Foreign, Commonwealth and Development Office v Information Commissioner, Williams and Others (Sections 23 and 24): [2021] UKUT 248 (AAC) [2021] UKUT 248 (AAC)

UPPER TRIBUNAL

ADMINISTRATIVE APPEALS CHAMBER

[2021] UKUT 248 (AAC)

Case No GIA/388/2021, GIA/389/2021, GIA/390/2021

Between

Foreign, Commonwealth and Development OfficeAppellant

Information Commissioner, Williams and Others (Sections 23 and 24)Respondent

Before

Mrs Justice Farbey DBE

Upper Tribunal Judge Mullan

Upper Tribunal Judge Wikeley

Date 1 October 2021

Category: Information rights

Subcategory: Information rights freedom of information absolute exemptions, Information rights freedom of information qualified exemptions, Information rights information rights practice and procedure

[1]This appeal concerns the inter-relationship between the two national security exemptions under sections 23(1) and 24(1) of the Freedom of Information Act 2000 (FOIA) together with section 17 of the same Act. 2. Section 23(1) of FOIA, an absolute exemption, provides that “Information held by a public authority is exempt information if it was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).” Section 23(3) then lists a number of security bodies, starting with the Security Service and the Secret Intelligence Service. 3. Section 24(1) of FOIA, a qualified exemption, provides that “Information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security”.

[4]Section 17 of FOIA deals generally with refusals of requests made under the Act. It requires any public authority refusing a FOIA request to issue the requester with a notice which, amongst other things, “specifies the exemption in question” (section 17(1)(b)). The central issue in dispute

[5]The Information Commissioner identifies the central issue for us to decide in the following way (in her Response to the appeal at para 1): This appeal concerns whether a public authority responding to a FOIA request is entitled to rely on sections 23(1) and 24(1) FOIA in the alternative, so as to protect the interests of national security by masking, in particular, whether or not the information requested relates to a section 23(3) security body. FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 3

[6]Dr Lownie, one of the three requesters involved in these proceedings (who all see the issue in the same way), frames the central question for determination in a rather different way (in his Response to the appeal at para 1): The FTT was faced, and the UT is now faced on appeal, with a straightforward question of law: when s.17(1)(b) FOIA requires a public authority to “specify” an exemption upon which it relies, is that public authority entitled (in the circumstances of the mutually-exclusive ss.23 and 24 FOIA, or at all) to “mask” which exemption it actually relies upon by also stating a dummy exemption it does not rely upon (and cannot rely upon as a matter of law), so as to avoid disclosing which is the applicable exemption?

[7]Put simply, the Foreign, Commonwealth and Development Office (the FCDO) and the Information Commissioner submit that a public authority is entitled to rely on FOIA sections 23 and 24 in the alternative, where on the facts only one such exemption applies, as a means of “masking” the involvement (or indeed non-involvement) of a security body. The requesters argue, in short, that the deployment of such a fiction is incompatible with the public authority’s duty under FOIA section 17. The First-tier Tribunal decided this preliminary point in the requesters’ favour and the FCDO now appeals to the Upper Tribunal, supported by the Commissioner.

[8]Our unanimous conclusion, in summary, is that the FCDO was entitled to rely on FOIA sections 23(1) and 24(1) in the alternative, so as to protect the interests of national security by masking whether or not the information requested relates to one of the security bodies listed in section 23(3). It follows that the Information Commissioner’s original Decision Notices were correct as a matter of law on this point in each case and the First-tier Tribunal’s decision on the preliminary issue was made in error. The context in which the central issue arises

[9]The First-tier Tribunal was concerned with appeals in relation to three FOIA requests made to the FCDO.

[10]On 10 May 2018 Mr Williams made a FOIA request to the FCDO for all documents relating to the case of Mr Abdul-Hakim Belhaj and Ms Fatima Boudchar, opponents of the Gaddafi regime who had been unlawfully rendered to Libya, where they were tortured. Their ordeal led to the UK government issuing a public apology, which recognised that its actions had “contributed to [their] detention, rendition and suffering”, and settling legal proceedings brought by the couple.

[11]On 6 March 2019 Professor Wickham-Jones, a historian with a special interest in British foreign policy in Italy immediately after the Second World War, made a FOIA request to the FCDO for the declassification of a specific file on the political situation in Italy in 1947, held at The National Archive (TNA, formerly the Public Records Office).

[12]On 14 April 2019 Dr Lownie, a biographer, made a FOIA request to the FCDO for two other TNA classified files, both relating to the Soviet spy Guy Burgess.

[13]In each of the three cases the FCDO replied that information within the scope of the request was held but that it would not be supplied because it was exempt FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 4 either under section 23(1) (information supplied by, or relating to, bodies dealing with security matters) or section 24(1) (national security). Implicit in each refusal was an acknowledgment that the exemptions under sections 23(1) and 24(1) were mutually exclusive. That proposition has been agreed as correct on all sides before both the First-tier Tribunal and Upper Tribunal. However, the FCDO went on to explain that it was citing the two exemptions “in the alternative” because “it is not appropriate, in the circumstances of the case, to say which of the two exemptions is actually engaged so as not to undermine national security or reveal the extent of any involvement, or not, of the bodies dealing with security matters”.

[14]All three requesters complained to the Information Commissioner. Following lengthy investigations, she upheld the FCDO’s right to cite sections 23(1) and 24(1) “in the alternative”. The Information Commissioner concluded that the information sought was exempt under one or other of those subsections but did not inquire into, much less determine, which of the two exemptions was applicable. All three requesters then lodged appeals with the First-tier Tribunal.

[15]The First-tier Tribunal (Judge Anthony Snelson and Judge Moira Macmillan) held a hearing on 13 November 2020 on the preliminary issue as to whether the Information Commissioner’s decision that it was open to the FCDO to maintain the section 23(1) and 24(1) exemptions “in the alternative” was correct in law. The First-tier Tribunal’s unanimous decision (dated 29 December 2020) was that the Commissioner’s approach was wrong as a matter of law. The First-tier Tribunal subsequently gave the FCDO permission to appeal to the Upper Tribunal on this preliminary issue. The Upper Tribunal hearing

[16]We held a conventional oral hearing of the FCDO’s three appeals on 1 and 2 July 2021, albeit that some of those involved observed the hearing remotely. The FCDO (the Appellant) was represented by Sir James Eadie QC, Ms Jennifer Thelen and Mr David Mitchell of counsel. The Information Commissioner was represented by Mr Christopher Knight of counsel. Mr Williams, Professor Wickham-Jones and Dr Lownie were represented by Ms Alison Berridge, Mr John Fitzsimons and Mr Greg Callus of counsel respectively. We are indebted to counsel on all sides for their co-operation in avoiding the duplication of submissions, given the overlapping interests. We are especially indebted to those counsel who acted pro bono. We are satisfied that all possible arguments have been properly ventilated. We should emphasise for the record that there were no closed written submissions and there was no closed hearing. The roadmap for this decision

[17]We start by providing an overview of the relevant legislative framework (paragraphs 18-25) before considering the proper approach to statutory interpretation (paragraphs 26-28) and the national security context (paragraphs 29-34). After considering the Information Commissioner’s guidance on the inter-relationship of sections 23 and 24 of FOIA (paragraphs 35-38), we discuss the nature of section 17 of FOIA (paragraphs 39-48) and in particular focus on the meaning of “specify” in section 17(1)(b) (paragraphs 49-58). We also address the practical consequences of our decision (paragraphs 59-63) and explain why the NCND (neither confirm nor deny) provisions do not provide an adequate FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 5 solution to the problem that has been identified (paragraphs 64-70). Finally, after reference to other official guidance (paragraphs 71-75), we analyse the human rights dimension (paragraphs 76-84). The legislative framework

[18]Under section 1 of FOIA any person who makes a request of a public authority has two rights. The first is the right “to be informed in writing by the public authority whether it holds information of the description specified in the request” (section 1(1)(a)). The second, if that is the case, is the right “to have that information communicated to him” (section 1(1)(b)).

[19]Assuming that the duty to confirm or deny does not arise, then the requester’s section 1(1)(a) right to be informed does not apply where either a provision in Part II confers an absolute exemption or (in the case of a qualified exemption) “the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information” (section 2(1)).

[20]Furthermore, the requester’s section 1(1)(b) right to have information communicated does not apply to any information which is exempt under Part II to the extent it is covered by an absolute exemption or to the extent “the public interest in maintaining the exemption outweighs the public interest in disclosing the information” (section 2(2)).

[21]However, the key provisions for our purposes are sections 17, 23 and 24. The material provisions of section 17 read as follows: 17.— Refusal of request(1) A public authority which, in relation to any request for information, is to any extent relying on a claim that any provision of Part II relating to the duty to confirm or deny is relevant to the request or on a claim that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which— (a) states that fact, (b) specifies the exemption in question, and (c) states (if that would not otherwise be apparent) why the exemption applies.

(2) Where— (a) in relation to any request for information, a public authority is, as respects any information, relying on a claim— (i) that any provision of Part II which relates to the duty to confirm or deny and is not specified in section 2(3) is relevant to the request, or (ii) that the information is exempt information only by virtue of a provision not specified in section 2(3), and (b) at the time when the notice under subsection (1) is given to the applicant, the public authority (or, in a case falling within section 66(3) or (4), the responsible authority) has not yet reached a decision as to the application of subsection (1)(b) or (2)(b) of section 2, the FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 6 notice under subsection (1) must indicate that no decision as to the application of that provision has yet been reached and must contain an estimate of the date by which the authority expects that such a decision will have been reached.

(3) A public authority which, in relation to any request for information, is to any extent relying on a claim that subsection (1)(b) or (2)(b) of section 2 applies must, either in the notice under subsection (1) or in a separate notice given within such time as is reasonable in the circumstances, state the reasons for claiming— (a) that, in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the authority holds the information, or (b) that, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

(4) A public authority is not obliged to make a statement under subsection (1)(c) or (3) if, or to the extent that, the statement would involve the disclosure of information which would itself be exempt information.

[22]Section 23 provides as follows: 23.— Information supplied by, or relating to, bodies dealing with security matters(1) Information held by a public authority is exempt information if it was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).

(2) A certificate signed by a Minister of the Crown certifying that the information to which it applies was directly or indirectly supplied by, or relates to, any of the bodies specified in subsection (3) shall, subject to section 60, be conclusive evidence of that fact.

(3) The bodies referred to in subsections (1) and (2) are— (a) the Security Service, (b) the Secret Intelligence Service, (c) the Government Communications Headquarters, (d) the special forces, (e) the Tribunal established under section 65 of the Regulation of Investigatory Powers Act 2000, (f) the Tribunal established under section 7 of the Interception of Communications Act 1985, (g) the Tribunal established under section 5 of the Security Service Act 1989, (h) the Tribunal established under section 9 of the Intelligence Services Act 1994, FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 7 (i) the Security Vetting Appeals Panel, (j) the Security Commission, (k) the National Criminal Intelligence Service (l) the Service Authority for the National Criminal Intelligence Service, (m) the Serious Organised Crime Agency, (n) the National Crime Agency, and (o) the Intelligence and Security Committee of Parliament.

(4) In subsection (3)(c) “the Government Communications Headquarters” includes any unit or part of a unit of the armed forces of the Crown which is for the time being required by the Secretary of State to assist the Government Communications Headquarters in carrying out its functions.

(5) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) which was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).

[23]Section 23 is an absolute exemption (see FOIA section 2(3)(b)). The security bodies listed in section 23(3) are not listed as public authorities by virtue of section 3 and Schedule 1 to FOIA. In addition, and rather by way of belt and braces, the first three agencies listed in section 23(3) are expressly excluded from the definition of “government department” (see FOIA section 84). We accept that the combined effect of these provisions is to signal a clear Parliamentary intention that there should be no question of requiring the disclosure of any information which was directly or indirectly supplied by, or relates to, any of the specified security agencies.

[24]Section 24 provides as follows: 24.— National security(1) Information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security.

(2) The duty to confirm or deny does not arise if, or to the extent that, exemption from section 1(1)(a) is required for the purpose of safeguarding national security.

(3) A certificate signed by a Minister of the Crown certifying that exemption from section 1(1)(b), or from section 1(1)(a) and (b), is, or at any time was, required for the purpose of safeguarding national security shall, subject to section 60, be conclusive evidence of that fact.

(4) A certificate under subsection (3) may identify the information to which it applies by means of a general description and may be expressed to have prospective effect.

[25]Section 24 is a qualified exemption by virtue of the simple fact it is not listed in section 2(3) of FOIA as one of the absolute exemptions. As already noted, it is also agreed on all sides that sections 23 and 24 are mutually exclusive, given FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 8 that the material scope of section 24(1) is by definition “Information which does not fall within section 23(1)”. Approaches to statutory interpretation and Quintavalle

[26]Lord Bingham described the proper approach to the task of statutory interpretation in the following terms in R (Quintavalle) v Secretary of State for Health

[2003] UKHL 13

[2003] AC 687

[8]The basic task of the court is to ascertain and give effect to the true meaning of what Parliament has said in the enactment to be construed. But that is not to say that attention should be confined and a literal interpretation given to the particular provisions which give rise to difficulty. Such an approach not only encourages immense prolixity in drafting, since the draftsman will feel obliged to provide expressly for every contingency which may possibly arise. It may also (under the banner of loyalty to the will of Parliament) lead to the frustration of that will, because undue concentration on the minutiae of the enactment may lead the court to neglect the purpose which Parliament intended to achieve when it enacted the statute. Every statute other than a pure consolidating statute is, after all, enacted to make some change, or address some problem, or remove some blemish, or effect some improvement in the national life. The court's task, within the permissible bounds of interpretation, is to give effect to Parliament's purpose. So the controversial provisions should be read in the context of the statute as a whole, and the statute as a whole should be read in the historical context of the situation which led to its enactment.

[27]The principles in Quintavalle are well-established and received recent endorsement by the Supreme Court in R (Fylde Coast Farms Ltd) v Fylde BC

[2021] UKSC 18

[2021] 1 WLR 2794

. Relying on Lord Bingham’s remarks, Lord Briggs and Lord Sales JJSC said the following at paragraph 6: Even where particular words used in a statute appear at first sight to have an apparently clear and unambiguous meaning, it is always necessary to resolve differences of interpretation by setting the particular provision in its context as part of the relevant statutory framework, by having due regard to the historical context in which the relevant enactment came to be made and, to the extent that its purpose can be identified (which may require examination of admissible travaux preparatoires), to arrive at an interpretation which serves, rather than frustrates, that purpose.

[28]In paragraph 30 of its decision, the First-tier Tribunal noted that a key FOIA provision in this case – section 17(1) – was part of the legislative framework and so had to be read in the context of the FOIA scheme as a whole. Thereafter, however, the First-tier Tribunal ignored that requirement and adopted what was clearly a literal approach to statutory construction. In so doing, it disregarded the Quintavalle stipulation that the task of the judicial body is, in general terms, to seek to establish and give effect to the purpose Parliament was seeking to achieve and, in more specific terms, to set a particular provision within its broader legislative context. In this case, that mandated a requirement to consider section 17(1) in the context of both sections 23 and 24. FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 9 The national security context

[29]Sections 23 and 24 of FOIA have yet to receive detailed analysis in the case law of either the Supreme Court or the Court of Appeal. There is, however, ample existing Upper Tribunal authority.

[30]So far as section 23 is concerned, in Commissioner of the Police of the Metropolis v Information Commissioner and Rosenbaum

[2021] UKUT 5 (AAC)

(or “Rosenbaum”) Judge Markus QC (at paragraphs 35 and 43) approved the following 14 principles extracted from the case law by Mr Knight (also appearing there for the Commissioner). These principles draw from the following cases: Home Office v Information Commissioner and Cobain

[2015] UKUT 27 (AAC)

; APPGER v Information Commissioner and Foreign and Commonwealth Office

[2015] UKUT 377 (AAC)

, [2016] AACR 5; Savic v Information Commissioner, Attorney General’s Office and Cabinet Office

[2016] UKUT 535 (AAC)

, [2017] AACR 26; Corderoy v Information Commissioner

[2017] UKUT 495 (AAC)

, [2018] AACR 19; and Lownie v Information Commissioner and others

[2020] UKUT 32 (AAC)

[2020] 1 WLR 3319

[1]Section 23 affords the “widest protection” of any of the exemptions: Cobain at [19(b)] and [29].

[2]The purpose of section 23 is to preserve the operational secrecy necessary for section 23(3) bodies to function: Lownie at [50].

[3]It is “Parliament’s clear intention that, because of what they do, there should be no question of using FOIA to obtain information from or about the activities of section 23 bodies at all”. The exclusion of the section 23(3) bodies from the scope of FOIA was shutting the front door, and section 23 was “a means of shutting the back door to ensure that this exclusion was not circumvented”: APPGER at [16].

[4]The legislative choice of Parliament was that “the exclusionary principle was so fundamental when considering information touching the specified bodies, that even perfectly harmless disclosure would only be made on the initiative or with the consent of the body concerned”: Cobain at [28]; Lownie at [53].

[5]Asking whether the information requested is anodyne or revelatory fails to respect the difficulty of identifying what the revelatory nature of the information might be without a detailed understanding of the security context: Lownie at [42]; Corderoy at [59].

[6]When applying the “relates to” limb of sections 23(1) and (5), that language is used in “a wide sense”: APPGER at [25]; Corderoy at [59]; Savic at [40].

[7]The first port of call should always be the statutory language without any judicial gloss: APPGER at [23]; Corderoy at [51]; Savic at [40].

[8]With that warning in mind, in the context of “relates to” in section 23, it may sometimes be helpful to consider the synonyms of “some connection” or “that it touches or stands in some relation to” (APPGER at [13], [25]) or to consider whether the request is for “information, in a record supplied to FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 10 one or more of the section 23 bodies, which was for the purpose of the discharge of their statutory functions” (APPGER at [21], [26]; Lownie at [57]). But the “relates to” limb must not be read as subject to a test of focus (APPGER at [14] or directness (Lownie at [59]-[60]).

[9]The scope of the “relates to” limb is not unlimited and there will come a point when any connection between the information and the section 23(3) body is too remote. Assessing this is a question of judgment on the evidence: Lownie at [62].

[10]The assessment of the degree of relationship may be informed by the context of the information: Lownie at [4] and [67].

[11]The scope of the section 23 exemption is not to be construed or applied by reference to other exemptions, including section 24: APPGER at [17]; Lownie at [45] and [52].

[12]In a section 23(1) case, regard should be had as to whether or not information can be disaggregated from the exempt information so as to render it non-exempt and still be provided in an intelligible form: Corderoy at [43].

[13]Section 23(5) requires consideration of whether answering “yes” or “no” to whether the information requested is held engages any of the limbs of section 23: Savic at [43], [82] and [92].

[14]The purpose of section 23(5) is a protective concept, to stop inferences being drawn on the existence or types of information and enables an equivalent position to be taken on other occasions: Savic at [60].

[31]So far as section 24 is concerned, Mr Knight has provided us with a more compendious package of six principles derived from the case law:(1) The term national security has been interpreted broadly and encompasses the security of the United Kingdom and its people, the protection of democracy and the legal and constitutional systems of the state: Secretary of State for the Home Department v Rehman

[2001] UKHL 47

[2003] 1 AC 153

, paras 15-16 per Lord Steyn, para 50 per Lord Hoffmann and para 64 per Lord Hutton.

(2) A threat to national security may be direct (the threat of action against the United Kingdom) or indirect (arising from the threat of action directed against other states): Rehman, paras 16 and 64.

(3) Section 24 is not engaged, unlike the majority of the qualified exemptions, by a consideration of prejudice. Its engagement is deliberately differently worded.

(4) The term “required” means “reasonably necessary”: Kalman v Information Commissioner & Department for Transport [2011] 1 Info LR 664, para 33.

(5) National security is a matter of vital national importance in which the Tribunal should pause and reflect very carefully before overriding the sincerely held views of relevant public authorities: APPGER v Information FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 11 Commissioner & Ministry of Defence

[2011] UKUT 153 (AAC)

, [2011] 2 Info LR 75, para 56 (citing Rehman).

(6) Even where the chance of a particular harm occurring is relatively low, the seriousness of the consequences (the nature of the risk) can nonetheless mean that the public interest in avoiding that risk is very strong: Kalman, para 47. As the Upper Tribunal put it: “the reality is that the public interest in maintaining the qualified national security exemption in section 24(1) is likely to be substantial and to require a compelling competing public interest to equal or outweigh it”: Keane v Information Commissioner, Home Office and Metropolitan Police Service

[2016] UKUT 461 (AAC)

, para 58 (approving Kalman). That does not mean that the section 24 exemption carries “inherent weight”, but is rather a reflection of what is likely to be a fair recognition of the public interests involved in the particular circumstances of a case in which section 24 is properly engaged.

[32]Mr Knight does not cite an authority for the third of his principles relating to section 24, but it is none the worse for that. It is amply made out on a plain reading of the language of Part II of FOIA.

[33]In terms of the linkage between sections 23 and 24, and approaches to their construction, an earlier three-judge panel of the Upper Tribunal expressed the point in the following terms in APPGER v Information Commissioner and FCO

[2015] UKUT 377 (AAC)

[17]This broad approach by reference to identified bodies [in section 23] is not narrowed by the qualified exemption in section 24(1), namely that information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security. This is a safety net provision which recognises that national security issues may arise in respect of information that is not within the absolute section 23 exemption. Rather this safety net provision reinforces the view that Parliament's intention was to put section 23 bodies outside the ambit of the right to information conferred by FOIA and a narrow approach to an absolute exemption would not promote that purpose.

[34]We turn now to summarise the Information Commissioner’s guidance on how sections 23 and 24 inter-relate. The Information Commissioner’s guidance

[35]In September 2012 the Information Commissioner issued detailed guidance on How sections 23 and 24 interact. At this stage we refer to this document simply to illustrate what the Commissioner has identified as the potential problem with the inter-relationship between sections 23 and 24 (see in particular paragraph 26 of the guidance and the example that follows below). Putting that example in context, the guidance includes the following passage at paragraphs 21-27 (excluding a short extract cited from FOIA after paragraph 25; “NCND” is the conventional abbreviation for the “neither confirm nor deny” response): FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 12 Sections 23(1) and 24(1)

[21]Although many requests that raise national security concerns could be responded to using the NCND provisions, there will be situations when it is obvious that the information is held. This may be as a result of official statements to that effect. In these situations the use of NCND would serve little purpose. In these cases the Commissioner would encourage public authorities to confirm that the information is held.

[22]When it is obvious that the information is held, but not obvious whether its contents relates to a security body, this in itself may be worthy of protection. The dilemma for the public authority is that relying on either section 23(1) or section 24(1), alone, would reveal whether the requested information relates to a security body.

[23]In these circumstances the public authority should not attempt to apply the NCND provisions in order to avoid citing an exemption from the duty to communicate the actual information. Even though relying on just one of the exemptions from the duty to communicate information would itself reveal something of the nature of the information, this is not a basis for engaging sections 23(5) or 24(2). As discussed above, the only basis for applying sections 23(5), or 24(2), or both, is what would be revealed by confirmation or denial that the information is held.

[24]When it is obvious the information is held and therefore the public authority sees no value in refusing to confirm or deny, or if the NCND provisions can’t be engaged on the facts of the case, the public authority will be faced with the problem of applying either section 23(1) or section 24(1). The Commissioner has developed an approach to deal with this situation, which is set out below. Section 23(1) and 24(1) are mutually exclusive

[25]Sections 23(1) and 24(1) are mutually exclusive. This means they cannot be applied to the same request. …

[26]The fact that section 24(1) can only be applied to information that is not protected by section 23(1) can present a problem, if a public authority does not want to reveal whether a section 23 security body is involved in an issue. If it could only cite section 24(1) in its refusal notice, this would disclose that no section 23 body was involved. Conversely, if only section 23(1) was cited, this would clearly reveal the involvement of a security body. To overcome this problem the Commissioner will allow public authorities to cite both exemptions ‘in the alternative’ when necessary. This means that although only one of the two exemptions can actually be engaged, the public authority may refer to both exemptions in its refusal notice. Example In this hypothetical example, the government announce that a terrorist suspect, Mr X, has been apprehended but very few details are released. This prompts an FOI request to the Home Office for information on the circumstances of the arrest. It may well be that the FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 13 arrest was the result of a well executed, intelligence led, security operation. However it is equally plausible that the local police made the arrest following a report that someone had been acting suspiciously and the significance of the arrest was only realised later. It is clear, because of the Government’s announcement, that the public authority would hold information on the circumstances of the arrest, but it may not want to reveal whether a security body was involved. If the Home Office was unable to cite sections 23(1) and s24(1) in the alternative, it would be faced with having to identify the actual exemption being relied on. If it relied on section 23(1), it would reveal the involvement of a security body, or if it relied on section 24(1) then this would reveal the security bodies were not involved.

[27]Previously, where public authorities have been concerned that being able to rely only on either section 23(1) or section 24(1) would reveal the involvement or not of a security body, they have tried to avoid the problem by applying the NCND provisions of the two exemptions. This is the case despite the fact that confirming the information is held would not reveal anything which needed to be protected. The perceived problem is that if the public authority confirms the information is held, it would then have to rely on just one exemption to withhold it. The Commissioner is satisfied that allowing public authorities to cite sections 23(1) and 24(1) in the alternative is the pragmatic solution to the problem. There are benefits to the applicant in that they at least receive confirmation that the information is held. In addition the public authority is not placed in the odd position of refusing to confirm whether information is held where it obviously is and so avoids looking unnecessarily obstructive. Refusal notices

[28]When a public authority cites sections 23(1) and 24(1) in the alternative, consideration needs to be given to the contents of the refusal notice. Technically section 17(1) requires public authorities to specify the exemption they are relying on. However, it is important in these circumstances that the refusal notice effectively disguises which provision actually applies. Therefore, the Commissioner will accept a refusal notice which cites both exemptions, stating that they are being cited in the alternative and then explaining why each one could apply. As section 24 is qualified, the refusal notice would also have to explain the application of the public interest test to that provision.

[36]Mr Knight’s submission was that the example given in paragraph 26 of the Information Commissioner’s guidance was an illustration of a real life practical dilemma and not simply a hypothetical problem. Thus reliance on e.g. section 23 alone could give rise to what was described as the “revelatory problem” – it could reveal a fact not previously in the public domain, namely the involvement of one of the listed security agencies. The consequential harm to national security interests in the event of such disclosure could be slight or could be serious, but either way there was a genuine policy concern. Echoing this approach, Sir James posited what he characterised as the central legislative policy question in the following terms: if Parliament had clearly expressed its intention to protect information where its disclosure might damage national security interests, even if that information was apparently anodyne, then why FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 14 would it have left unprotected another type of information where revealing such material might put the public at risk?

[37]The requesters’ response was two-fold. First, it was argued that the FCDO needed to provide evidence of actual harm that had eventuated as a result of the revelatory problem. We disagree – this is ultimately a question of statutory construction that does not turn on factual evidence. In any event, the example given in the Information Commissioner’s guidance is sufficient to demonstrate that the problem is real and not imagined. Second, it was submitted that the probable impact of such “give away” disclosure was likely to be limited. We agree with Sir James that the evaluation of the risk to national security is a matter for the executive. Moreover, Parliament had made it clear that impact of any degree on national security interests where section 23 bodies were involved was to be avoided. The revelation of such information always had the potential to be damaging (see further the 3rd, 4th and 5th principles expounded in Rosenbaum (see paragraph 30 above)).

[38]We return later to consider the status of the Information Commissioner’s guidance (see paragraphs 71-72 below). For the present we turn to consider the nature of section 17 of FOIA. FOIA section 17: a procedural provision

[39]We have already set out the material parts of section 17 above (see paragraph 21). Although it has not received close attention in the superior courts, the nature and purpose of section 17 of FOIA has been considered in a trilogy of Upper Tribunal decisions: DEFRA v Information Commissioner and Birkett

[2011] UKUT 39

, [2012] AACR 32 (“Birkett”); Information Commissioner v Malnick & Advisory Committee on Business Appointments

[2018] UKUT 72 (AAC)

, [2018] AACR 29 (“Malnick”) and Oxford Phoenix Innovation Ltd v Information Commissioner & Medicines and Healthcare Products Regulatory Agency

[2018] UKUT 192 (AAC)

(“Oxford Phoenix”).

[40]Birkett establishes that there is no legal bar on a public authority subsequently relying on an exemption which it failed to mention in its original section 17 notice. One reason for this, as held by Upper Tribunal Judge Jacobs, was that section 17 involves a purely “administrative process” (emphasis in the original in the passage that follows):

[32]As I read section 17, what the authority has to do is to identify the information covered by the request and then either disclose it or say why it is not doing so. That is an administrative process.

[33]Mr Swift pointed out that section 17 is not a formal decision that is subject to a form of appeal under section 50. I would generalise that submission and say that the process undertaken by the public authority is not an adjudicative procedure that results in a decision. I note the contrast between the language of section 17 and section 50. Under the former, the language suggests a degree of informality: the public authority gives the applicant notice that specifies an exemption and states why it applies. Under the latter, the language suggests a degree of formality: the Commissioner serves a decision notice that requires steps to be taken to remedy a failure to comply. That reflects the Commissioner's role as a decision-maker rather than an administrator. (I also note that section 50 FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 15 merely provides for an application to determine whether the public authority has acted in compliance with Part I, not directly for a challenge to the section 17 notice. However, that wording is necessary in order to include an application if the public authority has not given a notice as required.)

[34]I note that under section 17(1) the public authority must identify the exemption on which it is relying. That suggests a current position. If the authority were committing itself for the future, I would have expected relies.

[41]Judge Jacobs’s decision was upheld on appeal by the Court of Appeal (Birkett v DEFRA

[2011] EWCA Civ 1606

, [2012] AACR 32) but there was no further analysis of the section 17 procedure or its implications.

[42]Subsequently the three-judge panel in Malnick confirmed that section 17 is not designed to control the correctness or otherwise of a public authority’s reliance on any given exemption. The Upper Tribunal reasoned as follows (with emphasis added):

[74]The first decision-maker in the statutory process is the public authority. Its duties are found in Part 1 of FOIA. An authority must confirm or deny whether requested information is held, and communicate the information which it holds, unless a relevant exemption applies: section 1(1). If an authority communicates information it must do so in accordance with section 11. Where it refuses to either confirm or deny, or to communicate information, it must issue a refusal notice in accordance with section 17 setting out all the exemptions claimed and why they apply. A public authority which correctly applies one of the exemptions on which it relies but incorrectly relies on others, and provides reasons and information in accordance with section 17, has complied with its duties under Part 1. It has complied with its duties under section 1 because section 1 permits it to withhold information to which any exemption applies. It has complied with its duties under section 17 because it has set out the basis on which it is claiming all exemptions relied on. It does not matter that it also incorrectly relies on other exemptions because the scheme of Part 1 means that, although a public authority must state all the exemptions which it relies upon, it need only be right about one of them.

[75]This analysis is consistent with the powers of the Commissioner to issue a decision notice under section 50(4). Under paragraph (a) the Commissioner must require a public authority to take steps to correct a failure to communicate information or issue confirmation or denial where it is required to do so by section 1(1). But where one exemption is correctly relied on by the authority, there has been no failure to comply with section 1(1) even if the other claimed exemptions do not apply. This explains why section 50(4) does not make any provision for a decision notice to address those other exemptions. Under paragraph (b), the Commissioner must specify the steps to be taken to correct a failure to comply with sections 11 or 17. But, even if an authority wrongly relied on some exemptions included in its refusal notice, this would not amount to a failure to comply with either section. FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 16

[43]The Upper Tribunal in Malnick was not directly faced with the conundrum posed by specifying sections 23 and 24 “in the alternative”. However, the passage as highlighted in paragraph 74, which is pitched at a high level of generality, supports the analysis advanced by both the FCDO and the Information Commissioner in the present proceedings.

[44]Paragraphs 74 and 75 of Malnick were then considered by Judge Markus QC in Oxford Phoenix (Mr Knight again appearing for the Commissioner), where she observed as follows (emphasis as in the original):

[38]If in these passages the Upper Tribunal had said that section 17 required an authority to be correct about one exemption, that would have supported Mr Knight’s contention that section 17 has a substantive content. But that is not what the Tribunal said. It said that the authority must be correct about an exemption in order to comply with Part 1. The Upper Tribunal then made clear that it is section 1 which requires an exemption to be correctly relied upon, and section 17 which requires proper notification of all exemptions relied on.

[45]This passage again emphasises the procedural nature of section 17. Having cited Birkett,

Judge Markus QC further observed as follows (emphasis added):

[40]Mr Knight said that, if section 17 is limited to matters of process, an authority could comply with that provision by relying on an obviously inapplicable exemption. That may be so, but it would be of no avail to the authority because doing so would lead to an adverse decision by the Commissioner under section 50(4)(a). It would not enable the authority to avoid its obligations under FOIA. Indeed, if the Commissioner is not empowered to require an authority to reconsider a request, that may well provide an incentive against an authority abusing section 17 in such a manner.

[46]We agree with the propositions that Mr Knight derived from this trilogy of Upper Tribunal authority and which he developed in his oral submissions. First, section 17 sets out an administrative process (Birkett at [32] and Oxford Phoenix at [42]). Second, section 17 contemplates an informal procedure (Birkett at [33]). Third, a public authority which specifies certain exemptions in its refusal notice under section 17 is not precluded from either dropping those exemptions or adding to them at a later stage (Birkett at [25], [29] and [34]). Fourth, specifying an exemption which in the event is found not to apply is not a breach of section 17 (Malnick at [74]-[75] and Oxford Phoenix at [36]). Fifth, and furthermore, citing an obviously inapplicable exemption is also not a breach of section 17 (Oxford Phoenix at [40]). Sixth, and finally, the ultimate supervisory mechanism for public authorities’ reliance on exemptions is not section 17 itself but rather the decision-making functions of the Information Commissioner and on appeal the First-tier Tribunal (Birkett at [33], Malnick at [75] and Oxford Phoenix at [40]).

[47]The First-tier Tribunal barely mentioned this trilogy of Upper Tribunal authority. Its decision contains no direct citation from either Birkett or Malnick. There is a brief reference in para 44 of the decision to the passage at paras 37-40 of Oxford Phoenix, and hence indirectly to Malnick. The First-tier Tribunal expressed its agreement with the proposition that citation of exemptions was a procedural rather than substantive requirement, but concluded that “the FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 17 (procedural) obligation on the public authority under s.17 is to identify the exemption(s) on which it in fact relies. A response which cites an exemption which the authority knows to be inapplicable does not ‘specify’ the exemption relied upon” (para 44).

[48]The requesters also downplay the trilogy of Upper Tribunal authority while content to concede that it has procedural aspects. It is our view that the Upper Tribunal authority is relevant and, as noted in paragraph 46 above, assists in the resolution of the question whether sections 23 and 24 may be deployed as alternatives.

(b) of FOIA

[49]We have concluded that the requirement in section 17(1)(b) of FOIA that a public authority, when refusing an information request by relying on an exemption, must issue the requester with a notice which, amongst other things, “specifies the exemption in question”, is satisfied when the notice specifies the sections 23 and 24 exemptions in the alternative. That much is obviously and uncontroversially so where the public authority holds some information which is covered by section 23 and other information that comes within section 24. But it also applies in the situation where the information that is held falls exclusively within either section 23 or section 24. We arrive at that conclusion by applying both the ordinary meaning of the words and a purposive construction to the statutory text.

[50]As to the former, on the ordinary meaning of the word, we are of the view that a notice which states that the public authority is relying on one of two exemptions in the alternative is “specifying” the exemption on which it relies (albeit with one other on which it does not). The simple requirement that the refusal notice “specifies the exemption in question” does not, in and of itself, preclude the use of masking by reliance on sections 23 and 24 in the alternative. In the relatively informal context of section 17, “specifies” means no more than “cites” or “identifies”. The First-tier Tribunal fell into error by in effect importing into section 17(1)(b) an implied substantive obligation that a public authority must specify only a valid exemption.

[51]In seeking to advance their construction of section 17(1)(b), the requesters placed great emphasis on section 17(4). This provides that a “public authority is not obliged to make a statement under subsection (1)(c) or (3) if, or to the extent that, the statement would involve the disclosure of information which would itself be exempt information”. As such, a public authority is relieved of the duty to provide the reasons why it states that an exemption applies where to do so would involve the disclosure of exempt information. In contrast, it was pointed out, section 17(1)(b) was not qualified in any way by section 17(4). As such, it was suggested, section 17(1)(b) was an absolute requirement. This superficially attractive argument is unpersuasive for two reasons. First, it assumes too much, not least that Parliament identified but then dismissed the revelatory problem, and indeed made a conscious decision to run the risk of harm to national security interests by prohibiting an “in the alternative” refusal notice notwithstanding the broad policy thrust evident in sections 23 and 24. Second, and in any event, it assumes what it purports to prove, namely that section 17(1)(b) is only susceptible of one reading. FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 18

[52]As to the need for a purposive construction, section 17 must be construed not in isolation but alongside and in harmony with other statutory provisions in the same scheme. We therefore return to the principles concerning the relationship between sections 23 and 24, which we set out at paragraphs 29 to 33 above, and emphasise in particular what has been set out in the case law, in general but forceful terms, about the national security context. Thus, for example, the Upper Tribunal said the following at paragraphs 19b and 29 of Cobain: 19b. This suggests an intention by Parliament to afford a wide degree of protection for information relating to the security bodies. Indeed, of all the exemptions under FOIA, s.23 affords the widest protection. …

[29]I agree, for the reasons above, with the Information Commissioner that the very fact that section 23 is engaged is highly material (paragraph 19a-19c), not least because, as he remarks, “of all the exemptions under FOIA, s.23 affords the widest protection” (paragraph 19b).

[53]In APPGER, the Upper Tribunal remarked as following at paragraph 16: Second, it is inconsistent with Parliament’s clear intention that, because of what they do, there should be no question of using FOIA to obtain information from or about the activities of section 23 bodies at all. There is no point sending a letter making a FOIA request to Thames House. As Ms Steyn put it, Parliament had shut the front door by deliberately omitting the section 23 bodies from the list of public authorities.

[54]We were also referred to R v Shayler

[2002] UKHL 11

[2003] 1 AC 247

and the comments of Lord Bingham at paragraph 12: There is much domestic authority pointing to the need for a security or intelligence service to be secure. The commodity in which such a service deals is secret and confidential information. If the service is not secure those working against the interests of the state, whether terrorists, other criminals or foreign agents, will be alerted, and able to take evasive action; its own agents may be unmasked; members of the service will feel unable to rely on each other; those upon whom the service relies as sources of information will feel unable to rely on their identity remaining secret; and foreign countries will decline to entrust their own secrets to an insecure recipient: see, for example, Attorney General v Guardian Newspapers Ltd (No 2)

[1990] 1 AC 109

, 118C, 213H-214B, 259A, 265F; Attorney General v Blake

[2001] 1 AC 268

, 287D-F. In the Guardian Newspapers Ltd (No. 2) case, at p 269E-G, Lord Griffiths expressed the accepted rule very pithily: "The Security and Intelligence Services are necessary for our national security. They are, and must remain, secret services if they are to operate efficiently. The only practical way to achieve this objective is a brightline rule that forbids any member or ex-member of the service to publish any material relating to his service experience unless he has had the material cleared by his employers. There is, in my view, no room for an exception to this rule dealing with trivia that should not be regarded as confidential. What may appear to the writer to be trivial may in fact be the one missing piece in the jigsaw sought by some hostile intelligence agency.” FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 19

[55]We agree with the FCDO that both section 23 and section 24 are concerned with the protection of national security and that the mutual exclusivity arises because section 24 is the subsidiary, safety net provision. We also agree that the specification of sections 23 and 24 in the alternative must be permitted to avoid adverse consequences of a significant nature. We discuss the substantive consequences of permitting specification in the alternative below.

[56]We also return to the trilogy of Upper Tribunal authority on the nature and purpose of section 17 as set out in paragraphs 39 to 48. We repeat that we are satisfied that this authority supports the analysis advanced by both the FCDO and the Information Commissioner in the present proceedings.

[57]As was noted above, we have also been referred to the Information Commissioner’s guidance on the interaction of sections 23 and 24. Although the guidance document is not binding on us, we note that the Information Commissioner, a key player in the FOIA scheme, permits public authorities to specify sections 23 and 24 in the alternative. We return to other aspects of the guidance below.

[58]We are therefore of the view that the FCDO was entitled to rely on sections 23(1) and 24(1) FOIA in the alternative, so as to protect the interests of national security by masking whether or not the information requested relates to one of the security bodies listed in section 23(3). Practical consequences

[59]Mr Fitzsimons submitted that permitting a public authority to specify sections 23(1) and 24(1) in the alternative would have adverse consequences for a requester. He put that assertion in the following way in paras 31 and 32 of his written response to the FCDO appeal:

[31]Finally, one of the bases upon which the FCDO commends its interpretation to the Upper Tribunal at §12(d) of its Grounds of Appeal is that it creates “no vice” in terms of the proper procedural working of FOIA.

[32]This is not correct. By not having information about which exemption is relied upon, a requester cannot make an informed decision about whether or not to pursue an appeal. This is critical given the difficulty in mounting a challenge to a s.23 exemption (as a result of it ordinarily being an absolute exemption) as opposed to mounting a challenge to a s.24 exemption, where the Tribunal will consider and weigh the public interest questions.

[60]We agree that any challenge by a requester to a public authority’s specification of exemptions in the alternative will be more complex where one of those exemptions is absolute and the other is qualified. However, the additional cost, time and work involved is not insurmountable. As noted above, the First-Tier Tribunal’s decision in APPGER dealt with the specification of sections 23(5) and 24(2) in the alternative. The Tribunal observed as follows on the consequences of allowing the public authority to do that (at para 112): First, Ms Clement argues that it is unsatisfactory to claim ss. 23(5) and 24(2) in tandem, as the APPGER cannot know if the NCND exemption is said to be absolute (s.23(5)) or dependent on proof of harm and subject to the public interest balancing test (s.24(2)). Clearly, this puts APPGER at some disadvantage, but such disadvantage stems from the nature of FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 20 secret material relating to national security. The disadvantage can be overcome by the APPGER arguing (as, in general, they have done) the balance of public interests in all cases in which both provisions are claimed. Beyond that, the remedy must lie with the Tribunal, in satisfying itself, with the benefit of having seen the material in question if any, whether an exemption has been properly claimed. (For s 24(2) we find that the information, if and to the extent that it exists, is subject to similar public interests and the same balance as we discuss below for s. 27.)

[61]We agree. In any event, and leaving national security considerations aside, any challenge under FOIA of a refusal of a request for information can be costly, time-consuming and problematic. In Birkett,

Judge Jacobs set out some of the principal difficulties as follows:

[62]Ms Proops emphasised the uncertainty that Mr Swift's interpretation would produce for those who request information. She was supported by Mr Facenna in pointing out the inconvenience and cost when the whole basis of a case is changed. I do not underestimate the sheer frustration, delay and financial cost that can be involved. Mr Birkett's experience in DEFRA provides a graphic example. However, this is a matter of degree. The position of those who request information is inherently uncertain. They do not know the information and have to work partly in the dark. And the case may change significantly once the Commissioner has seen the information and served a decision notice. A change of position by the public authority may make little or no difference or it may make things worse, possibly considerably worse. The difference will vary from case to case. Moreover, the effect would be the same if the Commissioner or the tribunal exercised the discretion to allow the new exemption to be raised. Certainty would only be enhanced in those cases in which the discretion was not exercised. Looking at the matter overall, certainty is not a sufficient reason to bar a public authority from raising a new exemption without permission. It is not simply that requesters may be faced with considerable uncertainty in circumstances where a public authority raises a new exemption late in the day. As Mr Knight pointed out, there may be other situations in practice in which a requester’s task may be made more onerous. A public authority may cite multiple exemptions, some absolute and some qualified. A public authority may be genuinely unsure as to which exemption applies and so cite two exemptions in the alternative. A public authority may specify an exemption which is not applicable on the current state of the law but where the authority wishes to overturn that orthodoxy in the current case and for the future. In all these situations (and others) the requester may be put to extra work in challenging the refusal.

[63]Furthermore, we recognise that in the general FOIA scheme requesters who receive adverse decisions from public authorities or the Information Commissioner may often be left in the dark as to the basis on which the decision was made e.g. where there is closed material or a closed judgment. It is in such cases that the respective roles of the Information Commissioner and the First-tier Tribunal come to the fore in scrutinising the arguments advanced in closed by the public authority. In any event, we repeat what we said at paragraph 55 above, namely that the specification of sections 23 and 24 in the FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 21 alternative must be permitted to avoid potentially adverse consequences of a significant nature. In that regard, the practical consequences for requesters in not knowing the whole basis on which the request was refused may be a small price to pay. They do not persuade us that, as a matter of law, a public authority is not permitted to state the exemptions in the alternative. The NCND provisions

[64]We were also referred at various junctures to the NCND provisions that relate to the FOIA national security exemptions. It will be recalled that a public authority’s duty to comply with section 1(1)(a) of FOIA is known as the “duty to confirm or deny” (see section 1(6)).

[65]However, section 23(5) of FOIA provides that “The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) which was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).”

[66]Section 24(2) in turn provides that “The duty to confirm or deny does not arise if, or to the extent that, exemption from section 1(1)(a) is required for the purpose of safeguarding national security.”

[67]It was accepted on all sides that sections 23(5) and 24(2) were not mutually exclusive and could be properly cited in the alternative. In that regard we agree with the analysis of the First-tier Tribunal in APPGER v Information Commissioner & FCO (EA/2011/0049-0051), as set out in paragraphs 91 to 109 of its decision (footnote omitted):

[91]The right neither to confirm or deny under s.23(5) whether information is held has been claimed in this case together with s.24(2) S.24(1) “Information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security.”

[92]However s.24 is a qualified exemption and subject to the public interest test.

[93]The Tribunal has given careful consideration to whether the “Neither Confirm Nor Deny” provisions of s.23(5) and s.24(2) may be claimed together. In a series of Tribunal cases, starting with Baker public authorities with responsibilities for security matters have routinely claimed both the s.23(5) and s.24(2) NCND provisions in respect of the same request. This enables the public authority to keep secret any involvement of a s.23 security body in a matter. The consistent use of ss.23(5) and 24(2) together ensure that requests made for similar information some time apart do not disclose, through whether both or only one of the NCND exemptions is claimed, if a s.23 body has acquired, or ceased to have, an involvement in a matter.

[94]APPGER argue that ss.23 and 24 are mutually exclusive adopting the arguments in Coppel on Information Rights chapter 17, and that the NCND provisions of ss.23(5) and 24(2) cannot be used in the alternative, without identifying which exemption is actually in play. APPGER argue that Baker was wrongly decided. FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 22

[95]Baker was decided on the papers, without the benefit of oral submissions from counsel. Nevertheless, it has been followed in many cases since, and public authorities attach considerable importance to the ability to claim both NCND provisions together in matters where national security considerations are at stake. It will often be the case that information relating to national security has been supplied both by s.23 bodies and by other bodies, such as police forces, the Diplomatic Service or HM Revenue and Customs. These latter bodies may be covered by the qualified NCND provision of s. 24(2).

[96]In the light of the submissions by Ms Clement, and the importance attached by public authorities to the ability to claim s.23(5) and s.24(2) together, the Tribunal has reviewed carefully whether the conclusion reached in Baker is one it can follow.

[97]It is in the nature of the security services that much or all of what they do is necessarily secret. That is why s.23 is an absolute exemption. Necessary secrecy also extends to keeping secret the fact of whether a security body has an involvement with a matter. The Tribunal was taken to the dicta of Lord Brown of Eaton-under-Heywood JSC in the Supreme Court case of Regina (A) v Director of Establishments of the Security Service

[2009] UKSC 12

. This concerned the jurisdiction of the Investigatory Powers Tribunal. Lord Brown spoke of:

“the self-evident need to safeguard the secrecy and security of sensitive intelligence material, not least with regard to the working of the intelligence services” and of the need: “to protect the ‘neither confirm nor deny’ policy (equally obviously essential to the effective working of the services).”

[98]The Tribunal attaches considerable importance to the availability of NCND in national security matters. The Tribunal does not need to consider whether Lord Brown’s dicta is in any way binding upon us. It is sufficient to note his comments as an authoritative statement of a view we had reached independently on the evidence before us.

[99]In support of APPGER’s case that the s.24 provisions are an alternative to the s.23 provisions Ms Clement points to the introductory words of s.24 which provide that “Information which does not fall within section 23(1) is exempt information if …”. This, she say, limits the scope of s.24 to information not caught by s.23. This argument requires s.24 to be read as a whole (i.e. as one single “provision” for FOIA purposes, rather than as separate provisions) and that it and s.23 are mutually exclusive.

[100]Mr Hopkins for the IC submits that this argument must fail, as s.1(1) sets out two distinct types of right to information. First, there is the right “to be informed in writing by the public authority whether it holds information of the description specified in the request” (s.1(1)(a)). Second, there is the right “to have that information communicated to him” if it is held (s.1(1)(b)). This second right only arises where the first one is engaged. Where NCND is correctly applied, the first right is disapplied, and the second never comes into play. FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 23

[101]The exemptions in Part II of FOIA therefore should not be read as single monolithic provisions. Rather, they consist of distinct provisions, some of which go to the first type of access right, and some to the second. S.24(1) is a provision which, in terms, concerns only the s.1(1)(b) right. It arises only where s.23(1) does not. S.24(2), however, is a separate provision, concerned only with the s.1(1)(a) right. It is not mutually exclusive with section 23(5).

[102]Ms Steyn drew attention to the specific terms of the NCND provision at s.23(5). This is drawn more widely than many other NCND provisions in the Act in that it covers “information (whether or not already recorded)”. This contrasts with the definition of information in s. 84 “Information ... means information recorded in any form”.

[103]The wider definition serves to protect information (which may not be recorded) that a s.23 body is not involved. Such information could be of value to a hostile agency, and the terms of s.23(5) put it beyond doubt that NCND may be used in such circumstances, rather than a simple denial. This serves further to reinforce the importance to be attached to the ability to make a NCND response.

[104]It is in the nature of NCND that it covers circumstances in which information is not held, as well as circumstances in which information is held. It can be used to protect sources, and to avoid inferences being drawn from acknowledgement of the fact that certain information is not held. Moreover if NCND could not be used in circumstances in which information was not held, there would be little point in it, as it would then amount to an acknowledgement that information was held.

[105]If no information is held, from either s.23 or s.24 sources, that absence of information is, by its nature, indivisible. As there is nothing to attribute separately to ss.23(5) and 24(2), it is logical to claim them together.

[106]Ms Steyn further argues that, had Parliament intended the use of s.23(5) to debar the use of s.24(2) (or vice versa) it would have said so on the face of the Act. The Tribunal agrees.

[107]First, it is common for a public authority to claim more than one exemption in respect of a single request for information. If Parliament had intended the exemptions in ss.23 and 24 to be an exception to this general rule, it would surely have said so.

[108]Second, intelligence information, of the sort likely to be caught by ss.23 and 24, is often made up of fragmentary data. In its nature, it may come from multiple sources. The overwhelming importance of the ability to use NCND responses in relation to national security matters, and to do so in relation to information from all sources, renders it highly improbable that Parliament would have intended the use of these exemptions to be, uniquely, subject to greater restrictions than other exemptions.

[109]Therefore the Tribunal concludes that a proper construction of ss.23 and 24 allows the NCND provisions of ss.23(5) and 24(2) to be claimed together, in relation to a single request for information. The words “information which does not fall within section 23(1)” are not to be read as FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 24 rendering the NCND provisions of ss.23(5) and 24(2) as mutually exclusive, but rather as a means of defining national security information which comes from sources other than the bodies named in s.23(3).

[68]We are mindful that the First-tier Tribunal there was dealing with two exemptions which were not mutually exclusive. Nonetheless, in our view much of the reasoning underlying the conclusion that the NCND provisions could be relied on in the alternative applies equally in the context of the main provisions in sections 23 and 24.

[69]However, the requesters submitted that the fact that sections 23(5) and 24(2) could be cited in the alternative by a public authority provided a simple and ready-made legislative solution to concerns about the revelatory problem. As such, they argued, there was no lacuna which justified a finding that the mutually exclusive sections 23(1) and 24(1) could also be specified in the alternative.

[70]We found this a singularly unattractive argument for a number of reasons. First, it is by no means obvious that a public authority can rely on the NCND provisions where the mischief is not what would be revealed by confirmation or denial that the information is held, but rather the potential harm that could result from disclosure of the precise national security exemption relied upon. Second, reliance on the NCND provisions in the alternative would result in requesters being provided with even less information about the fate of their requests – they would not even know whether relevant information of any sort was held. As the Upper Tribunal observed in Corderoy, “no doubt because of the expected and confirmed involvement of the security bodies a ‘neither confirm nor deny approach’ was correctly not advanced by the respondents under section 23” (at paragraph 60). Third, such a response would in some cases result in patent absurdity, e.g. where the very fact that material information was held was on the public record (for example, where the existence of files containing national security-related information has been revealed by TNA index searches). To that extent reliance on NCND instead of sections 23 and 24 in the alternative would undermine rather than further the legislative purpose of FOIA. More generally, the requester’s right under section 1(1)(a) of FOIA to be told if information is held is respected by specification of sections 23 and 24 in the alternative, whereas both section 1(1) rights would be rendered nugatory by using NCND. The official guidance

[71]We have referred above to the guidance issued by the Information Commissioner in September 2012 on How sections 23 and 24 interact (see paragraphs 35-38). Both Mr Callus and Mr Fitzsimons referred us to several passages in the guidance which they submitted supported their approach to the proper construction of section 17. For example, para 24 refers to “the problem of applying either section 23(1) or section 24(1)”; likewise para 26 refers to the “problem” being addressed by the fact that “the Commissioner will allow public authorities to cite both exemptions ‘in the alternative’ when necessary” (emphasis in the original). This is described as “the pragmatic solution to the problem” of undesirable disclosure (para 27). Furthermore, “technically section 17(1) requires public authorities to specify the exemption they are relying on. However, it is important in these circumstances that the refusal notice FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 25 effectively disguises which provision actually applies. Therefore, the Commissioner will accept a refusal notice which cites both exemptions, stating that they are being cited in the alternative and then explaining why each one could apply” (para 28).

[72]In summary, the requesters argue that this shows that the Commissioner is assuming for herself the right to provide a discretionary solution to avoid an unfortunate problem which had not been foreseen by the drafters of FOIA. However, this submission falls into the trap of seeking to interpret an independent regulator’s guidance as if it were statute when such guidance is neither a source of binding law nor a formal aid to construction, but rather a regulator’s expert and independent view as to how to apply the law in practice. In addition, the requesters’ reading as to the significance of the use of the term “pragmatic” in paragraph 27 of the guidance and “technically” in paragraph 28 means those single words are doing a lot of heavy lifting.

[73]We also recognise that previously, in March 2012, the Ministry of Justice had issued a document entitled Freedom of Information Guidance: Exemptions guidance – Section 23: information supplied by, or relating to, bodies dealing with security matters. Page 4 of that document included the following passage (emphasis added): Use of section 23(5) and 24(2) exemptions together In practice it is very rare that a neither confirm nor deny response will cite just section 23, as this will confirm that the question of whether or not information is held relates to one of the section 23 bodies. Therefore, to avoid releasing information about one of these bodies which has not already been released, it will be necessary to rely upon neither confirm nor deny under both section 23 and section 24. By using both exemptions it obscures the fact that a section 23 body may or may not have been involved. This is permissible in contrast to the application of section 23(1) and section 24(1) to withhold information that the duty under section 1(1)(b) applies to, where the exemptions are mutually exclusive, although there are instances where they may appear together to withhold different information. The ability to use section 23(5) and section 24(2) together in respect of the same information is important in order to maintain the principle that information about section 23 bodies is exempt. The use of section 24(2) requires full consideration of the public interest in disclosure (for more information see the detailed exemptions guidance on section 24).

[74]Page 8 of the Ministry of Justice guidance included the following passage: Relationship with other exemptions There is nothing to prevent the use of other exemptions if a section 23 and/or a section 24 exemption is relied upon in relation to the same information. While section 23(1) and section 24(1) cannot be cited for the same information (except in the context of a neither confirm nor deny response) it is possible to use them in the same response cumulatively, i.e. if they apply to different information.

[75]Mr Callus, in particular, relied on this brief document and these passages in support of the proposition that sections 23(1) and 24(1) could not be relied on in FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 26 the alternative. The short answer is that the Ministry of Justice guidance is just that, guidance. The mere fact that it omits what is often the standard official disclaimer in a foreword to the effect that the document is not intended to be a definitive statement of the law does not give it any added weight. The Ministry of Justice guidance is not an authoritative statement as to the proper interpretation of FOIA. It reflects no more than a civil service understanding of what the law is at a given point in time and cannot be regarded as an aid to construction. In any event, it is far from clear that the guidance contemplated the issue as identified by the example in the Commissioner’s own guidance. The human rights dimension

[76]Dr Lownie resists the FCDO’s appeal on an alternative basis, namely that the Upper Tribunal should interpret FOIA on the basis that his rights are engaged under

article 10 of the European Convention on Human Rights

(“the Convention”). Article 10(1) protects rights to freedom of expression and includes the right to receive and impart information and ideas without interference by a public authority. Mr Callus submitted that it also includes a right of access to information. In so far as the interpretation of FOIA for which the FCDO contended would permit the masking of an exemption, it would infringe the right of access to information. We should therefore reject that interpretation (Human Rights Act 1998, section 3) which would also be a matter of concern in light of the particular importance attributed to article 10 rights by Parliament (Human Rights Act, section 12).

[77]In support of his submissions, Mr Callus relied on the judgment of the Grand Chamber of the European Court of Human Rights in Magyar Helsinki Bizottság v Hungary

(2020) 71 EHRR 2

. In that case, the Court reviewed its previous case law and extended the scope of article 10 to include the right of access to information in certain circumstances. The Court observed at paragraph 148: Thus…since the Convention was adopted the domestic laws of the overwhelming majority of Council of Europe member States, along with the relevant international instruments, have indeed evolved to the point that there exists a broad consensus, in Europe (and beyond), on the need to recognise an individual right of access to State held information in order to assist the public in forming an opinion on matters of general interest.

[78]The Court went on to hold at paragraph 156: In short, the time has come to clarify the classic principles. The Court continues to consider that “the right to freedom to receive information basically prohibits a Government from restricting a person from receiving information that others wish or may be willing to impart to him”. Moreover, “the right to receive information cannot be construed as imposing on a state positive obligations to collect and disseminate information of its own motion”. The Court further considers that art. 10 does not confer on the individual a right of access to information held by a public authority nor oblige the Government to impart such information to the individual. However, as is seen from the above analysis, such a right or obligation may arise, firstly, where disclosure of the information has been imposed by a judicial order which has gained legal force (which is not an issue in the present case) and, secondly, in circumstances where access to the information is instrumental for the individual’s exercise of his or her right to FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 27 freedom of expression, in particular “the freedom to receive and impart information” and where its denial constitutes an interference with that right.

[79]We were left in some doubt as to how these passages in Magyar Helsinki are applicable to the issue before us. We are not now considering whether the requesters should be given access to any of the withheld information which will be a matter for the First-tier Tribunal when it comes to determine the substantive appeal. We agree with Mr Knight that Magyar Helsinki does not deal with the question of what must be provided to a requestor by way of reasons for refusal to give access to information, which is all that we are being asked to decide. We do not regard Magyar Helsinki as establishing the procedural right to be informed in all circumstances and irrespective of any damage to the public interest of the reasons for withholding access to information.

[80]Even setting aside these concerns, Mr Callus’s submissions face the hurdle that they are inconsistent with the domestic approach to date. In Moss v Information Commissioner and the Cabinet Office

[2020] UKUT 242 (AAC)

, the Upper Tribunal (Judge Wright) considered the effect of Magyar Helsinki. He held that the Tribunal was bound by the conclusion (albeit obiter dicta) of the majority of the Supreme Court in Kennedy v Charity Commission

[2014] UKSC 20

[2015] AC 455

and of at least two members of the Court in British Broadcasting Corporation v Sugar (No 2)

[2012] UKSC 4

[2012] 1 WLR 439

Judge Wright held:

[56]The respondents argue that although technically obiter I should follow the reasoning of Supreme Court in Kennedy on

Article 10(1) of the ECHR

on the basis that it was a point which was fully argued out before the Supreme Court and considered in great depth by it. In these circumstances the respondents argue that the Supreme Court’s view on Article 10(1) was at the “almost virtually binding” end of the spectrum of highly persuasive dicta: see APPGER v ICO and FCO

[2015] UKUT 377 (AAC)

; [2016] AACR 5 at paragraph [49] and, to similar effect, Brunner v Greenslade

[1971] Ch 993

at pages 1002- 1003. They further relied on R (Youngsam) v Parole Board

[2017] EWHC 729

Admin;

[2017] 1 WLR 2848

at paragraphs [20]-[40] for the proposition that where the Supreme Court has articulated a statement of principle, including on the interpretation and application of Convention rights, which was intended to be followed by all courts and tribunals of an inferior jurisdiction, it ought to be so followed, regardless of whether it is technically obiter.

[57]From this starting point the respondents argue that subsequent caselaw of the ECtHR (in this case Magyar) which is contrary or different in material effect to the clearly reasoned view of the Supreme Court in Kennedy cannot alter the approach to precedent. Section 2(1) of the Human Rights Act 2000 – with its requirement on all domestic courts and tribunals to “take into account” any decision of the ECtHR when deciding a question which has arisen in connection with a Convention right – is simply that, so the respondents argue. It amounts to an obligation to take into account the ECtHR’s decision in Magyar but not to follow it where it conflicts with the (effectively) binding superior domestic court authority of Kennedy. The respondents relied for this aspect of their argument on Kay FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 28 v Lambeth LBC

[2006] UKHL 10

; [2006] 2 A.C. 465 and R (RJM) v SSWP

[2008] UKHL 63

;

[2009] 1 AC 311

. In the latter Lord Neuberger said this. ‘64. As a matter of principle, it should be for this House, not for the Court of Appeal, to determine whether one of its earlier decisions has been overtaken by a decision of the ECtHR.’

[58]I agree with the respondents. 59.…Magyar has expanded the understanding of Article 10(1) so that as a matter of ECtHR law it now covers, albeit in limited circumstances, a right of access to information. This was not disputed before me. However, the view of five members the Supreme Court in Kennedy, as well as the Court of Appeal in Kennedy and two if not three members of the Supreme Court in Sugar (No.2), in my judgment, is that domestic law does not consider Article 10(1) extends to include a right of access information, and I consider myself bound by the rules of precedent to follow this view.”

[81]Mr Callus submitted that we would be free to, and should, take a different view to the Supreme Court, given the obiter nature of the various relevant passages of Kennedy and Sugar and the developments represented by Magyar Helsinki since those cases were decided. Nor should we regard ourselves as bound by the single-judge decision in Moss which had failed to recognise the development to the article 10 jurisprudence which Magyar Helsinki had established. We should take our lead from the Convention case law in accordance with the well-known dictum of Lord Bingham in R (Ullah) v Special Adjudicator

[2004] UKHL 26

, [2004] 2 A.C. 323, para 20: “The duty of national courts is to keep pace with the Strasbourg jurisprudence as it evolves over time: no more, but certainly no less”.

[82]We decline to reach the conclusion that a right of access to information exists in English law. There is no binding domestic authority to that effect. We agree with the conclusion of Judge Wright in Moss and would gratefully adopt his reasoning which is detailed and thorough. We agree with Mr Knight that there would be no purpose in revisiting the reasoning in Moss which would amount to revisiting the reasoning in Kennedy and Sugar which followed full argument in the Supreme Court. We agree with Sir James that Mr Callus’s submissions in any event fail to deal with the qualified nature of article 10 rights and fail to deal with how the carefully calibrated scheme of FOIA yields any disproportionate interference with the rights in article 10(1) which would be a necessary condition of any infringement. We do not agree that anything in FOIA is capable of lessening (as opposed to enhancing) the right to information contained in sensitive material, and do not accept that the interpretation which we have reached is incompatible with the requesters’ article 10 rights

[83]Mr Callus submitted that the FCDO’s interpretation would be incompatible with

article 6(1) of the Convention

which guarantees the right to a fair trial in relation to the determination of a person’s civil rights and obligations. Even assuming that the right of access to information were to engage a civil right in some fashion, we were left unclear as to how the scheme of FOIA breaches any fair trial right. Mr Callus submitted that tribunal proceedings would be unfair if the requestor had to mount hypothetical arguments about one limb of a section 17 notice which would not represent the public authority’s true reason for withholding information. That submission ignores the scrutiny which both the FCDO v Information Commissioner, Williams and Others (Sections 23 and 24)

[2021] UKUT 248 (AAC)

GIA/388/2021, GIA/389/2021 & GIA/390/2021 29 independent Information Commissioner and the First-tier Tribunal provide, and their ability to probe public authorities in order to ensure that the FOIA exemptions are properly and lawfully applied. We have already rejected the submission that the additional burdens of litigation (such as they are) would be sufficient to overcome the risk to national security that the requestors’ submissions entail. We were provided with no other particularised example of a potential article 6 breach that the legislation would engender if interpreted in accordance with Sir James’s submissions. We would reject this part of Mr Callus’s challenge.

[84]Finally, we disagree with Mr Callus’s characterisation of the FCDO’s position as condoning untrue or misleading decisions by public authorities. Anyone reading a decision founded on section 23 or section 24 in the alternative will appreciate – or can find out – that he or she cannot receive certain information because it is information supplied by, or relating to, bodies dealing with security matters, or exempt from disclosure on national security grounds. The individual would not know which of the exemptions applied but there would be nothing untrue or misleading. We regard this part of Mr Callus’s submissions as inaccurate. Conclusion

[85]For all these reasons, we conclude that the exemptions in sections 23(1) and 24 may as a matter of law be specified under section 17 in the alternative and that the national security imperative will permit this in practice. Accordingly, the FCDO’s appeal is allowed. Mrs Justice Farbey DBE Chamber President Kenneth Mullan Judge of the Upper Tribunal Nicholas Wikeley Judge of the Upper Tribunal Authorised for issue on 1 October 2021

Cited in 21 later judgments

and 12 more of the most senior