a granular approach did not necessarily involve illegitimate ‘cherry-picking’ of particular passages so as to undermine the law relating to breach of confidence.[131]This ground of appeal on DVLA’s part fails essentially for two reasons.[132]The first reason is the starting point that any request made under FOIA, properly analysed, is a request for information, and not a request for documents. Section 84 of FOIA, of course, declares that ““information” … means information recorded in any form” (so whether in a written document or otherwise). It is well-established under FOIA that in determining whether an exemption applies a process of disaggregation may be required, such that some information is properly disclosable (as no exemption bites) whereas other information is withheld (as a relevant exemption is engaged). Thus, as the Upper Tribunal held in Corderoy and Ahmed v Information Commissioner, A-G and Cabinet Office [2017] UKUT 495; [2018] AACR 19 (at paragraph 36), it is important to bear in mind that:
“(a) the request is for information and not for documents and that the requested information does not have to be given by providing whole or redacted documents that record it, and so (b) the information can be given by extracting it from documents and other records held by the public authority (see paragraphs 32 and 33 of APPGER v IC and FCO [2015] UKUT 0377 (AAC); [2016] AACR 5).”
[133]The second reason is that, properly considered, the First-tier Tribunal in any event did not adopt a rigid and overly granular approach to the information in issue. Instead, for the reasons that are amplified in the closed annex, I am satisfied the Tribunal took into account both the contents and the context of the requested information in deciding whether section 41 was engaged.[134]Nor do I consider that the case law relied upon by Ms Michalos assists the DVLA on this ground of appeal.[135]First, FCO v Information Commissioner and Plowden does not suggest that a line-by-line approach is necessarily inappropriate. Rather, Upper Tribunal Judge Jacobs was affirming the need to combine, as appropriate, both a holistic contextual and a more specific contents-based approach. The Judge expressed the point as follows:
“I also consider that the tribunal failed to take account of the information as a package. It adopted a sentence by sentence approach. I accept that that was appropriate, but not to the exclusion of looking at the information as a whole”
(at paragraph 16).[136]Secondly, I do not consider that reliance on Jockey Club v Buffham takes the DVLA anywhere. Ms Michalos placed great emphasis on paragraph [44] of that judgment, where Gray J accepted there was force in counsel’s argument that it DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 36 was not open to one party “to ‘cherry-pick’ from the documents passages which, at least when divorced from their context, may lack the quality of confidence and argue from there that the whole document has not been shown to be confidential.” However, as Mr Perry observed, it was plain from other passages in the judgment that Gray J was adopting a contents-based approach in contra-distinction to a ‘whole document’ approach (see e.g. at paragraphs [54] and [57]). Furthermore, and in any event, for the reasons explored in the closed annex, the First-tier Tribunal did not engage in the type of ‘reverse engineering’ referred to by Gray J at paragraph [44].[137]Thirdly, reliance is placed upon Hellard v Irwin Mitchell, a case of legal professional privilege in the context of an action for professional negligence. HH Judge Purle QC, sitting as a High Court Judge, held there (at paragraph [7]) that a party could not “cherry-pick and disclose only some of the relevant communications or covered by privilege and confidentiality”. However, this finding was made in the context of waiver of legal professional privilege, which is not on all fours with the current case.[138]Furthermore, the notion that within the FOIA scheme there is a ‘whole document’ approach to the exclusion of any consideration of the contents of the document in question is simply unsustainable. Differentiation of material is part of the daily diet of tribunals deciding whether particular exemptions are engaged in FOIA appeals. Where section 41 is in play, there will be some cases where the requested information is completely covered by the breach of confidence exemption (see e.g. RB v Information Commissioner [2015] UKUT 614 (AAC) (and contrast paragraph 20 in that decision)). There will be other FOIA law of confidence cases in which a systematic line-by-line analysis may need to be to the fore, resulting in a process of disaggregation of requested information into material which engages the exemption and other information which does not do so (see e.g. UK Coal v information Commissioner [2012] UKUT 212 (AAC)).[139]It follows that Ground 6 in relation to section 41 does not succeed. Personal data and section 40(2) of FOIA[140]Ground (9): The Tribunal erred in its approach to personal data under s.40 and . . . (b) wrongly concluded as a matter of fact that an individual had a public facing role to a degree that warranted disclosure of their personal data when they did not and there had been no evidence on the issue in any event; and (c) wrongly failed to consider as a first step whether any legitimate interest in disclosure of this personal data to the requester existed, as required.[141]This ground of appeal turned on the proper application of section 40(2) of FOIA (personal data). Section 40(2) of FOIA (personal data) is for present purposes an absolute exemption, at least so far as it relates to cases where the first condition referred to in subsection (2) is satisfied – see FOIA, section 2(3)(fa). The relevant statutory provision2 is as follows:
“40.— Personal information 2 I have used the post-GDPR version of s.40(2) in force since 25 May 2018, rather than the version in force at the material time, but nothing turns on this. DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 37 (1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. … (7) In this section— "the data protection principles" means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018; "data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); "the GDPR" , "personal data" , "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act).”
[142]This ground of appeal raises a relatively short and narrow point. Ms Michalos submitted that the First-tier Tribunal had erred in law in respect of certain personal data in two respects. First, it had found that a particular named individual (or at least an individual named in closed) had a public facing role when there was no evidence to support that conclusion. Second, it had failed to take the first step of deciding whether the requester had a legitimate interest in the disclosure of this personal data. In that regard she relied on my Upper Tribunal decision in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) (at paragraphs 32-47).[143]Mr Perry’s submission was that the First-tier Tribunal had identified the correct principles of law but did not have available to it full evidence as to the seniority and nature of the roles of all those individuals whose names appeared in the withheld information. He accepted this was particularly the case in relation to the one named individual in Ms Michalos’s closed submissions.[144]Meanwhile Mr Williams had made it clear in his oral submissions in open that he was not interested in the names of, as he put it, ‘the office junior’ within DVLA. However, he did consider that the names of staff (again, as he put it) “who take the decisions” should be disclosed. I took this to mean that Mr Williams wanted DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 38 to see disclosure of the names of those more senior DVLA staff who “carry the can in terms of responsibility and accountability” (see Cox at paragraph 46).[145]In those circumstances I agreed with Ms Michalos and Mr Perry in the closed session that the DVLA and the Commissioner should endeavour to agree the necessary redactions to protect personal data covered by the section 40(2) exemption. I am satisfied that such redactions should include the personal data of the one named individual. In the closed session Ms Michalos raised the issue (although without naming any names) as to whether similar redactions should be made in respect of managers at several of the private companies involved in the DVLA investigation. I agree with Mr Perry, as noted in the Annex A gist, that “the position may be less clear cut with regards to other individuals – for example those holding senior management roles at a private company”.[146]In sum, the DVLA and the Commissioner are agreed that the First-tier Tribunal erred in law in finding one named individual had a public facing role that warranted the disclosure of their personal data when there was no sufficient evidence to support that finding. Although this was an error of law, in the overall scheme of things it amounts to a very marginal point. Given especially my conclusions on the other grounds of appeal, I exercise my discretion so as not to set aside the Tribunal’s open Third Decision (Tribunal, Courts and Enforcement Act 2007, section 12(2)(a)). However, the DVLA and the Commissioner should endeavour to agree the necessary redactions bearing in mind the principles set out in Cox. A note about Annex B[147]Annex B comprises the Upper Tribunal’s closed reasons with respect to Grounds 6 and 9 which relate to the First-tier Tribunal’s Third Decision. Annex B is accordingly to be issued solely to the DVLA and the Information Commissioner (and the First-tier Tribunal). It is not to be issued to Mr Williams or third parties. I make a rule 14 order to that extent.[148]The time limit in the information rights jurisdiction for making an application to the Upper Tribunal for permission to appeal to the Court of Appeal is one month from the date that the Upper Tribunal’s written reasons are issued: see Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698), rule 44(4)(a). The one-month time limit may also run from one of the special circumstances set out in rule 44(4)(b) and (c), e.g. notification that an application under rule 43 for the decision to be set aside for procedural reasons is unsuccessful.[149]I therefore direct that the closed Annex B will remain closed until at least one month after the date this decision is issued (or such later date as is required by rule 44(4)(b) or (c)). The effect of this direction is that (barring one of those special cases) the closed status of Annex B will be removed one month after this decision is issued, unless within that time a party makes an application to the Upper Tribunal for permission to appeal to the Court of Appeal. In that event, and subject to any contrary order of the Court of Appeal, Annex B will remain closed until disposal of that permission application and any ensuing appeal. This is subject to the exception that the DVLA and the Commissioner may agree on reflection that there is nothing that is contained in Annex B which cannot be referred to in open. I make provision for this eventuality in the accompanying directions.

(V) 39 The bigger picture

[150]In her closing oral submissions Ms Michalos invited me to take a step back and look at the global picture – the core of the appeal, she suggested, concerned whether KADOE users, once they had made a regulation 27 request with “reasonable cause”, were then able to sell on that data to third parties. The First-tier Tribunal, she suggested, had lost sight of that bigger picture. An investigation by DVLA into whether personal data was sold on to third parties was necessarily part of the public authority’s functions and so fell within section 31(1)(g) read with section 31(2)(a) and (b). It followed that the law enforcement exemption applied. Furthermore, this was a matter of wide public importance and as such touched on the Department for Transport’s policy agenda.[151]In a sense Mr Williams, although he was coming at the problem from a very different perspective, was also encouraging me to have regard to the bigger picture, which he described as the major data breach caused by the way that the DVLA operated the KADOE arrangements (see paragraph 17 above).[152]This may be a case for my part of once bitten, twice shy. In another FOIA context I have been criticised by the Court of Appeal for acceding to counsel’s urging to adopt a “bigger picture” approach (see Department for Business, Energy and Industrial Strategy v Information Commissioner and Henney [2017] EWCA Civ 844; [2017] PTSR 1644 at paragraphs [9], [26] and [35]-[36]). As the Court of Appeal explained, “an approach which is not focussed on the statutory definition is liable to introduce uncertainty and error” (at paragraph [36]). The “bigger picture” analysis can cut both ways – one might just as well say here, as Mr Williams has consistently argued from the outset, that the bottom line (or the bigger picture) is that the DVLA is not in the business of law enforcement.[153]It follows that the proper approach is to recognise that the outcome of this appeal really turned on two principal issues. First, had the First-tier Tribunal erred in law in its approach to section 31 of FOIA? Secondly, had the Tribunal erred in law in denying the DVLA the opportunity at a late stage to argue the section 35 exemption? For the reasons above, I conclude that the Tribunal’s decisions on those two core questions do not involve any material error of law. Conclusion[154]It follows that I find that six of the seven grounds of appeal in respect of which permission was given are not made out. The last ground is proven in part but, for the reasons explained above, I do not set aside the decision of the First-tier Tribunal. The Tribunal’s First, Second and Third Decisions all stand. Nicholas Wikeley Judge of the Upper Tribunal Authorised for issue on 26 November 2020 DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 40 ANNEX A Gist of Closed Session Held During Hearing 5th November 2020 Grounds 1-3 Mr Perry, for the Commissioner, made a brief point on whether the withheld material specifically concerned investigation into whether vehicle keeper information had been used for a ‘reasonable cause’. Ms Michalos drew the UT’s attention to the closed passages in Mr Toft’s First Witness Statement. Ground 6 Ms Michalos QC, for the DVLA, summarised the information the DVLA contends should be withheld under section 41 which she indicated was the information summarised in the table referred to yesterday in the Open FTT bundle at p.56bg. She then set out representative examples of where, in her submission, the FTT took an impermissible line-by-line approach, which resulted in disclosure of information intermingled with confidential information and gave rise to a misleading impression of information withheld under section 41. Mr Perry argued that the FTT had only adopted a very granular, line-by-line, approach in a small handful of instances. He submitted that, whilst these examples where closer to the line distinguishing a lawful granular approach from unlawful cherry-picking, the FTT was nonetheless correct to take the approach it did. Mr Perry also took the Tribunal to examples in the closed reasons where the FTT had considered information in light of the withheld information read as a whole and broader contextual factors. Ground 9 Ms Michalos took the Tribunal to unredacted passages in the DVLA’s closed submissions of 10 May 2019 – in particular the example referred to at paragraph 39 of those submissions, which concerned a civil servant. Ms Michalos submitted that this individual was a junior civil servant and was not at a ‘decision-making’ level, so should not have their personal data disclosed. Mr Perry agreed with the DVLA’s position in relation to this individual. Though he indicated that the position may be less clear cut with regards to other individuals – for example those holding senior management roles at a private company. Judge Wikeley, Ms Michalos and Mr Perry agreed that the parties should, following this hearing, seek to agree section 40 redactions without the input of the Tribunal. DVLA -v- Information Commissioner and Williams (Section 31) [2020] UKUT 334 (AAC) GIA/779/2019 (V) 41 ANNEX B [The Upper Tribunal’s closed confidential reasons]

Cited in 6 later judgments