Harcup v Yorkshire Forward [2008] UKIT EA_2007

Appeal Number: EA/2007/0058

Information Tribunal Appeal Number: EA/2007/0058

SUBSTITUTED DECISION NOTICE
Dated: 5 February 2008
Public authority: Yorkshire Forward

Address of Public authority: Victoria House, Victoria Place, Leeds, LS1 5AE
Name of Complainant: Mr Tony Harcup
The Substituted Decision

For the reasons set out in the Tribunal’s determination, the substituted decision is that:

1. Yorkshire Forward should not have substantially ignored Mr Harcup’s request for
information about those organisations and individuals who had received corporate
hospitality organised by Yorkshire Forward.

2. Yorkshire Forward was not entitled to withhold the names of the individuals that had
attended events or corporate hospitality organised by it as these did not constitute
personal data within section 1 of the Data Protection Act; and therefore the
exemption in section 40(2) of the Freedom of Information Act did not apply;
(provided that in releasing both names of individuals and the organisations they
represented, the two could not be correlated).

3. However, it is clear that the cost of providing such data would have exceeded the
cost limit set by section 12 of the Freedom of Information Act, and Yorkshire
Forward are not therefore obliged to release the information requested.

Dated this 5^th day of February 2008

Humphrey Forrest

Deputy Chairman, Information Tribunal

Appeal Number: EA/2007/0058

Reasons for Decision

Introduction

1. Yorkshire Forward (YF) is a public authority whose duties include promoting
business in Yorkshire. To this end, it organises a number of training events and
seminars, and provides corporate hospitality on occasion.

The request for information

2. On 28 June 2005 Mr Harcup made a request under the Freedom of Information Act
(FOIA) for

“All information relating to Yorkshire Forward’s corporate hospitality, events and
entertainment of potential clients, members of the business community,
politicians and other guests from 2003 to date: including, but not restricted to
dinners, lunches, breakfasts, drinks receptions, awards ceremonies, and the use
of hospitality boxes or tickets for sporting or other events. I would like to see the
amount spent, broken down per event and lists of guests attending (including
which organisation they represented, if any), again broken down by event. I
would also like to see any reports relating to any such event in particular or to
corporate hospitality in general.”

3. On 4 July 2005, YF replied:

“We recently dealt with a similar enquiry and I have attached everything we
could supply based on the data we have available, which covers all activity from
2002. Unfortunately we are unable to supply you with the details of delegates
who attended our events as this is against the Data Protection Act”.

4. The letter went on to provide a substantial amount of information. The bulk of this
related to events in Yorkshire in 2002 to 2005, with some financial information.
After further correspondence, some more information was provided. Mr Harcup
remained dissatisfied with the response, which included an internal review. In the
review response, 27 September 2005, YF argued that the cost of providing any
more information requested would exceed the limit of £450, and therefore they were
not obliged to respond further, under section 12 of FOIA.

The complaint to the Information Commissioner

5. Mr Harcup complained to the Information Commissioner (IC) on 10 October 2005.
His “major complaint” was that YF had used the exemption in section 40(2) of the
Data Protection Act (DPA) to withhold the names of delegates, but he also
complained generally about the information supplied.

6. In his Decision Notice, dated 5 June 2007, the IC found some procedural breaches
of section 17 of FOIA; found that YF had correctly applied the exemption for
personal data in section 40(2) when it declined to provide the names of individuals,
but held that this exemption had been incorrectly applied in relation to the names of

Appeal Number: EA/2007/0058

the organisations involved; and required YF to disclose “the names of the
organisations represented by attendees at corporate events hosted by YF from
2003 to 28 June 2005.” YF have since provided those names.

The appeal to the Tribunal

7. In his appeal to the Tribunal Mr Harcup argues that the IC and YF have wrongly
interpreted the definition of personal data, relying on the decision of the Court of
Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746 to argue
that information relating solely to official or business capacity (such as attendance
at a publicly funded corporate event) should not be classed as personal data.
Secondly, he argued that in principle it is not unfair if individuals attending such
publicly funded events lose any expectation of privacy, and that there is a public
interest in disclosing their names.

The questions for the Tribunal

8. At a hearing for Directions on 10 September 2007, the issues in the appeal were set
out:

The issues arising for determination in this appeal include:

a. whether the disputed information amounts to personal data at all,
having regard in particular to the decision in Durant v Financial
Services Authority;

b. if it is personal data, whether the exemption in section 40(2) of the
Freedom of Information Act applies;

c. if the exemption does not apply, whether Yorkshire Forward are
entitled to refuse disclosure on the ground that the cost of disclosing
the information would exceed the limit provided in section 12 of FOIA.

9. However, during the appeal, it became apparent from the witness statements
served by YF that YF operated a clear internal dividing line between “events” and
“corporate hospitality”; and that the vast majority of the information they had
supplied related to “events”: that part of Mr Harcup’s original request which related
to corporate hospitality had never been addressed, save for some financial
information. We have also considered in our decision how this issue might be dealt
with.

Evidence

10. We considered an agreed bundle of documents setting out correspondence
between the parties, and the information disclosed; and witness statements from Mr
Harcup; and from Ms RE Mason, corporate information officer for YF and Ms TM
Lindsay, head of marketing and business development.

11. The events organised by YF include internal events for staff, including briefings and
an annual conference; corporate events such as the Regional Economic Strategy
Review, including key organisations such as the CBI, IoD, Local Authorities, MPs,
Higher Education Institutes and Urban Regeneration Companies who contribute
and shape key areas of policy; and external events such as overseas trade shows,
and large scale business conferences. Events may be organised centrally by the

Appeal Number: EA/2007/0058

Communications Team within YF, or by any of 4 separate Directorates. The
information provided to Mr Harcup, at least initially, came from information provided
only by the Communications Team, and therefore only related to those events
organised centrally. We have been given no hard information about the scale or
numbers of such events, but an indication can be gained from the number of
organisations named in response to the IC’s direction that Mr Harcup be given the
names of organisations attending: the 72 pages listing the organisations contain
over 3000 names. The list is not broken down by event. If events organised by the
separate Directorates had been included, numbers would presumably have been
significantly larger. The organisations involved are from a mix of public and private
sector organisations, and also from the professional, educational, charitable and
voluntary sectors.

12. Delegate lists are provided at some events, giving names and organisations of
those attending. The press and media are invited to some events, and invited to
photograph or film delegates for publication. Those registering to attend events
provide their personal details against an assurance:

The Data Protection Act. The information supplied on this form will be retained
by YF on a database and will be used to update our records and to contact you
with information about relevant initiatives, services or opportunities that we
believe might be of interest to you. Your details will be stored securely and will
not be released to any other organisation. YF is the Data Controller for your
information.

13. Because of the specific and restricted definition of “events” adopted by YF, which
excludes corporate hospitality, little information about corporate hospitality was
provided by YF, save that it is not organised or recorded centrally, (though some
financial information may be held centrally).

14. YF estimate that even though much of the information provided initially to Mr
Harcup had already been provided in response to another request, and so was
available, some 4.5 hours were spent locating, retrieving and extracting the
information to make it more specific to Mr Harcup’s request. Providing the names of
the organisations involved in events required 9 hours work. So far, therefore YF
have spent 13.5 hours responding to Mr Harcup’s request, which at the charging
rate of £25 ph, set by the Regulations, comes to £338.

15. It would take the Communications Team some 5 further hours to provide the full
information requested by Mr Harcup in relation to events organised centrally by
them; and a further five hours for each of the 4 Directorates that organise their own
events, a total of 25 further hours. In addition, the Finance Manager estimates that
it would require 3 weeks work of 37 hours (111 hours) to provide the detailed
financial breakdown requested, for each event. Providing information about
corporate hospitality events would require a further 25 hours.

Legal Framework

16. Section 1 of FOIA provides a basic entitlement to have information held by a public
authority communicated to a person who requests it. That right is subject to a
number of exemptions, including the exemption in section 40.

Appeal Number: EA/2007/0058

17. Section 40 of FOIA provides, so far as material:

(2) Any information to which a request for information relates is also exempt
information if –

(a) it constitutes personal data which do not fall within subsection
(1), and

(b) either the first or second condition below is satisfied.

(3) the first condition is -

(a) in a case where the information falls within any of paragraphs (a)
to (d) of the definition of “data” in section 1(1) of the Data
protection Act 1998, that the disclosure of the information to a
member of the public otherwise than under this Act would
contravene –

(i) any of the data protection principles ….,

and

(b) in any other case, that the disclosure of the information to a
member of the public otherwise than under this Act would
contravene any of the data protection principles if the exemptions
contained in section 33A(1) of the Data protection Act 1998
(which relate to manual data held by public authorities) were
disregarded.

Section 40(7) of FOIA gives “personal data” “the same meaning as in section 1(1) of
the Data Protection Act”. That provides:

DPA section 1(1) Personal data means data which relate to a living individual who can
be identified –

(a) from those data, or

(b) from those data and other information which is in the possession, or is likely to
come into the possession of, the data controller.

The data protection principles referred to in section 40(3) FOIA are the principles set
out in Part 1 of Schedule 1 of the DPA.

Section 12 of FOIA removes the obligation to provide information, under section I, if the
authority estimates that the cost of complying with the request would exceed the
appropriate limit. The appropriate limit is defined, (in the Freedom of Information and
Data Protection (Appropriate Limit and Fees) Regulations) 2004) as £450 in this case,
or 18 hours work at £25ph, the designated charging rate.

Section 16 of FOIA provides:

Appeal Number: EA/2007/0058

(1) It shall be the duty of a public authority to provide advice and assistance, so far as
it would be reasonable to expect it to do so, to persons who propose to make, or
have made, requests for information to it.

Legal submissions and analysis

1. Personal Data and Durant

18. All parties agreed that first issue in the case was whether, in asking for the names
of the individuals who had attended events and been given corporate hospitality, Mr
Harcup was requesting personal data, as defined in section 1(1) DPA; and that the
leading authority on the meaning of personal data was Durant, and specifically
paragraph 28 of Auld LJ’s Judgement:

It follows from what I have said that not all information retrieved from a
computer search against an individual’s name or unique identifier is personal
data within the Act. Mere mention of the data subject in a document held by a
data controller does not necessarily amount to his personal data. Whether it
does so in any particular instance depends on where it falls in a continuum of
relevance or proximity to the data subject as distinct, say, from transactions or
matters in which he may have been involved to a greater or lesser degree. It
seems to me that there are two notions which may be of assistance. The first is
whether the information is biographical in a significant sense, that is, going
beyond the recording of the putative data subject’s involvement in a matter or
an event that has no personal connotations, a life event in respect of which his
privacy could not be said to be compromised. The second is one of focus. The
information should have the putative data subject as its focus rather than some
other person with whom he may have been involved or some transaction or
event in which he may have figured or have had an interest, for example, as in
this case, an investigation into some other person’s or body’s conduct that he
may have instigated. In short it is information that affects his privacy, whether in
his personal or family life, business or professional capacity. A recent example
is that considered by the European Court in Criminal Proceedings against
Lindquist, Case C-101/01 (6 November 2003), in which the Court held, at para.
27,that “personal data” covered the name of a person or identification of him by
some other means, for instance by giving his telephone number or information
regarding his working conditions or hobbies.

19. The IC and YF use this passage to argue that the names of the attendees are
personal data: they are biographical, since they identify where the person was at
the time of the event; the focus of the information is the attendee themselves; and
attendee information is “obviously about” the particular individuals who attended.
That last point is taken from the Information Commissioner’s Technical Guidance on
“Determining what is personal data”, published in August 2007, to take account both
of the Durant decision, and the recommendations of the Article 29 Working Party.
The Data Protection Act is the British implementation of the European Commission
Directive 95/46; Article 29 of the Directive provides for an independent Working
Party composed of representatives of the member states supervisory authorities to
give advice or opinions from time to time to the Commission. The IC is the British
representative on that Working Party.

Appeal Number: EA/2007/0058

20. We have difficulty in reconciling the approach in the Guidance with that in Durant.
Paragraph 3.1 of the Guidance states that if the information is “obviously about” a
particular individual it is personal data for the purposes of the DPA. It gives
examples: a medical history, a criminal record, or a record of a particular
individual’s performance at work or in a sporting activity. The IC and YF argue that
the information sought by Mr Harcup would disclose that the individual had taken
part in a particular event – attended a training session or seminar run by YF, or
received corporate hospitality from them. On the other hand, Auld LJ states that the
information should be “biographical in a significant sense, that is going beyond …
involvement in a matter or an event that has no personal connotations”.
Attendance at any event must always have personal connotations, if all that is
required is attendance. Clearly, Auld LJ was suggesting something further was
required, significant biographical information. We reject the argument that simply
because the information identifies where the data subject was at a particular time, it
is necessarily significant biographical information.

21. Similarly, it seems to us that Auld LJ’s reference to focus is stripped of all meaning
if focus is satisfied by looking at the constituent parts of the information sought,
rather than the subject matter of the request. The focus of the request here are the
events organised by and the corporate hospitality provided by YF. In Auld LJ’s
words, to be personal data, “the information should have the putative data subject
as its focus rather than … some transaction or event in which he may have figured.”
The attendees who attended YF events figured in them, but they are not the focus
of those events. We accept, as Auld LJ states, that personal data extends to
“information that affects his privacy, whether in his personal or family life, business
or professional capacity”, but the inclusion of business life, does not mean that
every reference to business life is necessarily biographically significant, or has the
data subject as its focus. The case referred to by Auld LJ, and relied on by the IC
and YF, Lindquist, involved a significant breach of privacy at work: Mrs Lindquist
posted information on the net about her work colleagues, revealing not just their
identity and their employer, but also including “her colleagues’ jobs and hobbies,
and in some cases their family circumstances were outlined, and telephone
numbers and other personal information given. One of the various items was a
report that a colleague was on half time on medical grounds because she had
injured her foot.” In the court’s view, at paragraph 27 “referring to various persons
and identifying them by name or by other means, for instance by giving their
telephone number or information regarding their working conditions and hobbies
constitutes the processing of personal data…” within Article 3(1) of directive 95/46.
The IC and YF argue that revealing information about individuals’ attendance
reveals information about their “working conditions”, but this seems to us to suggest
that mere attendance at an event is enough to attract the protection given to
personal data, a view we have rejected above.

22. Is attendance at a YF seminar or corporate hospitality event “involvement in a
matter or event that has no personal connotations, a life event in respect of which
[the data subject’s] privacy could not be said to be compromised”? In our view, it
has no personal connotations, bearing in mind the two factors of biographical
significance and focus identified in Durant. Such events are of short duration and
routine business occurrences; they are not generally biographically significant; the
events are attended by numbers of attendees, who may each be given a list of

Appeal Number: EA/2007/0058

fellow attendees, together with the names of the organisations they represent. The
events provide networking opportunities. Those attending them expect to make
contacts and to be contacted. The press may be invited, and invited to take
photographs for publication. In such circumstances, it is hard to see how privacy
can be further compromised if names are released. We note that in the Decision
Notice the Information Commissioner invited Yorkshire Forward to “reconsider its
current policy in respect of providing a guarantee to delegates attending events it
hosts that their names and that of their organisations will not be disclosed in future”.
YF have informed the IC that they have reconsidered, though we are not told with
what result.

23. The Court of Appeal’s approach in Durant was significantly to narrow the concept of
personal data as it had been widely understood and applied. The attempt in the
IC’s Guidance to apply Durant in practice restores much of the previous width. If
weight is given to Auld LJ’s two notions of significant biographical information and of
focus, we cannot consistently with Durant find that this information constituted
personal data. In making that finding, we are not attempting to lay down any
general principle about attendance at events: some may be significant, some may
not. We are simply attempting to follow the guidance from the Court of Appeal,
which is of course binding on us, in the particular facts of this case.

24. The lengths to which the Information Commissioner’s wide view extend is
demonstrated by the Information Commissioner’s proviso to the steps he required
YF to take in paragraph 28 of the Decision Notice, when disclosing the names of
organisations which had attended YF’s events. “In undertaking this step, YF should
however consider whether any of the organisations are sole traders or partnerships
whose businesses take their name from the individual trader or partners. In such
instances, YF should consider whether such data should be disclosed.”
Presumably, this is so that YF may consider whether, in disclosing the name of the
business, YF are disclosing the name of the individual. This seems to us absurd. A
person who chooses to trade under their own name can have no claim to privacy
which would prevent the business being referred to by that name; and to suggest
that third parties should hesitate before referring to a business trading in the name
of the proprietor seems to us to impose a wholly uncalled for and undesirable
restriction on the flow of information. Applying the factors in Durant, where the
information in question is the name of a business, the focus of the information is on
the business, not the individual proprietor; the name of the business is not personal
data.

25. Our view is that to release the names of those attending YF events in the period in
question does not involve the release of personal data. Moreover that is still the
case even when the names of the organisations represented by those attending are
also released. We accept that to release the name of an individual’s employer
would be to release significant personal data, and therefore would be personal data,
within both Durant and Lindquist. But given the format in which the names of the
organisations have been released, an undifferentiated list running to over 70 pages,
it would be impossible to correlate individual names to organisations, at least
providing some basic step such as providing names alphabetically were taken to
prevent correlation.

Appeal Number: EA/2007/0058

26. To that extent therefore we disagree with the finding in the Decision Notice that
section 40(2) has been properly applied: it is not in accordance with law. Neither
the names of the individual attendees, nor the organisations they represent,
constitute personal data; though they would if released in the format requested by
Mr Harcup, who asked for “lists of guests attending (including which organisation
they represented, if any), again broken down by event.”

27. Similar considerations apply to the names and organisations of those who were
provided with corporate hospitality by YF during the period. We cannot see any
significant difference in principle between those attending an “event”, as defined by
YF, and those in receipt of hospitality. It is clear that Mr Harcup’s request extended
to those enjoying corporate hospitality; we accept the view of the IC in his
submission, that now that the restricted nature of YF’s interpretation of Mr Harcup’s
request has become clear, the Decision Notice should be amended to cover
recipients of corporate hospitality in the same way as attendees at “events”.

The second issue: applying the exemption in s 40(2)

28. Given our finding that neither the names of those attending nor the names of the
organisations represented at events constitute personal data, the issue of whether
the exemption in section 40(2) was correctly applied becomes irrelevant. However,
lest we are wrong in our conclusion above, we set out, briefly, our conclusion on
this issue. We have followed the approach taken by the Tribunal in The Corporate
Officer of the House of Commons v The Information Commissioner, EA/2006/0015
and 0016.

29. The first question that arises is whether the first condition in section 40(3) is
satisfied: that the data processing should not contravene any of the data protection
principles in the Data Protection Act. The first of those principles is that “Personal
data shall be processed fairly and lawfully”. Both the IC and YF argue that it would
not be fair to disclose the names of attendees, given the assurance provided to
them by YF that their personal information would not be released. In the
circumstances of this case, we feel that little weight can be placed by recipients on
that assurance, at least as far as their names and organisations (as opposed to
contact details) are concerned. Firstly, we note that delegates may already have
been provided with a list of fellow attendees, and their organisations; secondly, that
the press may have attended some events on the invitation of YF. Delegates can
have had no real expectation of confidentiality for their names or organisations, as
opposed to the significant personal details of addresses or telephone numbers,
which were not provided, or requested. We reject the argument of YF that releasing
the limited information sought runs the risk of exposing those attending to spam
emails or unsolicited marketing since no contact details would be provided. To that
limited extent therefore, fairness may not prevent release of the data.

30. However, the first principle also requires that at least one of the conditions in the
second Schedule to the DPA be met. The relevant condition appears to be 6(1):

the processing is necessary for the purposes of the legitimate interests pursued
by the data controller or by the third party or parties to whom the data are
disclosed, except where the processing is unwarranted in any particular case by

Appeal Number: EA/2007/0058

reason of prejudice to the rights and freedoms or legitimate interests of the data
subject.

31. Is the processing (the release of the data) necessary to enable Mr Harcup to pursue
his legitimate interests? He has a legitimate interest in seeing how public funds are
spent. However, that principle should not be overstated. YF’s use of public funds is
monitored in a number of ways: through its governing body, accountable ultimately
to elected representatives in local and central government; and through public
auditors. We accept the general benefits that follow from increased transparency
and openness, but we are not persuaded that it is necessary for those benefits to
accrue for the names of attendees to be published. Those attending will do so for
the most part as representatives of their organisations; it is the organisation, not YF,
who decides for the most part who their representatives should be. It seems to us
that publishing the names of the organisations represented meets Mr Harcup’s
legitimate needs; we are not persuaded that it is necessary, a strong word, to go
further. Therefore, Mr Harcup fails at this first hurdle; there is no need to go on to
conduct the balancing exercise.

The third question: the cost limit

32. We turned to consider the alternative reason for not complying with the request
advanced by YF: that to do so would, in their estimation, exceed the cost limit in
section 12 of FOIA. We have set out their costs estimates in our findings of fact,
above. They have not been challenged by Mr Harcup. A public authority is not
required to prove their estimate to any high standard; merely that is a reasonable
one. From the information provided, the estimate appears reasonable. The most
cursory examination of the list of names provided indicates that to add a further list,
from the 4 Directorates, and then to compile comparable lists for recipients of
corporate hospitality would comfortably exceed the limit; and that is without taking
into account the 3 weeks work estimated as required to provide financial information
broken down by event, as requested.

33. The effect of an estimate that costs will exceed the limit is to remove the obligation
to provide information altogether: it is not to provide information up to the costs limit.
We note that YF have so far spent some £338 in answering Mr Harcup’s request:
they are not obliged to spend the balance, up to the limit.

34. However, we should not leave this point without considering the impact of section
16, the duty to provide advice and assistance, on the cost limit in section 12. It
must have been obvious to YF from the outset that the information Mr Harcup was
providing was huge in scope, and likely to fall way outside the limit. The request
covered both events and corporate hospitality; it extended to all 4 Directorates and
to centrally organised events; it covered several years. Indeed, costs were the
reason given in their initial answer for providing the information they did: they had
just dealt with another, similar request and therefore had collated much of the
information already. On the face of it, such a response appears well intentioned
and helpful, but it was in its effect seriously deficient. It was misleading since it
appeared to provide information about all the types of events Mr Harcup referred to.
In fact, it was only during the course of the appeal that the IC realised that he too
had been misled by that initial response, and realised that it only covered one
category of the information requested, ”events”, and that “corporate hospitality” was

Appeal Number: EA/2007/0058

regarded as something entirely different by YF, and simply ignored in their
response.

35. More fundamentally, there was no attempt at a dialogue with Mr Harcup, to make
him aware of the cost limit and to suggest ways in which he might restrict or focus
his request so as to make it, or at least some of it, attainable. It would be
reasonable to expect the authority to offer information on the costs position as part
of its duty to offer advice and assistance. The relationship is one sided: Mr Harcup
has no way of knowing the costs involved (or whether or when the authority will
consider applying the costs limit); the authority knows what information it has
available, and what will take time to obtain. Offering the information already
collated and available could have been part of such a dialogue, but it should have
been provided as one, partial option, alongside others, not as a full response,
whose limitations only became apparent during the appeal. An authority which
arbitrarily provides some information in answer to an extensive request and then
refuses to provide more under cover of section 12 is likely to act in breach of its
duty to provide advice and assistance to those requesting information in section 16.
Such an approach effectively prevents the requester making an informed choice, in
the knowledge of the likely constraints, as to what information they wish to request.

36. Given that the application of section 16 was not identified as an issue in the
appeal, and the parties have not therefore had the opportunity to address us on it,
we make no formal finding of breach, but we draw the attention of the parties to the
relationship between section 12 and 16 so that, should there be a further request
(and the Act envisages repeated requests in section 14(2), it may properly be
considered. We adopt and endorse the helpful guidance provided by another
division of this Tribunal on this point in the case of Brown v The Information
Commissioner and The National Archive, EA/2006/0088.

Conclusion and remedy

37. In conclusion, we find that the exemption in section 40(2) was not properly applied
and did not prevent the disclosure of the data requested, since in the context of the
case, the names and organisations (provided they remained unconnected) of those
attending events did not constitute personal data. However, since the provision of
that information would clearly exceed the costs limit set in section 12, no further
steps are required of Yorkshire Forward.

38. Our decision is unanimous.

Signed

Humphrey Forrest

Deputy Chairman of the Tribunal Date: 5 February 2008





Information Tribunal Appeal Number: EA/2007/0058 Information Commissioner’s Ref: FS50091142

Considered on the papers On 3 January 2008		Decision Promulgated 5 February 2008

BEFORE	CHAIRMAN Mr H Forrest and LAY MEMBERS Mr R Creedon Mr D Wilkinson Mr Tony Harcup and INFORMATION COMMISSIONER and			Appellant
Between				Appellant
Between				Respondent

Yorkshire Forward			Additional Party

Decision The Tribunal allows the appeal and substitutes the following decision notice in place of the decision notice dated 5 June 2007.

1

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	United Kingdom Information Tribunal including the National Security Appeals Panel
You are here: BAILII >> Databases >> United Kingdom Information Tribunal including the National Security Appeals Panel >> Harcup v Yorkshire Forward [2008] UKIT EA_2007_0058 (5 February 2008) URL: http://www.bailii.org/uk/cases/UKIT/2008/EA_2007_0058.html Cite as: [2008] UKIT EA_2007_58, [2008] UKIT EA_2007_0058



	Appeal Number: EA/2007/0058

	Information Tribunal Appeal Number: EA/2007/0058 SUBSTITUTED DECISION NOTICE Dated: 5 February 2008 Public authority: Yorkshire Forward Address of Public authority: Victoria House, Victoria Place, Leeds, LS1 5AE Name of Complainant: Mr Tony Harcup The Substituted Decision For the reasons set out in the Tribunal’s determination, the substituted decision is that: 1. Yorkshire Forward should not have substantially ignored Mr Harcup’s request for information about those organisations and individuals who had received corporate hospitality organised by Yorkshire Forward. 2. Yorkshire Forward was not entitled to withhold the names of the individuals that had attended events or corporate hospitality organised by it as these did not constitute personal data within section 1 of the Data Protection Act; and therefore the exemption in section 40(2) of the Freedom of Information Act did not apply; (provided that in releasing both names of individuals and the organisations they represented, the two could not be correlated). 3. However, it is clear that the cost of providing such data would have exceeded the cost limit set by section 12 of the Freedom of Information Act, and Yorkshire Forward are not therefore obliged to release the information requested.

	Dated this 5^th day of February 2008 Humphrey Forrest Deputy Chairman, Information Tribunal

	2



	Appeal Number: EA/2007/0058

	Reasons for Decision Introduction 1. Yorkshire Forward (YF) is a public authority whose duties include promoting business in Yorkshire. To this end, it organises a number of training events and seminars, and provides corporate hospitality on occasion. The request for information 2. On 28 June 2005 Mr Harcup made a request under the Freedom of Information Act (FOIA) for “All information relating to Yorkshire Forward’s corporate hospitality, events and entertainment of potential clients, members of the business community, politicians and other guests from 2003 to date: including, but not restricted to dinners, lunches, breakfasts, drinks receptions, awards ceremonies, and the use of hospitality boxes or tickets for sporting or other events. I would like to see the amount spent, broken down per event and lists of guests attending (including which organisation they represented, if any), again broken down by event. I would also like to see any reports relating to any such event in particular or to corporate hospitality in general.” 3. On 4 July 2005, YF replied: “We recently dealt with a similar enquiry and I have attached everything we could supply based on the data we have available, which covers all activity from 2002. Unfortunately we are unable to supply you with the details of delegates who attended our events as this is against the Data Protection Act”. 4. The letter went on to provide a substantial amount of information. The bulk of this related to events in Yorkshire in 2002 to 2005, with some financial information. After further correspondence, some more information was provided. Mr Harcup remained dissatisfied with the response, which included an internal review. In the review response, 27 September 2005, YF argued that the cost of providing any more information requested would exceed the limit of £450, and therefore they were not obliged to respond further, under section 12 of FOIA. The complaint to the Information Commissioner 5. Mr Harcup complained to the Information Commissioner (IC) on 10 October 2005. His “major complaint” was that YF had used the exemption in section 40(2) of the Data Protection Act (DPA) to withhold the names of delegates, but he also complained generally about the information supplied. 6. In his Decision Notice, dated 5 June 2007, the IC found some procedural breaches of section 17 of FOIA; found that YF had correctly applied the exemption for personal data in section 40(2) when it declined to provide the names of individuals, but held that this exemption had been incorrectly applied in relation to the names of 3



	Appeal Number: EA/2007/0058 the organisations involved; and required YF to disclose “the names of the organisations represented by attendees at corporate events hosted by YF from 2003 to 28 June 2005.” YF have since provided those names. The appeal to the Tribunal 7. In his appeal to the Tribunal Mr Harcup argues that the IC and YF have wrongly interpreted the definition of personal data, relying on the decision of the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746 to argue that information relating solely to official or business capacity (such as attendance at a publicly funded corporate event) should not be classed as personal data. Secondly, he argued that in principle it is not unfair if individuals attending such publicly funded events lose any expectation of privacy, and that there is a public interest in disclosing their names. The questions for the Tribunal 8. At a hearing for Directions on 10 September 2007, the issues in the appeal were set out: The issues arising for determination in this appeal include: a. whether the disputed information amounts to personal data at all, having regard in particular to the decision in Durant v Financial Services Authority; b. if it is personal data, whether the exemption in section 40(2) of the Freedom of Information Act applies; c. if the exemption does not apply, whether Yorkshire Forward are entitled to refuse disclosure on the ground that the cost of disclosing the information would exceed the limit provided in section 12 of FOIA. 9. However, during the appeal, it became apparent from the witness statements served by YF that YF operated a clear internal dividing line between “events” and “corporate hospitality”; and that the vast majority of the information they had supplied related to “events”: that part of Mr Harcup’s original request which related to corporate hospitality had never been addressed, save for some financial information. We have also considered in our decision how this issue might be dealt with. Evidence 10. We considered an agreed bundle of documents setting out correspondence between the parties, and the information disclosed; and witness statements from Mr Harcup; and from Ms RE Mason, corporate information officer for YF and Ms TM Lindsay, head of marketing and business development. 11. The events organised by YF include internal events for staff, including briefings and an annual conference; corporate events such as the Regional Economic Strategy Review, including key organisations such as the CBI, IoD, Local Authorities, MPs, Higher Education Institutes and Urban Regeneration Companies who contribute and shape key areas of policy; and external events such as overseas trade shows, and large scale business conferences. Events may be organised centrally by the

	4



	Appeal Number: EA/2007/0058 17. Section 40 of FOIA provides, so far as material: (2) Any information to which a request for information relates is also exempt information if – (a) it constitutes personal data which do not fall within subsection (1), and (b) either the first or second condition below is satisfied. (3) the first condition is - (a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene – (i) any of the data protection principles …., and (b) in any other case, that the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions contained in section 33A(1) of the Data protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

	Section 40(7) of FOIA gives “personal data” “the same meaning as in section 1(1) of the Data Protection Act”. That provides: DPA section 1(1) Personal data means data which relate to a living individual who can be identified – (a) from those data, or (b) from those data and other information which is in the possession, or is likely to come into the possession of, the data controller. The data protection principles referred to in section 40(3) FOIA are the principles set out in Part 1 of Schedule 1 of the DPA. Section 12 of FOIA removes the obligation to provide information, under section I, if the authority estimates that the cost of complying with the request would exceed the appropriate limit. The appropriate limit is defined, (in the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations) 2004) as £450 in this case, or 18 hours work at £25ph, the designated charging rate. Section 16 of FOIA provides:

	6



	Appeal Number: EA/2007/0058 regarded as something entirely different by YF, and simply ignored in their response. 35. More fundamentally, there was no attempt at a dialogue with Mr Harcup, to make him aware of the cost limit and to suggest ways in which he might restrict or focus his request so as to make it, or at least some of it, attainable. It would be reasonable to expect the authority to offer information on the costs position as part of its duty to offer advice and assistance. The relationship is one sided: Mr Harcup has no way of knowing the costs involved (or whether or when the authority will consider applying the costs limit); the authority knows what information it has available, and what will take time to obtain. Offering the information already collated and available could have been part of such a dialogue, but it should have been provided as one, partial option, alongside others, not as a full response, whose limitations only became apparent during the appeal. An authority which arbitrarily provides some information in answer to an extensive request and then refuses to provide more under cover of section 12 is likely to act in breach of its duty to provide advice and assistance to those requesting information in section 16. Such an approach effectively prevents the requester making an informed choice, in the knowledge of the likely constraints, as to what information they wish to request. 36. Given that the application of section 16 was not identified as an issue in the appeal, and the parties have not therefore had the opportunity to address us on it, we make no formal finding of breach, but we draw the attention of the parties to the relationship between section 12 and 16 so that, should there be a further request (and the Act envisages repeated requests in section 14(2), it may properly be considered. We adopt and endorse the helpful guidance provided by another division of this Tribunal on this point in the case of Brown v The Information Commissioner and The National Archive, EA/2006/0088.

	Conclusion and remedy 37. In conclusion, we find that the exemption in section 40(2) was not properly applied and did not prevent the disclosure of the data requested, since in the context of the case, the names and organisations (provided they remained unconnected) of those attending events did not constitute personal data. However, since the provision of that information would clearly exceed the costs limit set in section 12, no further steps are required of Yorkshire Forward. 38. Our decision is unanimous.

	Signed Humphrey Forrest Deputy Chairman of the Tribunal Date: 5 February 2008

	12

United Kingdom Information Tribunal including the National Security Appeals Panel