Decision: The appeal is allowed in part.
Substituted Decision Notice:
1. Within 28 days from the date when this decision is sent to the parties, the London Borough of Bexley (the "Council") is to disclose to the Appellant the bundle of redacted nomination statements that they provided to the Tribunal on 24 September 2024, with the following amendments:
a. Addition of the missing pages for nominations #214, #238, #204 and #241. The Council should redact these pages to remove personal data.
b. Removal of any successful nominations, including nominations #239, #158, #189 and #222.
c. Inclusion of any blank but numbered pages that form part of the disclosed nomination statements (to avoid any confusion about whether pages are missing).
2. The Council was entitled to rely on section 40(2) of the Freedom of Information Act 2000 to withhold the remainder of the information requested by the Appellant.
3. Failure to comply may result in the Tribunal making written certification of this fact to the Upper Tribunal, in accordance with rule 7A of the First-tier Tribunal (General Regulatory Chamber) Rules, and may be dealt with as a contempt of court.
REASONS
Background to Appeal
- This appeal is against a decision of the Information Commissioner (the "Commissioner") dated 16 January 2024 (IC-243452-C4B4, the "Decision Notice"). The appeal relates to the application of the Freedom of Information Act 2000 ("FOIA"). It concerns information about rejected nomination statements for Bexley Civic Recognition Awards 2023 requested from the London Borough of Bexley (the "Council").
- The parties opted for a paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
- On 24 May 2023, the Appellant wrote to the Council and requested the following information (the "Request"):
"Can you please supply nomination statements for *rejected* Bexley Civic Recognition Awards 2023 nominations?"
- The Council responded on 15 June 2023 and confirmed that it held the requested information but was withholding it under section 40 FOIA. The Appellant requested an internal review on the same day. The Council responded on 4 July 2023 and said, "the information is exempt from disclosure under section 40(3A) since disclosure would contravene the requirements of the Data Protection Act 2018."
- The Appellant complained to the Commissioner on 5 July 2023. The Commissioner decided that the Council was entitled to withhold all of the requested information under section 40 FOIA:
a. The withheld information was personal data.
b. There was a legitimate interest in disclosure, based on the complainant requesting disclosure as they believed that there was bias in the judging panel, and there was no less intrusive means of meeting this interest.
c. There was insufficient legitimate interest to outweigh the data subjects' fundamental rights and freedoms. The persons referred to in rejected nomination statements would not reasonably expect their personal data to be shared, and disclosure could be distressing.
The Appeal and Responses
- The Appellant appealed on 21 January 2024. His grounds of appeal are:
a. The background is that 40% of awards in 2022/3 have gone to Scouts volunteers, the panel was chaired by a Scouts officer, and the Appellant's own nomination of an individual was turned down in both years.
b. He accepts the privacy concerns that have been raised, but he does not intend to publish the information.
c. Information in a nomination statement can be expected to be favourable to the nominee, making its disclosure less sensitive.
d. He relies on the public interest argument – scrutiny of the awards decisions, enabled by the disclosure, can identify and curb a political bias.
- The Commissioner's response maintains that the Decision Notice was correct. In addition to the lack of lawful basis for disclosure of general personal data, the Commissioner says that some of the nominations contain special category personal data and there is no lawful basis for disclosure. Disclosure would be to the world at large. The unsuccessful nominees, some of whom are under the age of 18, had no reasonable expectation that their personal data would be disclosed in this way. The Commissioner maintains that he has seen no evidence to support the Appellant's allegations of political bias concerning the civic recognition award scheme.
- The Appellant submitted a reply which says that the Commissioner's arguments are mitigated by context and outweighed by public interest, as discussed further below.
Applicable law
- The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
2 Effect of the exemptions in Part II.
…….
(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring absolute exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
……..
40 Personal information.
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles…
…….
58 Determination of appeals
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.
- Section 3(2) of the Data Protection Act 2018 ("DPA") defines "personal data" as "any information relating to an identified or identifiable living individual". The "processing" of such information includes "disclosure by transmission, dissemination or otherwise making available" (s.3(4)(d) DPA), and so includes disclosure under FOIA.
- The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation ("UK GDPR"), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be: "processed lawfully, fairly and in a transparent manner in relation to the data subject". To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include where "the data subject has given consent to the processing of his or her personal data for one or more specific purposes" (Article 6(1)(a)). It also includes where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." (Article 6(1)(f)). The UK GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.
- The balancing of interests test under section 6(1)(f) involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Issues and evidence
- The main issue is whether the Council was entitled to rely on section 40(2) FOIA to withhold all of the requested information, which involves the following issues:
a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?
b. Is the processing involved necessary for the purposes of those interests?
c. Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?
- By way of evidence and submissions we had the following, all of which we have taken into account in making our decision:
a. An agreed bundle of open documents.
b. A closed bundle of documents containing the withheld information, and some additional information sent by the Council to the Commissioner which also contains personal data.
- The additional information in the closed bundle is a set of letters to some unsuccessful nominees. These letters overlap substantially with the withheld information and contain personal information, and we confirm that they should be held on a closed basis. They are not within the scope of the Request. We have not relied on these letters when making our decision.
- The Tribunal panel initially met to consider this appeal without a hearing on 26 June 2024. Having considered the papers, the Tribunal decided to adjourn the consideration as we required further information before making a decision. This was on the basis that some nomination statements relate to organisations rather than individuals, and we required further information on whether all of these statements would allow the identification of individuals either directly or through the mosaic effect. The Council was asked to answer a number of questions about specific items in the closed bundle, set out in a closed annex to open directions. These questions were about specific nomination statements in the closed bundle which do not relate directly to identified individuals. The Tribunal asked how and why each of these nomination statements falls within the definition of personal data.
- The Council sent a letter on 9 July 2024 which answered the Tribunal's questions (on a closed basis). This letter proposed that some withheld nomination statements may now be disclosed with redactions to protect personal information, and explained why others still needed to be withheld in their entirety. The Commissioner provided submissions on 22 July 2024 which confirmed that he was content for the content of the nominations identified by the Council to be disclosed if they were redacted to ensure that no personal data is released. This was on the basis that the Council is best placed to identify the relevant information in the public domain and whether individuals could be identified from the nomination statements in respect of groups and organisations from those statements (even with redactions) and information in the public domain. The Commissioner's email was provided to the Appellant, but the Council's letter was not because it discussed the content of the withheld information in detail.
- The Council was directed to provide redacted copies of the nomination statements that they said could now be disclosed, and they did so on 24 September 2024 – this is the "Redacted Additional Disclosure Bundle". The Commissioner confirmed on 30 September 2024 that he had considered the proposed redactions and would have no objection to this redacted material being disclosed to the Appellant. The Appellant was given 14 days to make any final submissions in directions dated 25 October 2024. The Tribunal did not receive any further submissions. We therefore met again on 18 December 2024 to discuss and finalise this decision.
Discussion and Conclusions
- In accordance with section 58 of FOIA, our role is to consider whether the Commissioner's Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the notice in question was based. This means that we can review all of the evidence provided to us and make our own decision. We deal in turn with the issues.
- The Appellant is not disputing that the requested information largely consists of personal data. We have seen the withheld information. We agree that, in the majority of cases, redaction would not be a viable alternative. Surrounding information would reveal identities of individual nominees even if names and other specific personal details are removed. Redaction of these statements to remove all details from which individuals could be identified would leave effectively meaningless information. The exceptions to this are some of the nomination statements for organisations rather than individuals, which we discuss separately below.
- Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? We accept that the Appellant is pursuing a legitimate interest. He says that disclosure of the requested information would enable scrutiny of the awards decisions, to help identify and curb what he says is a political bias in how awards are made.
- Is the processing involved necessary for the purposes of those interests? We also accept that the processing through disclosure of the nomination statements is necessary for the purpose of the legitimate interests identified by the Appellant, i.e. to enable full scrutiny of the awards decisions. There is no other obvious way to compare the detail of successful and unsuccessful nominations.
- Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? We have considered whether individuals who could be identified through disclosure of the unsuccessful nomination statements have a reasonable expectation of privacy. This applies to the person making the nomination, and the person or people who are nominated. In relation to the person who makes the nomination, they may have an expectation that their personal information would not be published to the world at large – particularly where, as in some cases, they refer to personal details about themselves or their family. While potentially these details could be redacted, it may result in a meaningless document if redactions are also required to protect the privacy rights of the person or persons nominated for the awards.
- The nomination forms contain specific personal information, such as name, date of birth, associated organisations, details of voluntary work, skills, qualifications, and geographical location. Some of it relates to individuals under 18 years old, which means the data subject is a child and their rights need to be given particular consideration under Article 6(1). We agree with the Commissioner that none of the persons identifiable from the unsuccessful nominations would have a reasonable expectation that their detailed personal information would be disclosed to the world at large under FOIA, as a result of having made or received an unsuccessful nomination for an award. Those nominated for an award may not be aware of the nomination or be aware of the information provided to the Council in support of the nomination. We also agree with the Commissioner that those persons, and the persons nominating them, would not expect personal information contained in the unsuccessful nominations to be disclosed to the world at large. In the case of all nominations of individuals (and some nominations of organisations), disclosure of information contained in the forms would either directly disclose their identity, or disclose their identity when combined with other information known to those in the local area. This would be a disclosure of the fact they had been unsuccessfully nominated for an award and other personal information contained in the nomination form.
- The Appellant makes a number of points in his appeal and reply that seek to minimise the privacy concerns:
a. He says that he does not intend to publish the received information. However, the Tribunal must assess the appeal on the basis that a disclosure under FOIA is automatically a disclosure to the world at large.
b. He says that the information in a nomination statement can be expected to be favourable to a nominee. That might well be true for many of the nominations. However, in the Tribunal's view this does not mean it would be favourable to publicly disclose that the nomination was unsuccessful. In addition, as already explained above, the nomination forms contain personal details about the nominated individuals, as well as opinions about who they are and the work they do.
c. The Appellant also says that much of the information in a nomination statement comes from observations of public actions. While this may be factually correct, for the purposes of the exemption in section 40(2) FOIA the Tribunal must assess whether those persons who are identified or identifiable would wish or expect their personal details or opinions about them (or the fact that they were nominated unsuccessfully) to be publicly disclosed.
d. The Appellant also notes that the Commissioner does not seem to require the person making a nomination to obtain the nominee's approval before sharing the nominee's personal information with the Council. If that is correct, then the Tribunal considers that it strengthens the reasons why nominees would not want their personal data to be disclosed to the world at large. As noted, they may not even be aware that their personal information was provided to the Council in support of a nomination.
- We have considered the strength of the legitimate interests in disclosure. We find that they are not particularly strong. The Appellant says that the awards have been administered inappropriately. He says that 40% of the awards in 2022 and 2023 went to members of one organisation, with which at least one of the "jury" members (as described by the Appellant) has an affiliation. His appeal also says that his own nomination has been rejected twice, for an individual who publishes a local politics blog that is disliked by the local Conservatives. We acknowledge that the Appellant feels decisions have been biased. However, the Tribunal agrees with the Commissioner that there is no evidence of actual inappropriate or unlawful behaviour that overrides the interests and fundamental rights and freedoms of the persons who require their personal data to be protected. There are also other ways to pursue and investigate such allegations which do not involve or require public disclosure of the personal information withheld by the Council.
- Having considered where the balance lies in this case, we find that the interests in disclosure are overridden by the privacy rights of the data subjects. This is based on the nature and extent of the personal information in the nomination statements, including the young age of some nominees and the fact of unsuccessful nomination. The reasonable expectations of the data subjects that this personal information would not be disclosed to the world at large under FOIA are sufficient to outweigh the interests in disclosure. While there is some legitimate interest in disclosure of this information, it is not strong.
Nomination statements for organisations – additional disclosure
- As explained above, the Council has provided the Redacted Additional Disclosure Bundle and confirmed that this can be disclosed. This covers some but not all of the unsuccessful nomination statements relating to organisations rather than individuals. The Council explained in its closed correspondence why some of the nomination statements for organisations should still be withheld in their entirety, because of the extent to which they refer to individuals who could be identified. Having considered the nomination statements for organisations that the Council wishes to withhold in their entirety, we agree that they should be withheld for the same reasons as set out above. They contain considerable information from which individuals could be identified, and in some cases this includes special category data such as information about health.
- Having considered the Redacted Additional Disclosure Bundle, we have verified that the redactions appear sufficient to protect personal data. The Commissioner has also confirmed that he has no objection to the information as redacted being disclosed. The Tribunal does not have detailed knowledge of the local area and so has relied on the Council to ensure that the redactions are both necessary and sufficient to prevent identification of individuals through the mosaic effect. On the basis that both the Council and Commissioner are in agreement, we also agree that the Redacted Additional Disclosure Bundle should be disclosed, but subject to the following points:
a. Some pages have been omitted from some of the nomination statements. This applies to nominations #214, #238, #204 and #241. The Council should include these missing pages in the disclosure, with personal data redacted.
b. It appears that some of the nomination statements included in the Redacted Additional Disclosure Bundle are outside the scope of the Request because they relate to successful nominations (as checked against page D101 in the open bundle). The Request was for unsuccessful nominations only. The disclosure should not include information relating to successful nominations, which the Tribunal understands to include nominations #239, #158, #189, and #222.
c. The closed bundle shows some numbered blank pages as part of some of the nomination statements. To avoid any confusion as to whether all pages have been disclosed, the disclosure should include any blank but numbered pages in the relevant nomination statements.
- We therefore find that the majority of the unsuccessful nomination statements can be withheld under section 40(2), but a number of the unsuccessful nomination statements relating to organisations should be disclosed to the Appellant (with the redactions made to protect personal data and subject to paragraphs 29a to 29c above). We uphold the appeal in part and issue the Substituted Decision Notice as set out at the start of this decision.
Signed: Judge Hazel Oliver
Date: 8 January 2025
