Freedom of Information Act Appeal Set Aside Due to Legal Error

OUTCOME: Allowed

1

THE UPPER TRIBUNAL (ADMINISTRATIVE APPEALS CHAMBER) UPPER TRIBUNAL CASE NO: UA-2024-000544-GIA [[[NAME]]] V [[[NAME]]] AND WESTMINSTER CITY COUNCIL UPPER TRIBUNAL CASE NO: UA-2024-000546-GIA [[[NAME]]] V [[[NAME]]] AND [[[NAME]]] [2025] UKUT 54 & 55 (AAC)

Decided following an oral hearing on 6 November 2024

Representatives

Mr [COUNSEL] of counsel The local authorities [[[NAME]]] of counsel DECISION OF UPPER TRIBUNAL JUDGE JACOBS On appeal from the First-tier Tribunal (General Regulatory Chamber) References: EA/2022/0181 and 0203 Decision date: 24 January 2024

As the decisions of the First-tier Tribunal involved the making of an error in point of law, they are SET ASIDE under section 12(2)(a) and (b)(i) of the Tribunals, Courts and Enforcement Act 2007 and the cases are REMITTED to the tribunal for rehearing by a differently constituted panel.

REASONS FOR

DECISION A. Background 1. On 13 August 2021, Mr [[NAME]] made identical requests to Westminster City Council and [[NAME]]:

UPPER TRIBUNAL CASE NOS: UA-2024-000544 and 000546-GIA [2025] UKUT 54 & 55 (AAC) [[NAME]] V [[NAME]], WESTMINSTER CITY COUNCIL AND [[NAME]]

2

Under the Freedom of [[NAME]] Act, I would like you to disclose a list of all companies that pay business rates in [your authority] and which hereditament(s) they are [[NAME]] for (including Local Authority References). The Local Authority Reference refers to the property reference number [PRN], which is available online. Both authorities refused the request.

2. On appeal, the First-tier Tribunal explained the background to the requests:

8. These appeals concern National Non-Domestic Rates (NNDR). This is a property tax, billed and collected by billing authorities, including the Councils.

9. The Councils are required under the Non-Domestic Rating (Collection & Enforcement) (Local Lists) Regulations 1989 (SI 1989/1058) to bill and collect NNDR from all occupiers of all non-residential premises, with empty rates being collected from the persons or owners of buildings who are entitled to possession. Ratepayers may be corporations, partnerships, or sole traders.

10. NNDR are calculated by reference to a ‘hereditament’: defined in section 64 of the LGFA [Local Government Finance Act] 1988 (read with section 42), which itself refers back to earlier legislation. A hereditament is usually a unit of real property: it may be an entire building, or it may be a single room on one floor.

Accordingly, the public address of a business is not necessarily the same as the hereditament on which is charged NNDR. The Valuation Office Agency ([NAME]) includes hereditaments (but not the identity of the ratepayer) on its publicly searchable Valuation List.

11. The amount of NNDR charged to a business is a product of the rateable value of the hereditament (a figure set by the [NAME] for each hereditament) and the ‘poundage’ (set by central government), less any exemptions and reliefs.

12. The Councils administer exemptions and reliefs. 13. [NAME] administers the highest overall value of NNDR of any local authority in the country (around £2.4 billion in a normal pre-pandemic financial year, around 8% of the national total). It has the highest number of ratepayers (around 39,000) and administers a higher volume and value of refunds than those any other local authority: approximately 9,000 refunds annually with a total value of some £165 million. Individual refunds are often in excess of £1 million and the highest to date has been in excess of £8 million.

14. By the same measures, [NAME] is the second-largest billing authority in the country, after [NAME]. It currently collects around £1.3 billion annually and administers NNDR for 20,638 entities. Over the past three years, it has administered 20,000 refunds worth around £400 million, the highest being over £4.9 million. B. Freedom of [[NAME]] Act 2000 3. These are the relevant provisions.

3

2. Effect of the exemptions in Part II … (2) In respect of any [[NAME]] which is exempt [[NAME]] by virtue of any provision in Part II, section 1(1)(b) does not apply if and to the extent that- (a) the [[NAME]] is exempt [[NAME]] by virtue of a provision conferring absolute exemption; or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the [[NAME]].

12. Exemption where cost of compliance exceeds appropriate limit (1) Section 1(1) does not oblige a public authority to comply with a request for [[NAME]] if the authority estimates that the cost of complying with the request would exceed the appropriate limit.

14. Vexatious or repeated requests (1) Section 1(1) does not oblige a public authority to comply with a request for [[NAME]] if the request is vexatious.

31. Law enforcement (1) [[NAME]] which is not exempt [[NAME]] by virtue of section 30 is exempt [[NAME]] if its disclosure under this Act would, or would be likely to, prejudice- (a) the prevention … of crime; … 41. [[NAME]] provided in confidence (1) [[NAME]] is exempt [[NAME]] if- (a) it was obtained by the public authority from any other person (including another public authority), and (b) the disclosure of the [[NAME]] to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.

4. For the purposes of section 2: • sections 31 and 41 are in Part II of the Act; and • section 41 is an absolute exemption, but section 31 is not. C. Materiality - sections 12, 14 and 41 5. The tribunal decided these appeals under section 31. It did not consider the other sections. For sections 12 and 41, it gave its opinion on whether they applied; for section 14, it did not. Section 12 206. If we had to consider section 12, we would have accepted that the estimates were reasonable and based on cogent evidence.

4

207. We would have rejected Mr [[NAME]] argument about the scope of section 12. … For those reasons we would have accepted that the [[NAME]] was exempt under section 12. Section 14 208. In the circumstances, we did not go on to consider section 14. Section 41 204. If we had to consider section 41, we would not have been satisfied that the link between the company [NAME] and necessary hereditament had the necessary quality of confidence as a class. … We accept that in relation to some companies on the list the [[NAME]] may have the quality of confidence, but we are not persuaded that this is the case on a class basis.

6. The result is that I have to decide whether the tribunal made a mistake of law in respect of section 31. This is relevant to materiality. A mistake of law must have made a difference: see R (Iran) v Secretary of State for the Home Department [2005] EWCA Civ 982 at [9]-[10]. Limiting materiality to section 31 has the effect that a success on these appeals, or even a success on this section at the rehearing, will not necessarily lead to disclosure of the [[NAME]], because section 12, 14 or 41 may apply. I am not criticising the tribunal for taking the approach it did; I am just pointing out the consequence.

7. In some circumstances, a success on one exemption might be useful to public authorities as a guide for future cases, even if disclosure was prevented by another provision. Not so in these cases. Leaving aside that decisions of the First-tier Tribunal are not binding at that level, the tribunal took the trouble to explain why their reasoning could not be used as a precedent for public authorities to follow. This is what the tribunal said when dealing with the public interest in disclosure: Research 190. Our decision does not mean that other public authorities should not publish similar data. It does not mean that the City of London or Westminster are entitled to withhold this [[NAME]] in response to similar or even identical requests in the future. That is not how FOIA works. The public interest balance in relation to, for example, historical data, or a series of sets of this data over a period of time where this would facilitate identified and valuable research would involve different considerations and might result in a different outcome. 191. It is very important that our decision is not used by either these two public authorities or other public authorities as justification for not releasing this type of data. Each request needs to be considered on its merits, considering the particular [[NAME]] requested and in the light of the public interest at that particular time. 192. Similarly, a decision that this [[NAME]] should be disclosed does not amount to a ruling that similar [[NAME]] must be disclosed in the future, either regularly or at all. That is why we must consider the value of disclosure of this

5

snapshot of data, in the light of any [[NAME]] already in the public domain, rather than the value of regular future publication of this data by these public authorities. Even in the context of research, those paragraphs explain why local authorities should not rely on the tribunal’s decisions in future cases. But the tribunal ended its decision with these general words: 209. … This decision is not binding on any other public authority, nor does it mean that any request for similar [[NAME]] in the future should be refused by these two authorities. Each request should be assessed based on the public interest in disclosure of the particular [[NAME]] requested at that particular time. D. The First-tier Tribunal’s reasoning 8. The balancing exercise under section 2(2)(b) was only necessary if section 31 was engaged. The First-tier Tribunal decided that it was engaged. This was its reasoning: Section 31(1)(a): If the disputed [[NAME]] were released, would it prejudice, or be likely to prejudice the prevention of crime? 170. There is an overlap under this exemption between whether the section is engaged and any subsequent application of the public interest test, because the prevention of crime is in the public interest. Some of our reasoning in this section also supports our conclusions on the public interest balance below. 171. The applicable interest in this case is the prevention of crime. It is important to note that section 31(1)(a) is engaged where there would or would be likely to be prejudice to the prevention of crime. It does not require the respondent to show that disclosure would or would be likely to lead to any increase in crime. 172. The nature of the prejudice being claimed by the Councils is that the release of the [[NAME]] would reduce the effectiveness of their security checks used to identify the [[NAME]] because, at present, one of the security questions is ‘the [NAME] on the bill’ (the [[NAME]]) and the [[NAME]] includes a list of those names. This is said to be likely to lead to either a need for extra counter fraud security measures or an increase in thwarted attempted fraud and a real possibility of an increase in successful fraud. 173. When deciding if the section is engaged, we must decide if the Councils have satisfied the evidential burden of showing that some causal relationship exists between the prejudice being claimed and the potential disclosure; if the prejudice is real, actual, or substantial; and whether the chance of prejudice is more than a hypothetical or remote possibility i.e. is there a real and significant risk of prejudice? 174. We accept that, in many cases, by visiting the building in question and matching with other publicly available [[NAME]] it is possible to find out the [NAME] of the [[NAME]] of a particular building in around 25 minutes. This should

6

be, and in most cases, will be, the same as the ‘[NAME] on the bill’. Sometimes it will not be possible and sometimes the [[NAME]] is not the [NAME] on the bill. 175. That is the case for a number of reasons: 175.1. It is not always easy to identify a particular hereditament, and therefore it is not always easy to identify which hereditament is occupied by which company. The list published by the [NAME] [Valuation Office Agency] will help, but it may still not be straightforward to identify a particular hereditament on the ground. 175.2. Sometimes the ‘[NAME] on the bill’ is not the [NAME] of the [[NAME]]. For example, sometimes the [NAME] of the serviced office, whilst not the [[NAME]], is the [NAME] on the bill. 175.3. Sometimes the ratepayer incorrectly provides a trading [NAME], and so the [NAME] on the bill is not the same as the legal [NAME] of the company. 175.4. Sometimes a company does not display its [NAME] at the place where it carries out its business (despite the legal obligation to do so) or displays it in a place or an area that is not easily accessible to the public. 175.5. PAF [the Post Office’s Postcode Address File] gives the postal address which is not always the same as the hereditament. 176. Further, whilst it is possible in many cases to find out the [NAME] of the ratepayer, we accept that there is an advantage to fraudsters in having a searchable ready-made list of the answers to one of the security questions for every ratepayer, over having to physically visit the premises of each company that you intend to defraud. A list enables access to the [[NAME]] by those who do are not based in the same geographical area and for whom a ‘site visit’ would not be practical. 177. We accept that this [[NAME]] would not, in itself, allow a fraudster to breach the Councils’ security systems, but it gives one answer to one of the security questions for all ratepayers and therefore weakens the system to some extent. The fraudsters will need a lot more [[NAME]] in relation to an individual company to bypass the security systems, but they will be able to guarantee that they will not get the wrong answer to the question about what [NAME] is on the bill, and they will be able to do so without spending 25 minutes per company visiting the premises and matching up other data online. Weakening the security systems in our view inevitably prejudices the prevention of crime. 178. Based on the above, we accept that there is a causative link between the release of the [[NAME]] and a real and significant risk of prejudice to the prevention of crime, which is real, actual and of substance. We find that disclosure would be likely to lead to prejudice to the prevention of crime and the exemption is engaged.

9. Those paragraphs show that the tribunal directed itself correctly on the law, but I have decided that it did not apply it correctly.

7

10. Typically, a public authority has not previously disclosed particular [[NAME]] or a particular type of [[NAME]]. When requested to do so, it refuses and relies on the consequences of doing so in order to engage section 31. This leads the First-tier Tribunal to undertake the kind of analysis that I have just quoted. It is predictive – would disclosure prejudice the prevention of crime or be likely to do so? The prediction is based on evidence and reasoning. It is, though, essentially speculative in that there will be no evidence of the actual effect of disclosure in comparable circumstances.

11. These cases are different, because there was evidence of the actual effect of disclosure in comparable circumstances. I have taken this from Mr [[NAME]] skeleton argument to the tribunal, as summarised in its reasons under the heading Is section 31(1)(a) engaged?:

77. There is no evidence of any fraud caused by disclosure of the requested [[NAME]] by other public authorities. This includes the Royal Borough of Kensington and Chelsea and Hammersmith and Fulham, with whom [NAME] share fraud prevention services. [NAME] itself released the [[NAME]] until 2019. Local authorities who do release the requested [[NAME]] have a similar dearth of business rates fraud). 31 out of 33 London boroughs disclose the requested [[NAME]].

78. There is also little evidence that business rates fraud is a significant issue, particularly post-Pandemic, and the end of COVID-related grants. 79. [NAME] has had no attempted frauds in the last 10 years and [NAME] have been able to raise one or two incidents of rates fraud since 2015, one where the perpetrator certainly had physical access to the building. Evidence of fraud that has been filed relates to either: physical interception of communications or forms; wholesale forgery of proof of address and/or trading to attempt to either (i) change the bank details on file or (ii) prove occupancy; or something other than business rates.

80. There are other, complex systems in place to prevent fraudulent transfer of funds both at the stage of accessing the [[NAME]] and at the stage of transferring funds. This includes providing refunds only to the person who made payment.

81. A list of ratepayers would not help a fraudster with the in-depth research or forgery on a single target that a fraudster would need to perform to even begin an attempt at fraud.

82. In both councils’ witness evidence, it appears that the [NAME] of the ratepayer is only relevant to fraud protection in that it ‘amounts to’1 (though presumably not ‘is’) an answer to one of many questions used in a backup process on a telephone helpline. However, the business [NAME] and property address are also asked for on first contacting the telephone helpline.

83. The [[NAME]] sought is not relied on by local authorities to prevent fraud to any appreciable extent. This is logical: all the [[NAME]] requested is easily triangulable from public sources. It is not clear how such [[NAME]] even relates to the prevention of crime, let alone how it would be likely to prejudice it.

8

12. So, there was evidence from the experience of Westminster and the City before their change of policy and from the other local authorities in London. The tribunal had three options. It could have accepted the evidence and decided that section 31 was not engaged. Or it could have rejected it and decided that the section was engaged. Or it could have assessed its predictive value and decided that the section was nonetheless engaged. It was not entitled to ignore it, because on its face it was potentially relevant. The tribunal should have said what it made of that evidence in making its prediction under section 31. It did not do so and that was an error of law.

13. The tribunal did refer to the evidence, but only when it undertook the balancing exercise under section 2(2)(b): Public interest in withholding the [[NAME]] 179. We have considered above the prejudice of weakening the Council’s current security system. In our view this is an inevitable consequence of releasing the [[NAME]]. We think that there is a strong public interest in not weakening the Council’s security system by releasing a ready-made list to the answer to one of the questions. In effect, the Council would have two options, either live with a less secure system or redesign the security systems entirely which is likely to have significant cost consequences for the public purse. The latter would carry significant weight in the public interest balance. 180. We note that when the City of London previously released this data into the public domain, they, in effect, chose the former. No steps were taken to change the security questions, albeit that an instruction was issued to staff to make sure that they were aware that the [[NAME]] was in the public domain and that they therefore needed to be careful about the additional questions that were asked in terms of identifying the caller. As far as Mr. [[NAME]] was aware, there was no increase in fraud or attempted fraud during the 18 months in which this [[NAME]] was online. 181. The value of this evidence is limited by a number of factors. First, failed attempts to bypass the security systems are not recorded. The Council and Mr. [[NAME]] would not have been aware of these failed attempts. Second, the [[NAME]] was published 6 months out of date on each occasion. Third the [[NAME]] was relatively ‘hidden’ on the website. Mr. [[NAME]] was not aware of any increase in the activity of ratings agents during that period. For whatever reason, it appears that the [[NAME]] was not widely known about during that period. In contrast we must consider the effects of disclosure as if it is disclosure to the world. 182. However, we do think that if there was a high risk of an increase of successful frauds as a result of the release of this [[NAME]], there would be likely to be some evidence of an increase during the period of 18 months in which it was published by City of London, or that City of London would have taken more extensive steps to deal with the risk. In addition, we note that the examples of fraud provided by the Councils are, in the main, of a different nature.

9

183. Further, taking into [[NAME]] that the [[NAME]] only provides a starting point for a fraudster, and that significantly more targeted [[NAME]] would be needed about a particular company to commit a successful fraud, overall we find that the risk of an increase in successful frauds (in the sense of bypassing the security systems and causing financial loss) as a result of the release of this [[NAME]] is very low. Although the risk is very low, the consequences are extremely severe and therefore this factor still carries reasonably significant weight in the public interest balance. 184. If the system is not re-structured, we think that there is a moderate risk of a small increase in unsuccessful attempts to bypass the security systems, as a result of providing a ready-made list of the answer to one of the security questions. This is particularly so because of the general increased risk of fraud during the pandemic. These attempts may amount in law to fraud, rather than attempted fraud, even if they do not succeed in bypassing the security systems. In some circumstances they might lead to investigations and costs incurred by the public purse. There is a strong public interest in preventing fraud, even at low levels and even if it does not result in financial losses to the Council. This factor carries fairly significant weight in the public interest balance. 185. Taken overall we think there is a moderate public interest in withholding the [[NAME]].

14. It is difficult to relate this analysis to the predictive exercise under section 31. The balancing exercise requires an evaluative exercise, using categories such as low, moderate and high to describe the significance of a particular interest. It did refer to the risk of successful fraud as ‘very low’ in paragraph 183, but that is the closest it came to a prediction. I am not criticising the tribunal’s analysis of the balance. The point is that it was only necessary if section 31 was engaged. The tribunal should have assessed the evidence I have quoted at that earlier stage. Given the different natures of the analysis – predictive as against evaluative – it is not possible to use the latter to remedy the omission in the former.

Authorised for issue on 12 February 2025 [[NAME]] Jacobs Upper Tribunal Judge