First-tier Tribunal - 2023 UKFTT 778 GRC
From GDPRhub
| First-tier Tribunal - 2023 UKFTT 778 GRC | |
|---|---|
 | |
| Court: | First-tier Tribunal (United Kingdom) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 5(1)(a) GDPR Freedom of Information Act |
| Decided: | 25.09.2023 |
| Published: | |
| Parties: | Information Comissioner |
| National Case Number/Name: | 2023 UKFTT 778 GRC |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | English |
| Original Source: | BAILII (in English) |
| Initial Contributor: | Sainey Belle |
The First-tier Tribunal held that a request made under the Freedom of Information Act was unjustified as it did not satisfy the necessity test under Article 5(1) GDPR.
English Summary
Facts
An individual (“appellant”) made a request to their local council (Doncaster Metropolitan Borough Council - “controller”) under the Freedom of Information Act 2000 (“FOIA”) seeking information on the individual who was responsible for drawing a proposed cycle route.
The controller rejected the request for information pursuant to section 40(2) FOIA, stating that the disclosure of information would contravene one of the data protection principles as the employee had not consented to the disclosure and the data would not have been processed in a fair and lawful way pursuant to Article 5(1)(a) GDPR.
The appellant sought to argue that the name of the individual who created the public drawing was not considered personal data per Article 4(1) GDPR.
Holding
The Tribunal held that the controller was correct to rely on the exemption provided in section 40(2) FOIA. Per the Tribunal, a disclosure of personal data following a FOIA request for information would be transmission, dissemination or otherwise making it available and is therefore processing for the purposes of Article 4(2) GDPR. Responses to requests for information under FOIA are published and, as such, are available for the whole world to view; they would not be exclusive to the appellant.
To be lawful in accordance with Article 5(1) GDPR, publication must be necessary in the pursuit of the legitimate interest. In Goldsmith International Business School -v- The Information Commissioner and the Home Office [2014] UKUT 563 (ACC); (a) “necessary” means being more than desirable but less than indispensable or absolute necessity and can be summarised as “reasonably necessary”, (b) the test for necessity must be satisfied before consideration of whether the interests or fundamental rights or freedoms of the data subject should override the necessary disclosure and (c) the test of reasonable necessity itself involves the consideration of alternative measures and so a measure would not be necessary if the legitimate aim could be achieved by something less.
In an email sent to the appellant by the “Head of Service Major Projects and Strategic Infrastructure”, it was stated that various individuals have taken part in the project, with a varying degree of roles and responsibilities. The employee also stated that they were in a better position to respond to any questions concerning the project as they have a better overview of the strategic objectives. The Tribunal were of the opinion that the individual(s) who participated in the drawing of the route had a role akin to a compiler than a creator.
In light of the rule laid out in the Goldsmith case, the Tribunal concluded that the Head of Service is in a more public facing role and more senior and would be better placed and able to assist the appellant and others with the pursuit of the legitimate Interest than the person whose name is sought by the request. Provision of the name is an appropriate alternative measure which would meet the needs of any legitimate interest pursued. For the reasons set out above we conclude that publication of the name of the person would not be necessary in the pursuit of the legitimate interest and therefore processing the personal data requested would not be lawful.
Comment
It should be noted that while UK left the European Union by 2020, the UK GDPR remains the same as the EU's GDPR as it is classified as retained EU Law under the UK's legislative system. This case pits Freedom of Information against Data Privacy, both matters under the purvue of the UK's DPA (ICO). It is interesting to note how the court develops and expands upon a test for the interpretation of Article 5(1) GDPR and balances it against Freedom of Information, a principle which often enjoys a prioritised status in English and Welsh law.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
[New search] [Context] [View without highlighting] [Printable PDF version] [Help] Neutral citation number: [2023] UKFTT 778 (GRC) Case Reference: EA/2022/0406 First-tier Tribunal General Regulatory Chamber Information Rights Heard on: 22 August 2023 Decision given on: 25 September 2023 Before Tribunal Judge Simon Heald Tribunal Member Ms E Yates Tribunal Member Mr D Sivers Between PETER WAILES Appellant and THE INFORMATION COMMISSIONER Respondent Decision: The appeal is dismissed REASONS Mode of Hearing The appeal was decided without a hearing as agreed by the parties and allowed by the Tribunal by Rule 32(1) of the Tribunal Procedure (First -Tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended) Summary of Reasons 1. Peter Wailes (Mr Wailes and/or the Appellant) made a request pursuant to the Freedom of Information Act 2000 (FOIA) to be provided with the name of the person at Doncaster Metropolitan Borough Council (the Council) who made a certain drawing (the Request). 2. The information sought is personal data by section 3(2) Data Protection Act 1998 (DPA). 3. Responding to the Request by processing the Personal Data in this case would contravene the Data Protection Principles as set out in Article 5(1)(a) of the General Data Protection Regulations (GDPR) because it would not be necessary for the pursuit of a legitimate interest required by Article 6(1)(f) GDPR. Bundle 4. The Tribunal considered an open bundle for this appeal consisting of 174 pages. Page 23 appeared to be out of place and contained two questions numbered 5 and 6. We concluded they were not intended by the Appellant to be part of his appeal but that even if we are wrong about this, they would not have altered the outcome of this appeal. The Request 5. On 18th February 2022 Mr Wailes wrote to the Council and made the Request pursuant to section 1 (1) FOIA in relation to a drawing of a proposed cycle route. He asked Could you please tell me who drew this drawing? 6. There were two other questions raised in the Request but the parts of the Decision Notice which relate to them were not appealed. Reply from the Council 7. There was correspondence concerning response times but in any event on the 21 April 2022 the Council responded to the Request (the Councils Reply). The Councils position was that the information requested was exempt from disclosure under section 40(2) FOIA because Disclosure would contravene one of the data protection principles 8. The Council expanded on this by saying:- The details you have requested regarding council officers are personal data. Disclosure of the information would contravene the requirement of principle 1 that personal data must be processed fairly and lawfully. As an employer the Council owes a duty of confidence to employees and the employee has not consented to the disclosure of this information. Disclosing details without the consent of Officer would breach that duty of confidence and be unlawful. We therefore are unable to provide the requested information at this time Review by the Council 9. On the 30 April 2022 Mr Wailes wrote asking for an internal review of the Councils Reply. In summary he said that he had found many other examples of drawings produced by the Council in a short period and in each the creator had been identified in the title block of the drawing; that the Council would not be able to show that all these had given permission or had been asked for permission to have their names shown and that if the Councils argument was valid there would be prima facia evidence of breaches of GDPR rules in (at least) 96 cases He described the claim that a draftsmans name (in itself) is personal data as being simply nonsense. 10. By email of the 1 July 2022 the Council provided Mr Wailes with the outcome of its internal review (the Internal Review). The Internal Review contained the reasoning of the Councils Reply but in addition that The drawings are put together using information, designs etc from several officers. The officer putting together the final drawing is not responsible for the project in its entirety and it is therefore not necessary to provide those details. You have previously been provided with contact details for senior members of staff should you wish to raise any issues regarding this matter Procedure 11. Mr Wailes referred the matter to the Information Commissioner (the Commissioner and/or the Respondent) by section 50 FOIA. On the 7th November 2022 the Commissioner issued the Decision Notice by which it concluded that the Council was entitled to rely on the exemption provided by section 40(2) FOIA. 12. On 4th December 2022 Mr Wailes appealed the Decision Notice (in so far as it related the one remaining question) to this Tribunal by section 57 FOIA. The Commissioner provided a response (the Commissioners Response) on 10th January 2023 to which Mr Wailes replied on the 23 January 2023 (the Appellants Reply). The Relevant Law 13. FOIA provides that any person making a request for information to a public authority is entitled to be informed in writing if that information is held (section 1(1)(a) FOIA) and if that is the case to have that information provided (Section 1 (1)(b) FOIA). 14. These entitlements are subject to exemptions. The exemptions relating to the provision of information can be absolute by Section 2(2)(a) FOIA or qualified by section 2(2)(b) FOIA. Where an exemption is qualified it is subject to what is known as the public interest balancing test set out in section 2(2)(b) FOIA which is that in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. 15. Section 40(2)(b) FOIA provides that any information to which a request for information relates is exempt if one of the three conditions in subsections (3A), (3B) or (4A) of section 40 FOIA applies. 16. Section 40(3A)(a) FOIA sets out the first of these three conditions. This makes the provision for personal data to be exempt if disclosure of this information to a member of the public otherwise than under this Act (a) would contravene any of the data protection principles 17. By Section 2(3)(fa) FOIA if the exemption relates to this first condition in section 40(3A)(a) FOIA it is an absolute exemption and therefore does not require consideration of the public interest balancing test. 18. Section 3(4)(d) DPA defines processing as disclosure by transmission, dissemination or otherwise making available. 19. The Data Protection Principles are set out in the GDPR. Article 5(1) GDPR provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject . 20. By Article 6(1) (f) GDPR processing of personal data is only lawful if and only if and to the extent that it is necessary for the purposes of the legitimate interests pursued by .a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of the data subject which require protection of personal data . 21. In the Bundle we see reference to the Environmental Information Regulations 2004 (the EIR). In our view the request for the name in this appeal is not included in the definition of environmental information in the EIR. In our view FOIA is applicable to this appeal and not the EIR. Grounds of the Appeal 22. The Appellant in his Grounds of Appeal raises several concerns. In summary he says:- a. the process of assessment carried out by the Commissioner and the evidence considered by which the conclusion was reached is not described. b. the reasons why the Commissioner concluded that the provision of the name of the head of department adequately fulfilled his request was not clearly explained and details of evidence used to reach that conclusion not given c. the Commissioner did not say what exactly the balancing test was (which was not performed as not being required). d. it is bizarre that a public servant carrying work paid for by the public can remain anonymous and unaccountable. 23. He concludes by saying that he wants to appeal based on four questions: - a. Has the ICO discovered and then properly considered all relevant information? b. Has the ICO correctly balanced the principles of Freedom of Information against the principles of data protection? c. Is the Councils claim to be concerned with data protection genuine or is there another motive? d. Has the ICO overlooked the exemptions in Schedule 2 of the Data Protection Act 2018? The Commissioners Response 24. The Commissioners Response asks that the Appeal be dismissed for the reasons set out in the Decision Notice. We summarise their position taken from the Decision Notice and the Commissioners Response as being: - a. The name of the person concerned is Personal Data and providing a response to the Request would be to process it and accordingly the exemption in section 40(2) FOIA is engaged. b. Processing Personal Data in this way must be lawful, fair and transparent as regards the data subject and will only be lawful if necessary for the pursuit of a legitimate interest and then, if found to be necessary, balanced against the fundamental rights or freedoms of the data subject. c. While there is a legitimate interest in the accountability and transparency of the Council as regards to the Councils implementation of cycle lanes and its management of the cycle lane project provision of the information requested was not necessary for the pursuit of that interest. d. it is not the role of the Tribunal in this appeal to engage in a review of the process adopted by the Commissioner in reaching the Decision Notice nor to consider the Appellants suggestion regarding possible other motives of the Council. The Appellants Reply to the Response 25. The Appellants Reply concludes with four questions. a. Whether the DPA is the correct law to apply in this case? b. If so, should the Schedule 2 exemptions apply? c. Does the simple act of releasing a draftsmans name (which should have appeared in the drawing title block in any case) constitute processing of data? d. Is the FOI Act the correct law to apply in this case? Correspondence 26. The Bundle contained amongst other things correspondence passing between the Commissioner and the Council and the Appellant. We noted a letter from the Council to the Commissioner dated 27 October 2022 and a letter from the Appellant to the Commissioner received on the 24 September 2022. 27. In the Councils letter reference was made to certain alleged concerns about the manner of the Appellants dealings with the Council and its staff. In the Appellants letter to the Commissioner he refers to a verbal exchange with an officer from the Council in which the Appellant reports that this officer accused him of harassing his staff and being aggressive. 28. Apart from these letters there was no relevant evidence on this point before us. While a Tribunals role is to be inquisitorial as the concerns raised did not form part of the Decision Notice we did not go further into what had been said and it does not form part of our Judgment. The Tribunals role 29. By Section 58 FOIA the Tribunals role is to consider whether the Decision Notice is not in accordance with the law or if the Commissioner should have exercised a discretion differently. If the Tribunal determines the Decision Notice was not in accordance with the law or that a discretion should have been exercised differently it can allow the appeal or substitute a different Notice that could have been served by the Commissioner but unless these apply the Tribunal shall dismiss the appeal. 30. In this Appeal, which deals with the processing of personal data and the section 40(2) exemption, the Tribunal is not called upon to carry out a qualitative review of the process by which the Commissioner produced the Decision Notice nor seek to determine if the Council had some other motive for withholding the information requested as suggested by the Appellant. Personal Data 31. The Commissioners position is that the information sought is personal data. In correspondence with the Commissioner the Appellant suggested that he did not seek personal data as he only wanted to know who created the drawing. In the Appellants Reply he asks how can the publication of a name (alone) in connection with a piece of work, be unlawful? 32. We note however in his Grounds of Appeal he says Paragraphs 9 through 11 basically confirm that someones name is personal detail. I dont dispute this; how could it be otherwise. 33. Section 3(2) DPA defines personal data as any information relating to an identified or identifiable living individual and Section 3(3) DPA defines an identifiable living individual as a living person who can be identified directly or indirectly by reference to - (a) an identifier such as a name 34. Although the Internal Review refers to the drawing being the work of more than one person it does appear to us that ultimately in this case one identifiable living person could be said to be responsible for putting together the final version of the drawing concerned. 35. We are satisfied that the name sought is personal data. Processing 36. The Appellant questions whether the act of releasing the name does constitute the processing of personal data. We are satisfied that a disclosure of personal data following a FOIA request for information would be transmission, dissemination or otherwise making it available and is therefore processing for the purposes of the GDPR by section 3(4)(d) DPA. 37. Responses to requests for information under FOIA are published and, as such, are available for the whole world to view; they are not exclusive to the Requester. Thus, while we note that the Request was to please tell me any information (including any personal data) provided in response to such a request is published to the world and not just the requester. Section 40(2) FOIA 38. It follows that the exemption in Section 40(2) FOIA is engaged. This provides that a Public Authority is exempt from the requirement to publish personal data in response to a FOIA request if to do so would not be in accordance with the Data Protection Principles. 39. By Article 5(1) GDPR processing is to be carried out lawfully, fairly and in a transparent manner in relation to the data subject. Article 6(1)(f) GDPR provides that processing of personal data is lawful only if and to the extent that one of the following applies . (f) processing is necessary for the purposes of the legitimate interests pursued by a third party except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject which require protection of personal data . Legitimate Interest 40. In the Decision Notice the Commissioner concluded that there is there is a legitimate interest in the accountability and transparency of the Council as regards the Councils implementation of cycle lanes and its management of the cycle lane project. 41. In the Request, Grounds of Appeal and Appellants Reply Mr Wailes refers to concerns relating to the waste of time and public money and the performance of the Council on projects relating to cycle paths and drawings. He refers to a concern about concealment of information and argues that finding out the name allows there to be accountability and would prevent the concealment of ineptitude and the waste of public money. 42. We make no findings about Mr Wailes opinions on this subject. We do however accept that these concerns do amount to a legitimate interest held by Mr Wailes (and potentially others) and accordingly, we conclude that the Request is made in the pursuit of a legitimate interest. Necessity 43. To be lawful in accordance with Article 5(1) GDPR publication must be necessary in the pursuit of the legitimate interest. The Respondent referred us to the following decisions among others: - a. Corporate Officer of the House of Commons v Information Commissioner and others [2008] EWHC 1084 and b. South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55. 44. Legal propositions taken from these decisions are reviewed in the decision of the Upper Tribunal in Goldsmith International Business School -v- The Information Commissioner and the Home Office [2014] UKUT 563 (ACC) and relevant for this appeal include these: - a. necessary means being more than desirable but less than indispensable or absolute necessity and can be summarised as reasonably necessary (Goldsmith para 37) b. the test for necessity must be satisfied before consideration of whether the interests or fundamental rights or freedoms of the data subject should override the necessary disclosure (Goldsmith para 36) c. the test of reasonable necessity itself involves the consideration of alternative measures and so a measure would not be necessary if the legitimate aim could be achieved by something less, accordingly the measure must be the least restrictive means of achieving the legitimate aim in question (Goldsmith para 39) 45. In the Internal Review the Council says that The drawings are put together using information, designs etc from several officers. The officer putting together the final drawing is not responsible for the project in its entirety ... 46. We also see in an email from the Council to the Appellant of the 9 March 2022 that A number of officers have input at various stages to the development and management of such highways schemes , The email continues In relation to specific names of officers I dont believe it appropriate to provide officers names who undertake relatively minor aspects of project development. 47. The writer who signs off as Head of Service Major Projects and Strategic Infrastructure says he is happy to provide his name and that he has a greater knowledge and overview of the project and the strategic objectives. 48. The Appellant in correspondence says Someone drew the drawing and was responsible for the technical details therein. The information request was about who drew the drawing not who was involved in discussions about the project as a whole 49. The Decision Notice (para 18) makes reference to the provision of the name of the senior person and says that this has already fulfilled the legitimate interest 50. We do not know the name of the person who drew the drawing. We do not have evidence as to their actual level of seniority, their role or job description. We do not know if they do or do not have authority to place their name on such a drawing. We have no clear evidence as to how far they influenced the final version. We do know from the Councils Reply that the person is an employee. 51. However, we conclude the person concerned was not a senior person at the Council or at least not as senior as the person whose name was provided to the Appellant. We also conclude their role with the production of the drawing was more akin to that of a compiler rather than creator. 52. While we have the Appellants opinion as regards the drawing, we do not know whether or not his opinion is shared by the persons manager or more formally by the Council. Even if the Appellants opinion is shared by the Council (on which we have no evidence) we do not know whether the person whose name is sought is responsible for any errors especially as we conclude that the person concerned was carrying out more of a collating rather than a creative role. 53. We have no evidence to assist us on whether the person was asked to provide their name and refused or was not asked. Further we have no evidence as to what employees or at least this employee of the Council was told about the likelihood of their name being published as part of their role. 54. We do accept that it appears to be the case that plans and drawings such as these often do have a name added. As far as we know that might be the usual practice. We do not know why it is not the case here. It may have been an oversight or omitted on purpose or that as a matter of formality the person concerned was not in a senior enough role for them to have their name on the drawing. 55. In particular in light of Goldsmith at para 39 we take note of the provision to the Appellant of the name of the Head of Service. We have concluded that the Head of Service is in a more public facing role and more senior and would be better placed and able to assist the Appellant and others with the pursuit of the legitimate Interest than the person whose name is sought by the request. Provision of his name is an appropriate alternative measure which would meet the needs of any legitimate interest pursued. 56. For the reasons set out above we conclude that publication of the name of the person would not be necessary in the pursuit of the legitimate interest and therefore processing the personal data requested would not be lawful. Other considerations 57. If we had found that processing by publication was a necessity, we would then have needed (1) to consider whether the interests or fundamental rights or freedoms of the person whose name is sought should override the necessary disclosure for the pursuit of a Legitimate Interest and then potentially (2) needed to consider the questions of fairness and transparency. 58. Our conclusions already reached about necessity would have been relevant here and we would have concluded in favour of the Respondent. Schedule 2 DPA 59. The Appellant suggests that consideration should have been given to schedule 2 DPA. He refers to the circumstances in which this schedule provides exemptions from GDPR. Schedule 2 DPA provides The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that (a) is designed as described in column 1 of the Table and (b) meets the condition relating to the function specified in column 2 of the Table to the extent that the application of those provisions would be likely to prejudice the discharge of the function 60. However, the provisions of Schedule 2 DPA do not apply to the appeal because they refer specifically to the processing of data for a function listed in the Table in schedule 2 whereas in this appeal the processing would be specifically in response to a FOIA request. Judgment 61. For the reasons set out above, this appeal is dismissed. Signed: Tribunal Judge Heald Date: 6 September 2023
