“39. The other ‘live’ issue in this case is whether disclosure of information relating to the specific DRO application with which the Appellant is involved, is covered by s40(2) FOIA and exempted from disclosure. 40. Applying the legal framework above, it is our view that the information sought is clearly the personal information of the third party applicant, and it is additional to the information currently available about the third party online. 41. We accept the Commissioner’s analysis in the decision notice that the Appellant has a legitimate interest in the disclosure of the information, to enable him to discover how the third party was able to successfully apply for a DRO in the circumstances of the case. Given the availability of some information online, the process which led to the revocation of the DRO, and the availability of the Ombudsman to investigate the procedures of the Insolvency Service this must lessen the Appellant’s legitimate interest in disclosure. We are also less sure than the Commissioner that disclosure would be necessary to fulfil this legitimate interest, but on balance we accept that there may be undisclosed information which it would still be necessary for the Appellant to have access to. 42. Therefore, to complete our analysis, it is necessary to balance these legitimate interests in disclosure to the Appellant against the data subject’s interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. 43. We agree with the Commissioner’s view that the named third party would have no expectation that the Insolvency Service would disclose details of his DRO application to the ‘world at large’ (as disclosure under FOIA cannot be restricted). We have viewed the withheld information, and its disclosure would clearly interfere with the privacy rights of the named third party and be likely to cause him harm and/or distress. We note the Appellant’s allegation that the third party has been dishonest in his application, but it seems to us that, even if that is so, that does not remove the third party’s reasonable expectation that the information will not be disclosed. 44. Therefore, we accept that Appellant has a limited legitimate interest in accessing this information, but in our view this is insufficient to outweigh the third party’s fundamental rights and freedoms relating to their private life, even if the information provided during the application process was not all true.”
“(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”
“Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity. Authority: Corporate Officer (Divisional Court) at [43] and Farrand at [26]- [27]. 38. Proposition 4: Accordingly the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality, although this may not add much to the ordinary English meaning of the term. Authority: Corporate Officer (Divisional Court) at [43], South Lanarkshire at [27] and Farrand at [26]. 39. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question. Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South Lanarkshire at [27]. 40. Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part test. Authority: South Lanarkshire at [27]. 41. Proposition 7: Where Article 8 privacy rights are in issue, the question posed under Proposition 1 can only be resolved after considering the excessive interference question posted by stage (iii). Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South Lanarkshire at [25]. 42. Proposition 8: The Supreme Court in South Lanarkshire did not purport to suggest a test which is any different to that adopted by the Information Tribunal in Corporate Officer (Information Tribunal). Authority: South Lanarkshire at [19]-[20] and Farrand at [26].” (2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1) (personal information of the applicant], and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles. Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’). Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data… 33. In making his submissions Mr Knight referred me to four authorities, being (in date order) decisions of the Information Tribunal, the Divisional Court, the Supreme Court and the Upper Tribunal respectively. These were: (1) Corporate Officer of the House of Commons v Information Commissioner and Others (EA/2007/0060-0063, 0122-0123 and 10131) (abbreviated here to “Corporate Officer (Information Tribunal)”); (2) Corporate Officer of the House of Commons v Information Commissioner and Others[2008] EWHC 1084 (Admin) (“Corporate Officer (Divisional Court)”); (3) South Lanarkshire Council v Scottish Information Commissioner[2013] UKSC 55 (“South Lanarkshire”); and finally (4) Farrand v Information Commissioner[2014] UKUT 310 (AAC) (“Farrand”). The last, of course, was decided after the Tribunal had given its decision on the present appeal. 34. Mr Knight helpfully set out eight principles or, as I prefer to call them, eight propositions, derived from this case law. I set them out below, including references to the relevant passages in the various decisions as authority for these propositions as (a) I endorse them; (b) they assist in resolving the present appeal; and (c) this taxonomy may well prove a useful roadmap for the Commissioner and other First-tier Tribunals when seeking to chart a path through the thicket of issues thrown up by Condition 6(1) of Schedule 2 in other cases… 35. Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three questions to be asked: “(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”
“Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity. Authority: Corporate Officer (Divisional Court) at [43] and Farrand at [26]- [27]. 38. Proposition 4: Accordingly the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality, although this may not add much to the ordinary English meaning of the term. Authority: Corporate Officer (Divisional Court) at [43], South Lanarkshire at [27] and Farrand at [26]. 39. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question. Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South Lanarkshire at [27]. 40. Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part test. Authority: South Lanarkshire at [27]. 41. Proposition 7: Where Article 8 privacy rights are in issue, the question posed under Proposition 1 can only be resolved after considering the excessive interference question posted by stage (iii). Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South Lanarkshire at [25]. 42. Proposition 8: The Supreme Court in South Lanarkshire did not purport to suggest a test which is any different to that adopted by the Information Tribunal in Corporate Officer (Information Tribunal). Authority: South Lanarkshire at [19]-[20] and Farrand at [26].”