Upper Tribunal Allows Appeal on FOIA Exemptions

OUTCOME: Allowed

Department for [NAME_1] v [NAME_2] & (2) [NAME_5] [2021] UKUT 327 (AAC)

1

IN THE UPPER TRIBUNAL Appeal No. GIA/2301/2019 (V – CVP) ADMINISTRATIVE APPEALS CHAMBER

On appeal from First-tier Tribunal (General Regulatory Chamber) – [NAME_4]: DEPARTMENT FOR [NAME_1]

Appellant - v –

(1) [NAME_2] (2) [NAME_5]

Respondents

Before: Upper Tribunal Judge Jones

Hearing date: 12 March 2021

Representation: Appellant: [redacted] Legal Department First Respondent: [redacted] Second Respondent: [redacted]

ON APPEAL FROM:

Tribunal: First-tier Tribunal ([NAME_4]) – General Regulatory Chamber Tribunal Case No: EA/2018/0286 Tribunal Venue: N/A – decided on papers Hearing Date: 17 July 2019 Decision Date: 3 August 2019

DECISION

The decision of the Upper Tribunal is to allow the appeal. The decision of the First- tier Tribunal made on 3 August 2019 under number EA/2018/0286 was made in error of law. Under section 12(2)(a) and (b)(i) of the Tribunals, Courts and Enforcement Act 2007 I set that decision aside and remit the case to be reconsidered by a fresh tribunal in accordance with the following directions.

Appeal No. GIA/2301/2019 (V – CVP)

2

Directions

1. This case is remitted to a freshly constituted First-tier Tribunal for reconsideration. 2. The appeal is to be limited to the issue of whether the requested [NAME_4] is exempt from disclosure pursuant to section 36(2) of the Freedom of [NAME_4] Act 2000.

3. The form of the hearing, the evidence that is to be admitted and all other consequential directions are to be made by the First-tier Tribunal.

These Directions may be supplemented by later directions by a Tribunal Judge in the General Regulatory Chamber of the First-tier Tribunal.

REASONS FOR DECISION

Introduction 1. This is an appeal to the Upper Tribunal from a decision of the First Tier Tribunal (‘[NAME_8]’) in a written decision dated 3 August 2019. The decision was made on the papers on 17 July 2019 without an oral hearing.

2. The appeal concerns the disclosure, pursuant to the Freedom of [NAME_4] Act 2000 (“FOIA”), of staff survey reports addressing very small units within the [NAME_10]. The requested reports relate to the [NAME_9] (“[NAME_9]”), a unit within the Department for [NAME_1] (‘the Appellant’ of ‘[NAME_1]’) and, within the [NAME_9], those pertaining to the “Investigators” unit and the “Administration” unit. The staff surveys in question were part of the [NAME_10] which is described as an important tool in the management of the [NAME_10]. 3. [NAME_8] upheld the decision of [NAME_2] (‘the First Respondent’ or ‘Commissioner’) that the Appellant must disclose [NAME_4] requested by the Second Respondent, [NAME_5], relating to staff surveys conducted in the [NAME_9] between 2010 and 2018.

4. The Appellant submits [NAME_8] erred in law in making its decision. 5. [NAME_8]’s decision upheld the decision of the Commissioner and agreed that no part of the requested [NAME_4] is exempt from disclosure under section 40(2) of FOIA (personal data). This is disputed by the Appellant in Grounds 1 and 2 of its grounds of appeal. 6. [NAME_8] also agreed with the Commissioner that the requested [NAME_4] is not exempt from disclosure under section 36(2)(c) of FOIA (prejudice to the effective conduct of public affairs). This is disputed by the Appellant in Ground 4 of its grounds of appeal.

Appeal No. GIA/2301/2019 (V – CVP)

3 The hearing before the Upper Tribunal 7. In directions dated 11 September 2020, I invited the parties to express their preference as to the form of the hearing before the Upper Tribunal. They all indicated they were content for a remote hearing to take place by online video platform, CVP. Taking into account the parties’ views, I was satisfied that it was in accordance with the overriding objective, just and fair, to hold a video hearing for public health reasons during the time of the pandemic. I was satisfied that it would afford the parties a fair and reasonable opportunity to present their respective cases which consisted of submissions on the law rather than the receipt of any evidence.

8. I held an oral hearing by CVP online video platform on 12 March 2021 in which all the parties participated and made oral submissions. Counsel appeared for the Appellant and First Respondent as named above and the Second Respondent appeared in person during the open sessions. I am grateful to all of them for the courteous and helpful presentation of each of their cases. I was particularly impressed by the research, industry and clarity with which both counsel structured their arguments.

9. During the hearing there was also a short closed session from which the Second Respondent was excluded but during which counsel for the Appellant and First Respondent made submissions. The open and closed sessions were also attended by counsel’s instructing solicitors and observers from the [NAME_11].

10. As I explained to the Second Respondent during the hearing, her interests were represented during the closed hearing in the sense that her case was largely aligned with the First Respondent whose counsel made submissions opposing the appeal in both open and closed sessions. I also gave the Second Respondent a gist of the closed session, as agreed with counsel. This was to the effect as follows. In respect of the section 40 exemption and the first two grounds of appeal, arguments were heard in the closed session by reference to the precise questions and aggregated responses contained in the staff survey (the requested [NAME_4]). In respect of the section 36 exemption and fourth ground of appeal, arguments were heard in closed session by reference to the closed parts of the witness statement of [NAME_12], the witness from the [NAME_11] on behalf of the Appellant whose evidence was provided to [NAME_8].

11. In addition to the parties’ oral submissions, I have received written submissions from the First Respondent dated 23 December 2020 and Appellant’s submissions dated 28 August 2020 and 3 February 2021. Closed submissions and closed reasons

12. In addition to the oral submissions during the closed session, I also received and considered the closed written submissions on behalf of the First Respondent provided to [NAME_8] dated 28 May 2019. I have considered those closed submissions when giving my closed reasons which accompany this decision. Those closed reasons supplement and develop the reasons given in this open decision.

Appeal No. GIA/2301/2019 (V – CVP)

4 Factual background

13. On 3 March 2018 the Second Respondent, [NAME_5], requested disclosure from the Appellant of “all [NAME_9] staff surveys undertaken by [NAME_9] or on behalf of [NAME_9]” for the years 2010/11 to 2017/18.

14. The disputed [NAME_4] which the Appellant has identified as falling within the scope of the request comprises aggregated responses to the staff surveys. The aggregated data simply shows what percentage of respondents to the survey answered “yes” or “no” to certain questions, or indicated a certain level of agreement or disagreement with a statement (eg “strongly agree” or “strongly disagree”). Where more detailed [NAME_4] was sought by the survey, for example in a follow up to a “yes” / “no” question, no indication as to the number of responses has been given where the number of people responding was lower than 10. This is consistent with the broader [NAME_10] policy set out at the end of the survey, which states: “Confidentiality The survey was carried out as part of the 2018 [NAME_10], which is managed by the [NAME_11] on behalf of all participating organisations. The [NAME_11] commissioned [NAME_13] to carry out the survey. [NAME_13] is a member of the Market Research Society, and is bound by their strict code of conduct and confidentiality rules. These rules do not allow for the breakdown of the results to the extent where the anonymity of individuals may be compromised. Groups of fewer than 10 respondents will not be reported on, however their responses do contribute to the overall scores for the unit and organisation they belong to and the overall [NAME_10].”

15. The Appellant responded to [NAME_5]’s request on 3 April 2018, confirming that it held [NAME_4] within the scope of the request, but refusing to disclose it on the basis that it fell within section 36(2)(c) FOIA and the public interest balance favoured withholding it. 16. [NAME_5] sought an internal review on 3 April 2018. In its internal review of 30 April 2018, the Appellant upheld the original decision as to the application of section 36(2)(c) FOIA, and relied additionally on section 40(2) of FOIA.

17. On 1 May 2018 [NAME_5] complained to the Commissioner, who investigated the complaint and issued decision notice FS50742642 on 22 November 2018 (“the DN”). The Commissioner’s reasoning is set out in full in the DN, but in summary she concluded that the requested [NAME_4] should be disclosed and neither exemption relied upon by the Appellant was engaged.

[NAME_8]’s Decision

18. The Appellant appealed to [NAME_8]. By the date of the hearing, the issues before [NAME_8] were: a. whether section 36(2) of FOIA was engaged, and if so whether the public interest favoured disclosing the disputed [NAME_4]; and

Appeal No. GIA/2301/2019 (V – CVP)

5 b. whether section 40(2) of FOIA was engaged, by reason of the disputed [NAME_4] comprising the ‘personal data’ of the Chief Inspector of the [NAME_9]; and if so whether its disclosure would be compatible with the first data protection principle and with condition 6(1) of Schedule 2 to the Data Protection Act 1998.

19. By its decision of 3 August 2019, [NAME_8] refused the [NAME_1]’s appeal against the Commissioner’s decision of 22 November 2018. As above, the Commissioner had determined that [NAME_4] requested by [NAME_5] in her request dated 3 March 2018, namely [NAME_10] Staff Survey reports relating to the [NAME_9] (“the requested [NAME_4]”), was required to be disclosed under FOIA and neither exemption relied upon by the [NAME_1] was engaged.

20. I take the exemptions in reverse order to the order in which [NAME_8] addressed them because that is the order in which the appeal grounds are now presented. [NAME_8]’s decision on section 40 FOIA 21. [NAME_8] decided the Appellant did not benefit from the data protection exemption under s.40 FOIA because, in respect of section 40(2) FOIA, the disputed [NAME_4] was not “personal data” as defined in section 1(1) of the Data Protection Act 1998, and within the scope of section 40(2)(a) of FOIA, because it could not be used to identify the then [NAME_9] Chief Inspector.

22. In summary [NAME_8] decided that: a) The fact that [NAME_3] requested related to the performance management of the Chief Inspector of the [NAME_9] was “irrelevant” to whether it constituted his personal data ([28] of the decision); b) The requested reports were not personal data because it was not possible to identify the Chief Inspector from the requested [NAME_4] itself, whether alone or together with other sources of [NAME_4]. This would appear to be because “There is no suggestion that any question in the survey names the Chief Inspector or refers to his position”. ([28-29]); 23. [NAME_8] stated as follows at [27]-[30] of the decision: “27. In our view, it is abundantly clear [NAME_3] to which the request relates does not constitute personal data. In the end [NAME_1]’s case, as gleaned from [NAME_6]’s submissions seems to be confined to the assertion that the relevant data subject is the former Chief Inspector of [NAME_9] and to rest on the following propositions. First, the concept of ‘personal data’ is a wide one. Second, [NAME_5]’s purpose is to find out about the competence of the former Chief Inspector of [NAME_9] and such a purpose is “highly indicate of [NAME_3] being his personal data.” Third, the survey report is the personal data of the Chief Inspector because (a) they (the data) are used an intended to be used for performance management, and (b) the names of many managers, including the Chief Inspector are available online.

28. …As to [[NAME_6]’s] third point, it seems to us that (a) is irrelevant and (b) is only relevant if and to the extent that a living individual could be identified from a combination of the survey report and the online [NAME_4].

29.We have been shown no basis for concluding that the survey report could identify the Chief Inspector, either on its own or when read with any other [NAME_4]. The report is compiled by

Appeal No. GIA/2301/2019 (V – CVP)

6 collecting anonymous responses. There is no suggestion that any question in the survey names the Chief Inspector or refers to his position or that of any other manager. No doubt, from any number of sources, the identity of any Chief Inspector (past or present) can be ascertained. But [NAME_1] needs to show that the disputed [NAME_4] can itself identify him or contribute, with other sources, to his identification. …

30. In these circumstances, [NAME_1]’s case under s40 collapses without more. The ambitious argument that the survey report ‘relates to’ the Chief Inspector (past or present) in the sense explained in the Durant [v Financial Services Authority [2004] FSR 28 CA] case need not be examined because no answer on the question can resolve the insurmountable problem that, in any event, the disputed [NAME_4] does not serve to identify him, either by itself or in combination with other [NAME_4].”

24. [NAME_8] therefore decided section 40(2) of FOIA was not engaged. It was not necessary to go on to consider whether the disputed [NAME_4] “related to” the Chief Inspector, within section 1(1) of the Data Protection Act 1998: [30]. It was also not necessary to consider whether disclosing that [NAME_4] would contravene any of the data protection principles, as set out in Schedule 1 of the Data Protection Act 1998 and within section 40(2)(b) and 40(3)(a)(i) FOIA.

25. The Appellant now challenges this conclusion by way of Grounds 1 and 2 in this appeal. It submits that [NAME_8] erred in law in making the decision that the exemption under section 40 FOIA was not engaged. [NAME_8]’s decision on section 36 exemption 26. [NAME_8] also held that the Appellant did not benefit from the exemption under s.36(2)(c) of FOIA because in respect of section 36(2) FOIA, [NAME_8] “had very careful regard to the statement of [NAME_12], [NAME_11] Chief Economist” [19], and concluded that the concerns expressed by the Appellant and [NAME_12] about the potential effects of disclosure were “speculative and overblown”: [21]. 27. [NAME_8] also reasoned that in addition to there being no prejudice in publication, there were other benefits to publication. [NAME_8] found not only that [NAME_1]’s concerns, set out in the unchallenged witness statement of [NAME_12] of the [NAME_11], were “speculative and overblown”, but also “publication of the results of individual sections or sub-units could serve to guard against the risk of the collective results smoothing over significant fluctuations in staff sentiment” and “could lay to rest anxieties of sceptics…who might be tempted to suspect that a department would deploy the full statistics in support of a public relations campaign to distribute good news and conceal problem areas.” ([21])

28. More specifically, [NAME_8] found: a. as to the alleged ‘chilling effect’ on other staff surveys in future: “We struggle to see any real risk in unit-specific publication. The Tribunal is too often presented with doom-laden warnings of ‘chilling effect’ for which there is little or no evidential basis. Cases are not to be decided on mere assertion. We find no persuasive evidence in [NAME_12]’s statement pointing to real risk of participation in the survey diminishing as a consequence of survey results being released into the public domain. It is common ground that those who participate

Appeal No. GIA/2301/2019 (V – CVP)

7 in surveys do so anonymously and, where very small units are involved, analysis of results by group is not undertaken anyway.1 We have been shown no convincing evidence to substantiate the theory that participation statistics are affected by any release, or anticipated release of [NAME_10] survey results, much less any evidence pointing to that being likely in the case of [NAME_9]”: [22]; b. and “In addition, [NAME_12] is driven to make the concession that the survey results of the [NAME_9] survey were satisfactory. In the circumstances, there seems to be no sensible basis for fearing any adverse consequences of releasing the material into the public domain. [NAME_12] speaks of possible prejudice from later freedom of [NAME_4] requests, perhaps relating to other independent units with the [NAME_10]. But we are not concerned with any later request and our judgment on the facts of this case cannot influence the assessment of any later Tribunal in relation to any later freedom of [NAME_4] request….” [23]. 29. [NAME_8] therefore emphasised that disclosure in this case would not mean that the Commissioner and Tribunal would order that different survey results for different parts of the [NAME_10] should in future be disclosed. [NAME_8]’s decision was confined to its specific facts. It could not and did not purport to set any precedent.

30. The Appellant now challenges these conclusions by way of its Ground 4 in this further appeal. It submits that [NAME_8] erred in law in concluding that the exemption under section 36 FOIA did not apply. The granting of permission to appeal 31. [NAME_8] Judge Snelson refused permission to appeal to the Upper Tribunal by decision dated 16 September 2019.

32. I held an oral hearing of the Appellant’s application for permission to appeal on 7 September 2020. I granted the Appellant permission to appeal on grounds 1, 2 and 4 of its grounds of appeal in my decision dated 11 September 2020 but refused permission to pursue ground 3.

Applicable law

(i) The relevant provisions of FOIA

33. A person requesting [NAME_4] from a public authority has a right to have that [NAME_4] communicated to them, if the public authority holds it: section 1(1) FOIA. That right is subject to certain exemptions.

Section 40 FOIA – personal data exemption

34. Section 40 FOIA (as it stood at the date of the Appellant’s internal review) provides that a public authority is entitled to refuse to provide [NAME_4] requested on

1 ‘We read in [NAME_12]’s statement, para 11 tells us that the threshold is 10 respondents’.

Appeal No. GIA/2301/2019 (V – CVP)

8 the basis that it is ‘personal data’ and to do so would breach the Data Protection Act 1998: 40 [NAME_4] (1) [NAME_4] to which a request for [NAME_4] relates is exempt [NAME_4] if it constitutes personal data of which the applicant is the data subject. (2) [NAME_4] to which a request for [NAME_4] relates is also exempt [NAME_4] if— (a) it constitutes personal data which do not fall within subsection (1), and (b) either the first or the second condition below is satisfied. (3) The first condition is— (a)in a case where [NAME_3] falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the [1998 c. 29.] Data Protection Act 1998, that the disclosure of [NAME_3] to a member of the public otherwise than under this Act would contravene— (i) any of the data protection principles, or (ii) section 10 of that Act (right to prevent processing likely to cause damage or distress), and (b) in any other case, that the disclosure of [NAME_3] to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions in section 33A(1) of the [1998 c. 29.] Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded. (4)The second condition is that by virtue of any provision of Part IV of the [1998 c. 29.] Data Protection Act 1998 [NAME_3] is exempt from section 7(1)I of that Act (data subject’s right of access to personal data). … (7)In this section— “the data protection principles” means the principles set out in Part I of Schedule 1 to the [1998 c. 29.] Data Protection Act 1998, as read subject to Part II of that Schedule and section 27(1) of that Act; “data subject” has the same meaning as in section 1(1) of that Act; “personal data” has the same meaning as in section 1(1) of that Act.

35. “Personal data”, under section 1 of the Data Protection Act 1998, is defined as: “data which relate to a living individual who can be identified – (a) from those data, or (b) from those data and other [NAME_4] which is in the possession of, or is likely to come into the possession of, the data controller …”

36. The “data protection principles” are set out in the Schedules to the Data Protection Act 1998. These provide, in relevant part: “SCHEDULE 1 The data protection principles Part I The principles 1Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless— (a)at least one of the conditions in Schedule 2 is met, and …” “SCHEDULE 2 Conditions relevant for purposes of the first principle: processing of any personal data …

Appeal No. GIA/2301/2019 (V – CVP)

9 6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. …” 37. The Data Protection Act 1998 implemented the UK’s obligations under Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Article 2(a) of the Directive defined “personal data” as follows: “'personal data' shall mean any [NAME_4] relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;”

38. This definition reflects the intention articulated in the Preamble to the Directive, which states: “Whereas the principles of protection must apply to any [NAME_4] concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable; whereas codes of conduct within the meaning of Article 27 may be a useful instrument for providing guidance as to the ways in which data may be rendered anonymous and retained in a form in which identification of the data subject is no longer possible;”

39. [ADDRESS] of Appeal in [NAME_14] v 5-[ADDRESS] and others [2017] EWCA Civ 121 confirmed that the definition of “personal data” in the Data Protection Act 1998 implies a two-limbed test: “61. Mr [NAME_15]-Payne QC, for the University, submitted that the definition of "personal data" consists of two limbs: i) Whether the data in question "relate to" a living individual and ii) Whether the individual is identifiable from those data. This is inherent in the form of the definition in the DPA. I agree, and the point is, in my judgment, even clearer in the definition of "personal data" in the Directive, where the definition is clearly split between two clauses.”

40. In respect of the second limb, identification, the House of Lords in Commons Services Agency v [NAME_16] [NAME_17] [200] UKHL 47, interpreted the definition of “personal data” as follows: “24. The relevant part of the definition is head (b). It directs attention to “those data”, which in the present context means [NAME_3] which is to be barnardised, and to “other [NAME_4]” which is or may come to be in the possession of the data controller. “Those data” will be “personal data” if, taken together with the “other [NAME_4]”, they enable a living individual to whom the data relate to be identified. The formula which this part of the definition uses indicates that each of these two components must have a contribution to make to the result. Clearly, if the “other [NAME_4]” is incapable of adding anything and “those data” by themselves cannot lead to identification, the definition will not be satisfied. The “other [NAME_4]” will have no part to play in the identification. The same result would seem to follow

Appeal No. GIA/2301/2019 (V – CVP)

10 if “those data” have been put into a form from which the individual or individuals to whom they relate cannot be identified at all, even with the assistance of the other [NAME_4] from which they were derived. In that situation a person who has access to both sets of [NAME_4] will find nothing in “those data” that will enable him to make the identification. It will be the other [NAME_4] only, and not anything in “those data”, that will lead him to this result.”

41. As Recital (26) of the Directive makes clear, it is permissible to render data anonymous in such a way that the data subject is no longer identifiable, and to publish/disclose it outside the data protection regime. Whether data has been fully anonymised is a question of fact to be decided in each individual case: Commons Services Agency, [27]. In R (on the application of the Department of Health) v IC [2011] EWHC 1430 (Admin), Cranston J accepted that, in that case, converting underlying [NAME_4] into statistics was effective to anonymise personal data. The Commissioner issued a Code of Practice on Anonymisation, under section 51 of the Data Protection 1998, which refers to aggregation as a permissible and low-risk method of anonymisation: see Appendix 2, and p36: “Different types of anonymised data have different vulnerabilities and pose different levels of re-identification risk. At one end of the spectrum, pseudonymised or de-identified data may be very valuable to researchers because of its individual-level granularity and because pseudonymised records from different sources can be relatively easy to match. However, this also means that there is a relatively high reidentification risk. At the other end of the spectrum, aggregated data is relatively low-risk, depending on granularity, sample sizes and so forth. This data may be relatively ‘safe’ because re-identification risk is relatively low. However, this data may not have the level of detail needed to support the data linkage or individual-level analysis that some forms of research depend on. … The more aggregated and non-linkable the anonymised data is, the more possible it is to publish it. This might be the case for statistics showing the percentage of children in a wide geographical area who have achieved particularly high educational attainment, for example.”

42. This approach is reflected in the compilation of the disputed [NAME_4] in this case, as set out in the statement quoted above.

43. In respect of the “relate to” limb, the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746 held: "28. … Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether [NAME_3] is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. [NAME_3] should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated. In short, it is [NAME_4] that affects his privacy, whether in his personal or family life, business or professional capacity. A recent example is that considered by the [ADDRESS] in Criminal

Appeal No. GIA/2301/2019 (V – CVP)

11 proceedings against [NAME_18], Case C-101/01 (6th November 2003), in which the Court held, at para. 27, that "personal data" covered the name of a person or identification of him by some other means, for instance by giving his telephone number or [NAME_4] regarding his working conditions or hobbies."

44. It is important to recall that the Court of Appeal in Durant referred to these two “notions” in the context of a case where it was borderline whether particular data “relates to” an individual: Edem v IC [2014] EWCA Civ 92, [17]. Those notions have no application in a case where the data obviously meet that requirement, such as, in the [NAME_19] case, “a person’s name in conjunction with job-related [NAME_4]”. [ADDRESS] of Appeal in [NAME_19] approved the Commissioner’s guidance in this regard: “21. [NAME_2]'s Office Data Protection Technical Guidance to assist in determining "what is personal data" accurately sets out the effects of the statutory scheme:- ‘6. It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where [NAME_4] is not 'obviously about' an individual or clearly 'linked to' him.’"

45. Finally, in interpreting “personal data” in any given case it is necessary to consider whether the interpretation proposed would serve the purposes of Directive 95/46, which is to protect an individual’s right to privacy: [NAME_14], [68].

Section 36 FOIA – prejudice to effective conduct of public affairs 46. Section 36(2) provides that a public authority is entitled to refuse to provide [NAME_4] requested on the basis that disclosure would prejudice, or be likely to prejudice, the effective conduct of public affairs: ‘36 Prejudice to effective conduct of public affairs (1)This section applies to— (a) [NAME_4] which is held by a government department or by the National Assembly for Wales and is not exempt [NAME_4] by virtue of section 35, and (b)[NAME_4] which is held by any other public authority. (2) [NAME_4] to which this section applies is exempt [NAME_4] if, in the reasonable opinion of a qualified person, disclosure of [NAME_3] under this Act— (a) would, or would be likely to, prejudice— (i)the maintenance of the convention of the collective responsibility of Ministers of the Crown, or (ii)the work of the Executive Committee of the Northern Ireland Assembly, or (iii)the work of the executive committee of the National Assembly for Wales, (b)would, or would be likely to, inhibit— (i)the free and frank provision of advice, or (ii)the free and frank exchange of views for the purposes of deliberation, or (c) would otherwise prejudice, or would be likely otherwise to prejudice, the effective conduct of public affairs. …

Appeal No. GIA/2301/2019 (V – CVP)

12 (4) In relation to statistical [NAME_4], subsections (2) and (3) shall have effect with the omission of the words “in the reasonable opinion of a qualified person”. …’ 47. [ADDRESS] of Appeal accepted, in Department for Work and Pensions v [NAME_17] & another [2016] EWCA Civ 758, at paragraph 27, that [NAME_8] judgment in Hogan v IC [2011] 1 Info LR 588 comprised “an accurate statement of the correct approach to the issue of prejudice”, including for the purposes of section 36(2) of FOIA. In that judgment [NAME_8] had held that to engage a prejudice-based exemption a public authority must establish that there is a real and significant risk that disclosing [NAME_3] requested will cause prejudice that is real, actual or of substance: “29. First, there is a need to identify the applicable interest(s) within the relevant exemption … “30. Second, the nature of the ‘prejudice’ being claimed must be considered. An evidential burden rests with the decision maker to be able to show that some causal relationship exists between the potential disclosure and the prejudice and that the prejudice is, as Lord Falconer of Thoroton has stated, ‘real, actual or of substance’ (Hansard (HL Debates), 20 April 2000, col 827). If the public authority is unable to discharge this burden satisfactorily, reliance on ‘prejudice’ should be rejected. There is therefore effectively a de minimis threshold which must be met.” ………. “34. A third step for the decision-maker concerns the likelihood of occurrence of prejudice. A differently constituted division of this tribunal in [COMPANY_20] v [NAME_2] (EA/2005/0005) interpreted the phrase ‘likely to prejudice’ as meaning that the chance of prejudice being suffered should be more than a hypothetical or remote possibility; there must have been a real and significant risk. That tribunal drew support from the decision of Munby J in R (Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin) , where a comparable approach was taken to the construction of similar words in the Data Protection Act 1998 . Munby J stated that ‘likely’: ‘connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there “may very well” be prejudice to those interests, even if the risk falls short of being more probable than not.’ “35. On the basis of these decisions there are two possible limbs on which a prejudice-based exemption might be engaged. Firstly, the occurrence of prejudice to the specified interest is more probable than not, and secondly there is a real and significant risk of prejudice, even if it cannot be said that the occurrence of prejudice is more probable than not.”

48. In respect of prejudice alleged to be comprised of a “chilling effect” on public servants in future, a three-judge panel of the Upper Tribunal in Paul Davies v IC & Cabinet Office [2019] UKUT 185 (AAC) observed: “25. There is a substantial body of case law which establishes that assertions of a "chilling effect" on provision of advice, exchange of views or effective conduct of public affairs are to be treated with some caution. In Department for [NAME_21] v [NAME_2] EA/2006/0006, the First-tier Tribunal commented at [75(vii)] as follows: "In judging the likely consequences of disclosure on officials' future conduct, we are entitled to expect of them the courage and independence that has been the hallmark of our civil servants since the Northcote-Trevelyan reforms. These are highly-educated and politically sophisticated public servants who well understand the importance of their impartial role as counsellors to ministers of conflicting convictions. The most senior officials are frequently identified before select committees, putting forward their department's position, whether or not it is their own."

Appeal No. GIA/2301/2019 (V – CVP)

13 26. Although not binding on us, this is an observation of obvious common sense with which we agree. A three judge panel of the Upper Tribunal expressed a similar view in DEFRA v Information Commissioner and Badger Trust [2014] UKUT 526 (AC) at [75], when concluding that it was not satisfied that disclosure would inhibit important discussions at a senior level: "75. We are not persuaded that persons of the calibre required to add value to decision making of the type involved in this case by having robust discussions would be inhibited by the prospect of disclosure when the public interest balance came down in favour of it… 76. …They and other organisations engage with, or must be assumed to have engaged with, public authorities in the full knowledge that Parliament has passed the FOIA and the Secretary of State has made the EIR. Participants in such boards cannot expect to be able to bend the rules."

27. In Department of Health v Information Commissioner and Lewis [2015] UKUT 0159 (AAC), [2017] AACR 30 Charles J discussed the correct approach where a government department asserts that disclosure of [NAME_4] would have a "chilling" effect or be detrimental to the "safe space" within which policy formulation takes place, as to which he said: "27. …The lack of a right guaranteeing non-disclosure of [NAME_4] …means that that [NAME_4] is at risk of disclosure in the overall public interest … As soon as this qualification is factored into the candour argument (or the relevant parts of the safe space or chilling effect arguments), it is immediately apparent that it highlights a weakness in it. This is because the argument cannot be founded on an expectation that the relevant communications will not be so disclosed. It follows that … a person taking part in the discussions will appreciate that the greater the public interest in the disclosure of confidential, candid and frank exchanges, the more likely it is that they will be disclosed… 28. …any properly informed person will know that [NAME_4] held by a public authority is at risk of disclosure in the public interest. 29. … In my view, evidence or reasoning in support of the safe space or chilling effect argument in respect of a FOIA request that does not address in a properly reasoned, balanced and objective way: i) this weakness, … is flawed."

(ii) [NAME_8]’s duty to give adequate reasons

49. The duty of a court or tribunal to provide reasons was described by Lord Brown in South Bucks District Council v [NAME_22] (No 2) [2004] UKHL 33: "The reasons for a decision must be intelligible and they must be adequate. They must enable the reader to understand why the matter was decided as it was and what conclusions were reached on the 'principal important controversial issues', disclosing how any issue of law or fact was resolved. Reasons can be briefly stated, the degree of particularity required depending entirely on the nature of the issues falling for decision."

50. In the context of [NAME_4] rights appeals, a three-judge panel of the [NAME_23] in [NAME_6] [NAME_24], at paragraph 22, approved the summary of [NAME_23] Judge Markus QC in DH v IC and Bolton Council [2016] UKUT 0139 (AAC), at paragraph 34: "Counsel for both Respondents have reminded me of the importance of the Upper Tribunal exercising restraint when faced with a challenge to a decision of the First-tier Tribunal and in particular when the reasons which it gives are being examined. As Lord Hope said in Jones v First-tier Tribunal & CICA [2013] UKSC 19 at [25], "The appellate court should not assume too readily that the tribunal misdirected itself just because not every step in its reasoning is fully

Appeal No. GIA/2301/2019 (V – CVP)

14 set out in it.". Applying Jones in UCAS v Information Commissioner and Lord Lucas [2014] UKUT 557 (AAC) Upper Tribunal Judge Wikeley said at [59]: "The question is rather whether the Tribunal has done enough to show that it has applied the correct legal test and in broad terms explained its decision…".

The Appellant’s grounds of Appeal

Ground 1 51. The Appellant’s first ground of appeal that [NAME_8] was wrong to hold that the fact that the requested reports are performance management data is irrelevant to the question of whether it is personal data. 52. [NAME_8] held at [28] of the Decision that the fact that [NAME_3] requested related to the performance management of the Chief Inspector of the [NAME_9] was “irrelevant” to whether it constituted his personal data. 53. [NAME_6] submitted that this conclusion of [NAME_8] was unsustainable. It is well established that (provided the relevant data subject is identifiable – a separate issue) job-related [NAME_4] is personal data. This was specifically held to be the case by the Court of Appeal in Edem v The Information Commissioner [2014] EWCA Civ 92 at [13] to which the Tribunal’s attention was specifically drawn in the [NAME_1]’s written submissions. No authority was cited to the contrary and [NAME_8] simply said that none of the cases cited bore “upon the point on which [we] have found [the [NAME_1]’s] case untenable.” [NAME_8] was accordingly in error in holding that the fact that [NAME_3] was job-related [NAME_4] usable for performance management purposes was irrelevant to whether it was personal data.

54. As to Ground 1, [NAME_6] submitted that the Commissioner’s submissions suggested that the Appellant had mischaracterised [NAME_8]’s analysis. That was not accepted. [NAME_8] clearly held at paragraph 28 of its decision that the fact that [NAME_3] requested related to the performance management of the Chief Inspector of the [NAME_9] was “irrelevant” to whether it constituted his personal data, which is plainly wrong as a matter of law. 55. [NAME_6] also submitted that the Commissioner’s alternative case on Ground 1, that [NAME_8] would have been entitled to make a finding that performance management data was irrelevant, misses the point. The Commissioner had submitted that, if [NAME_8] did conclude that the Appellant’s submission was in substance irrelevant to whether the “relates to” limb is met, that conclusion would have been correct or at least rational. While it is correct that whether a piece of [NAME_4] relates to an individual is a factual question to be determined in each case, it does not follow that this ground is a challenge to a question of fact. 56. [NAME_6] submitted that the Appellant’s case is that the fact that [NAME_4] was job-related [NAME_4] usable for performance management purposes was relevant to whether it was personal data. If the Appellant is correct that job-related [NAME_4] is capable of amounting to [NAME_4] which “relates to” an individual, [NAME_8] adopted an erroneous approach in law to the question of whether [NAME_3] in this case relates to the Chief Inspector of the [NAME_9].

Appeal No. GIA/2301/2019 (V – CVP)

15 57. As the Court of Appeal noted at paragraph 65 of [NAME_14], “At [13] [of [NAME_19]] Moses LJ said that there was ample authority that “a person's name, in conjunction with job-related [NAME_4], is their personal data.” That is to say, job-related [NAME_4] is [NAME_4] related to a person, which together with his name, which satisfies the identifiability element, renders it personal data. As the Court notes at paragraph 66 of the [NAME_14], Beatson and Underhill LJJ agreed. [ADDRESS]’s analysis of [NAME_19] at paragraph 66 of [NAME_14], is then that “[NAME_25] wanted was a specific piece of [NAME_4], namely the names of the officials who dealt with his case. The question was whether the three officials were identifiable from these data. Plainly they were.” [ADDRESS] of Appeal in Ittiahadieh according casts no doubt on the fact that job-related [NAME_4] is [NAME_4] that “relates to” an individual, which is the point here.

Ground 2 58. [NAME_6] submitted that [NAME_8] was wrong to hold that it is not possible to identify the former Chief Inspector of [NAME_9] from the survey reports indirectly or together with other [NAME_4] accessible to the requester.

59. Section 1(1) of the Data Protection Act 1998 provides that: “‘personal data’ means data which relate to a living individual who can be identified- (a) from those data, or (b) from those data and other [NAME_4] which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.”

60. [NAME_6] submitted that in this case, it is plain that the surveys relate to the relevant managers including the Chief Inspector. Specific questions are asked about them. The Appellant accepts that it is not possible to identify the relevant managers from the surveys alone and that this is therefore not a limb (a) case. However, as noted, the surveys clearly contribute to the identification of the [NAME_9] Chief Inspector, as they contain [NAME_4] that relate to him and are labelled “[NAME_9]”. It is clear therefore from the surveys that [NAME_3] relates to the Chief Inspector.

61. The publicly available [NAME_4] then provides what is described in the caselaw as the “key” to unlock the puzzle as to precisely who that is. 62. [NAME_6] submitted that [NAME_8]’s suggestion that the limb (b) identifiability criteria is not met because the survey does not itself name the Chief Inspector or refer to his position is beside the point. As noted, the reports are produced at team level, so will necessarily (particularly given that specific questions are asked about this) constitute expressions of opinion about that team’s leader (i.e. the relevant manager, here the Chief Inspector). That [NAME_4] (opinions about the team leader, here the Chief Inspector) together with knowledge of who that individual is (which [NAME_4] in relation to the Chief Inspector of the [NAME_9] is publicly available) enables the identification of the individual concerned. Indeed, as noted before [NAME_8], [NAME_5] has herself identified the Chief Inspector and wants these surveys precisely because they contain [NAME_4] that relates to him.

Appeal No. GIA/2301/2019 (V – CVP)

16 63. In the circumstances, [NAME_6] submitted that [NAME_8] adopted too narrow an approach to the limb (b) identifiability criteria.

64. In his refusal of permission to appeal to the Upper Tribunal, Judge Snelson states that the survey results “contribute nothing to the identifiability of the Chief Inspector”, but [NAME_6] submitted that this is simply not correct. As explained above, the surveys are expressly labelled as pertaining to the [NAME_9], which [NAME_8] in the Decision, and Judge Snelson in his refusal of permission had failed to take into account. [NAME_6] submitted that Upper Tribunal Judge Wright when refusing permission on the papers dismissed this ground out of hand as “no more than an attempt to have the Upper Tribunal reassess the factual merits of the case, which absent a pure irrationality challenge…is not an error of law ground.” But as set out above, this is not a challenge to the findings, but to the approach to the legal test applied.

65. This is not an irrationality challenge but in any event, [NAME_6] such a finding is perverse, given the ease with which the identity of the Chief Inspector of the [NAME_9] is found and the fact that the report says “[NAME_9]” at the top in large letters.

66. The question the Commissioner had addressed in its submissions is whether, in order to be identifiable from the contested data and all other means reasonably likely to be used to identify that individual, it is necessary for that data and other means to identify only that person, or whether it is sufficient for that person to be one identifiable within a number of others to whom the data (may) also relate. 67. [NAME_6]’s submission was that, provided the individual can be identified as within that group (and [NAME_3] relates to him or her), that will be personal data. For example, if it is known that a group of 10 patients at a clinic are HIV+, and it is known that patient A is among that group, but, because the patient numbers have been lost there is no way of identifying which of the 10 patients in the group patient A is, [NAME_3] that all the patients in the group are HIV+ is nonetheless A’s personal data even though it does not only relate to him. (Such [NAME_4] is obviously sensitive personal data, but there is no relevant distinction here).

68. The Commissioner had submitted that the above is wrong because personal data must relate to a single living individual. The Appellant accepts that, but it does not detract from the fact that a person can be identifiable as one of a group of individuals who share a particular characteristic such as HIV+ status, or about whom an opinion is collectively expressed. The Commissioner had noted that it is permissible to anonymise data so that individuals can no longer be identified. But that does not mean that where individuals can be identified within an anonymised group (such as patient A among the 10 HIV+ patients), the data will nonetheless not be personal data.

69. Indeed, [NAME_6] submitted the Commissioner’s Code of Practice, cited at paragraph 43 of the ICO Submissions is helpful to consider and consistent with the Appellant’s case. The reports with which this request were concerned are produced at team level, so will necessarily, given the questions about this, constitute expressions of opinion about that team’s leader (i.e. the relevant manager, here the Chief Inspector). That [NAME_4] (opinions about the team leader, here the Chief Inspector) together with knowledge of who that individual is (which [NAME_4] in relation to the Chief Inspector of the [NAME_9] is publicly available) enables the identification of the

Appeal No. GIA/2301/2019 (V – CVP)

17 individual concerned. The fact that there may be other members of the group who are not identifiable does not prevent the Chief Inspector from being so identifiable. Ground 4 70. [NAME_6] submitted that [NAME_8] failed to take account of and/or give appropriate weight to the relevant evidence of [NAME_12] as to the impact of disclosure of the requested reports when deciding that the section 36 exemption did not apply. In the alternative he submitted that [NAME_8] gave insufficient reasons for rejecting [NAME_12]’s evidence.

71. He submitted that [NAME_8] stated at [22] of its decision that assertion was all that there was in this case in support of the Appellant’s reliance on the chilling effect of disclosure. However, that overlooked the detail of the evidence of [NAME_12] (in particular her witness statement at [36]-[45] who was an experienced and senior civil servant (the [NAME_11]’s Chief Economist) in this regard. As noted in the Appellant’s Skeleton for permission to appeal, it is difficult to see what better evidence could have been produced to show the possible chilling effects of disclosure. In particular, [NAME_12] gave examples of teams within the [NAME_10] who do not complete the survey because of FOIA concerns: see para 36(v). More importantly she gave evidence of the effects already being felt within the [NAME_9]: [38]. It is trite that [NAME_8] must engage with the relevant evidence, but there is no evidence that it had done so.

72. In the circumstances, the assessment of [NAME_12]’s evidence at [22] as mere assertion is wrong and [NAME_8]’s assessment of the evidence goes well beyond the degree of caution or circumspection appropriate in cases of alleged chilling effects. It is difficult to envisage circumstances where a prospective chilling effect could be shown if the approach adopted by [NAME_8] were the test. That was plainly not the intention of this Tribunal in Hogan and in the circumstances, the appeal should be allowed on this ground.

73. The Appellant’s alternative ground under section 36(2)(c) is that [NAME_8] failed to give sufficient reasons. While the Appellant accepts that it is not necessary to deal expressly with every point, a judge must say enough to show that care has been taken and that the evidence as a whole has been properly considered: Simetra Global Assets Ltd v Ikon Finance Ltd [2019] EWCA Civ 1413 at [46]. As another Chamber of this Tribunal has also noted, mere statements that a witness was not believed are unlikely to be sufficient to discharge the duty to give reasons: MK (duty to give reasons) Pakistan [2013] UKUT 641 (IAC). 74. [NAME_6] submitted that [NAME_8]’s bald statement at [19] of the decision that it had very careful regard to [NAME_12]’s statement is, with respect, insufficient. For the same reasons, insofar as the Tribunal considers that [NAME_12]’s statement was taken into account, this bald statement does not demonstrate that [NAME_8] gave it proper weight in determining whether prejudice would be caused by the release of the requested reports.

75. Further and in any event, [NAME_8] failed to give any explanation for why this evidence was (if it was taken into account) rejected. [NAME_8] would appear to have simply substituted its own speculation as to the likely consequences of release for the

Appeal No. GIA/2301/2019 (V – CVP)

18 evidence of [NAME_12], which was, as noted all but unchallenged, and who is well placed to make these sorts of assessments.

76. In the circumstances, this was not an approach that was lawfully open to [NAME_8]. Upper Tribunal Judge Wright had suggested in refusing permission that this is incorrect because this is not a Malnick type case in which the reasonable opinion of a qualified person plays a part. [NAME_6] respectfully submitted that this is to misunderstand the submission. This is not a question of deference to another’s view, as in a Malnick case, but a question of [NAME_8] being required to reach decisions as the likely effect of disclosure not on the basis of its own speculation but on the basis of the evidence before it. It is well recognised that where a court has to make prognostic assessments, it will nevertheless give great weight to the views of those with the relevant institutional expertise: R (Lord Carlile of Berriew QC) v Secretary of State for the Home Department [2014] UKSC 60. That is not the same as not taking the decision for oneself.

77. On the substance of the ground, the Commissioner suggests that this is simply a challenge to the factual findings. [NAME_6] submitted that is of course well- established that in appropriate circumstances factual findings are capable of challenge as an error of law. As the Court of Appeal recently put it, “If a judge makes material errors in the evaluation of evidence, for instance because the inference drawn from a fact found is logically not one that properly can be drawn, then an appellate court will interfere”: SB (Sri Lanka) v SSHD [2019] EWCA Civ 160 at [48]. First Respondent’s Submissions 78. [NAME_7], for the Commissioner, opposed the appeal. She submitted that [NAME_8] had not erred in making its decision on any of the grounds of appeal for which permission had been granted. [NAME_8] and Commissioner were right to hold that neither exemption applied and the requested [NAME_4] should be disclosed. Grounds 1 and 2 79. I address the First Respondent’s submissions in reply to grounds 1 and 2 in the discussion section of this decision. Ground 4 80. [NAME_7], for the Commissioner responded as follows to ground 4. She submitted that the Appellant complains that in reaching its conclusion that section 36(2) of FOIA was not engaged, [NAME_8]: (a) failed to have regard to [NAME_12]’s evidence; or (b) did not attach sufficient weight to it; or (c) failed to give any explanation for why her evidence was rejected; or (d) simply substituted its own view of the likely consequences of disclosure:

81. As a preliminary observation, [NAME_7] submitted that the Appellant had stated repeatedly in its Grounds of Appeal that [NAME_12]’s evidence was “unchallenged”. [NAME_7] submitted that this is not correct – it is correct that she was not called to give oral evidence and cross examined and [NAME_8]’s decision was made without a hearing but the First Respondent had made submissions as to why [NAME_12]’s evidence was not accepted.

Appeal No. GIA/2301/2019 (V – CVP)

19 82. [NAME_7] respectfully adopted the analysis already set out by the Upper Tribunal in the permission determination of Judge Wright on the papers at [14]. This is “no more than a factual merits challenge dressed up as an error of law ground”.

83. She submitted in particular: a. The argument that [NAME_8] failed to take [NAME_12]’s evidence into account is “completely unsustainable given what the tribunal say in paragraph 19 of its decision about having “had very careful regard to” [NAME_12]’s statement”; b. The argument that [NAME_8] failed to give sufficient weight to [NAME_12]’s evidence “is classically a matter solely for the fact-finding tribunal, absent a pure irrationality challenge (which, again, is not made): see Yeboah v Crofton [2002] EWCA Civ 794; [2002] IRLR 634 and DWP v ICO [2016] EWCA Civ 758; [2017] 1 WLR 1.” c. The argument that [NAME_8] gave inadequate reasons for rejecting [NAME_12]’s evidence “is wholly without legal merit given the explanation the tribunal did provide in paragraphs 21-23 of its decision”; and d. The argument that [NAME_8] substituted its view for [NAME_12]’s is “misplaced. It is common ground that this was not a case where the ‘reasonable opinion of a qualified person’ played a part… In these circumstances, it was for the tribunal as the superior decision-making body to decide the prejudice issue for itself.”

84. [NAME_7] submitted that the question of whether disclosure of [NAME_3] requested was likely to prejudice the effective conduct of public affairs was a pure question of fact, for [NAME_8] to determine. There is no error of law in [NAME_8]’s Judgment on section 36(2) FOIA, or in the process by which it arrived at that judgment.

85. As to this, the Commissioner maintains that [NAME_8]’s reasons at [21]-[23] of the decision are entirely adequate. They are sufficient to “enable the reader to understand why the matter was decided as it was and what conclusions were reached on the 'principal important controversial issues', disclosing how any issue of law or fact was resolved.” The Appellant can understand precisely which point it has lost on, and why it has lost. [NAME_12]’s evidence was rejected by [NAME_8] because: ‘We find no persuasive evidence in [NAME_12]’s statement pointing to a real risk of participation the survey diminishing as a consequence of survey results being released into the public domain It is common ground that those who participate in surveys do so anonymously and, where very small units are involved, analysis of results by group is not undertaken anyway2’ [22].

86. Therefore, [NAME_8] did not accept that disclosure would give rise to a chilling effect on future staff participation in the survey, because staff participate in the survey anonymously, and because analyses of survey results are only made on an aggregated basis, for units of 10 or more people. [NAME_8] at [22] of its decision did not consider the evidence was sufficient to establish that, in those circumstances, disclosing the aggregated survey results would deter staff from completing the surveys.

2 ‘We read in [NAME_12]’s statement, para 11 tells us that the threshold is 10 respondents’.

Appeal No. GIA/2301/2019 (V – CVP)

20 87. Further, [NAME_8] did not accept that disclosing the disputed [NAME_4] would have an adverse effect in the instant case, because the staff survey results which comprise the disputed [NAME_4] were satisfactory: see [23] of the decision.

88. Finally, [NAME_8] did not accept that disclosure in this case would mean that the Commissioner and Tribunal would order that different survey results, for different parts of the [NAME_10], should be disclosed. [NAME_8]’s task was simply to determine the present case: see [23] of the decision. 89. [NAME_7] therefore submitted that those reasons are sufficient to explain why the Appellant had not established that section 36(2) of FOIA was engaged, and why [NAME_12]’s evidence had not been accepted. The Appellant had not shown a real and significant risk that any real prejudice is likely to arise as a result of disclosure: see DWP, [27]. 90. [NAME_7] accepted that it was true that [NAME_8] did not engage point-by-point with every paragraph of [NAME_12]’s evidence. However, it is well-established that that is not what is required of a judicial body: eg [NAME_24], [22]. "The question is rather whether the Tribunal has done enough to show that it has applied the correct legal test and in broad terms explained its decision…" [NAME_7] submitted [NAME_8] had done so here. 91. [NAME_7] submitted the argument is misconceived insofar as the Appellant also pursued a point about the weight to be given to [NAME_12]’s evidence and a complaint that [NAME_8] has substituted its view of the likely effects of disclosure for her evidence, based on R (Lord Carlile of Berriew QC) v Secretary of State for the Home Dept [2014] UKSC 60 (referred to in permission determination §40 [[NAME_23]/86]), for two reasons.

92. First, in the present case the disputed [NAME_4] is statistical [NAME_4] within section 36(4) of FOIA. That means that section 36(2) “[has] effect with the omission of the words “in the reasonable opinion of a qualified person””, and [NAME_8] had to decide for itself whether disclosure would cause the prejudice alleged by the Appellant. [NAME_12]’s evidence on this point is not the opinion of a qualified person, to be reviewed only for its reasonableness and accepted provided it fell within the bounds of reasonableness. It was simply evidence that was to be weighed by [NAME_8] in deciding for itself what the consequences of disclosure were likely to be. The argument that [NAME_8] should have elevated her evidence to a status akin to the opinion of a qualified person by giving it “great weight” ignores the clear stipulation in the statute as to the circumstances in which weight is to be given to the opinion of individuals within the public authority, and would render section 36(4) essentially nugatory.

93. Second, [NAME_12]’s evidence was that the prejudice which would be likely to arise was a chilling effect. It is well established that such evidence is to be treated with caution: eg [NAME_24], [25] et seq. It is certainly not to be accorded “great weight”.

94. Seen in this light, [NAME_7] submitted that a complaint that [NAME_12]’s evidence had been accorded insufficient weight by [NAME_8] or it had failed to give sufficient reasons for rejecting her evidence is without foundation.

95. She therefore submitted that Ground 4 should be dismissed and [NAME_8]’s decision be upheld on all grounds.

Appeal No. GIA/2301/2019 (V – CVP)

21 Second Respondent’s Submissions The Second Respondent, [NAME_5], adopted and relied upon the Commissioner’s arguments in opposing the appeal and submitting that there was no error of law in [NAME_8]’s decision. She submitted that the requested [NAME_4] should be disclosed to her as the exemptions under section 40 and 36 FOIA did not apply as both the Commissioner and [NAME_8] had found. She relied on an analogy - the fact that the government had disclosed staff survey data from the Rail Accident Investigation Branch, a body comparable to [NAME_9], which had even fewer staff than the [NAME_9] - an establishment of 43 staff were reported in 2019.

Discussion and Decision

Section 40 FOIA, personal data exemption

96. I am satisfied that the Appellant’s first and second grounds of appeal should be rejected. They do not demonstrate any error of law on the part of [NAME_8] in deciding that the personal data exemption under section 40 FOIA did not apply to the requested [NAME_4]. [NAME_8] did not err in law in concluding that the requested [NAME_4], the [NAME_9] staff survey reports for 2010-2018, did not consist of personal data of the Chief Inspector or any other person within [NAME_9]. My reasons for coming to this conclusion are set out below. They are supplemented by further reasons contained in my closed decision.

97. Not only did [NAME_8] not err in law, but its reasons for finding that the section 40 FOIA exemption did not apply were admirably succinct and to the point. Ground 1 98. In its first grounds of Appeal, the Appellant complains that [NAME_8] erred in considering it to be irrelevant that the disputed [NAME_4] related to the performance management of the [NAME_9] Chief Inspector. I largely adopt the submissions of the First Respondent in rejecting this ground of appeal.

99. In short, it is clear from reading [NAME_8]’s decision at [27]-[30] as a whole that the Appellant’s complaint is based on a mischaracterisation of [NAME_8]’s analysis and reading the word ‘irrelevant’ in [28] out of context. [NAME_8] did not decide that it was irrelevant that the disputed [NAME_4] related to the performance management of the [NAME_9]. It decided at [30] that it did not need to go on to decide this issue because a living person could not be identified. [NAME_8] decided it did not need to go on to decide the second limb of ‘relates to’ because the requested [NAME_4] did not satisfy the first limb of ‘identifies’. There was no error of law in this approach. 100. The Appellant argued that the disputed [NAME_4] is “personal data” because (a) the staff survey reports are used for performance management and (b) the names of managers, including the Chief Inspector, are available online [27]. Thus, the Appellant’s argument was that the “relates to” limb of section 1(1) of the Data Protection Act 1998 is met because the disputed [NAME_4] is used for the Chief Inspector’s performance management; and the identification limb is met because the names of managers including the Chief Inspector are available online.

Appeal No. GIA/2301/2019 (V – CVP)

22 101. [NAME_8] summarised its response to these two arguments at [28], stating that the Appellant’s argument on the “relates to” limb is “irrelevant”; and its argument on the identification limb “is only relevant if and to the extent that a living individual can be identified from a combination of the survey report and the online [NAME_4]” (i.e. the disputed [NAME_4] must itself contribute to the identification: Commons Services Agency, at [24]); [NAME_8] went on in [29] to elaborate on its conclusion as to the identification limb, which is discussed in Ground 2 below. 102. [NAME_8] then went on at [30] to elaborate on its conclusion as to the “relates to” limb. It considered that the “ambitious argument” that the disputed [NAME_4] “relates to” the Chief Inspector within the meaning of that provision articulated in Durant does not need to be considered. The conclusion on the identification limb was sufficient to dispose of the appeal. [NAME_8] decided the Appellant’s argument on this limb was “irrelevant”. [NAME_8] did not need to decide and did not decide whether the requested [NAME_4] ‘related to’ the Chief Inspector because it decided that the requested [NAME_4] did not identify him so as to be capable of constituting personal data. 103. I am satisfied that there is no error in [NAME_8]’s approach, properly understood, and I agree with it. Its finding at [28] of the decision that it is “irrelevant” that the disputed [NAME_4] is used for performance management is no more than a thumbnail summary of its conclusion in its decision at [30] that it is not necessary to consider the “relates to” limb of section 1(1) of the Data Protection Act 1998, in view of its conclusion as to the identifiability limb. 104. I do not need to go any further in rejecting this ground of appeal but make the following further observations as they were the subject of argument. 105. Insofar as [NAME_8] had gone further, as the Appellant suggests, and (contrary to the clear wording of [30]) concluded that the Appellant’s argument was in substance irrelevant to whether the “relates to” limb is met, that conclusion may also have been available to [NAME_8] to find on the facts of this case. I do not have to reach a concluded view on this issue, but my provisional view is at least that [NAME_8] did not come to an irrational conclusion. 106. Whether the ‘relates to’ limb for [NAME_4] to become ‘personal data’ is satisfied is a question of fact to be decided in each particular case. 107. I have not reached a concluded view on whether the subjective views or opinions of other staff as to how a person performs in their role, or how their values reflect the values of an organisation, relates to that person in order to make it job-related personal data. This is a fact sensitive question but I express some doubt that it does on the facts of this case. I explain this in more detail in my closed reasons. In this case, an examination of the disputed [NAME_4] tends to suggest that it is not obviously about nor does it obviously relate to the Chief Inspector. The requested data (survey results aggregating the views or opinions of staff as to the perceived job performance or perceived values held by the senior managers) is not clearly linked to the Chief Inspector ([NAME_19], paragraph 21); it does not have biological significance to him; and it arguably does not focus on him (Durant, paragraph 28).

Appeal No. GIA/2301/2019 (V – CVP)

23 108. The Appellant’s own evidence was that “Survey respondents from the [NAME_9] answering questions about the running of the organisation use the [NAME_1] as the reference point rather than the [NAME_9].”: witness statement paragraph 32. 109. The fact that the disputed [NAME_4] is used for performance management may therefore not be relevant. Performance management can be conducted using a wide variety of [NAME_4], and some of it may be personal data but some of it may not. In the Commissioner’s submissions she gave the example of a headteacher whose performance is managed inter alia by reference to the grades achieved by pupils in his or her school. The fact that X% of students achieved an A-grade at A Level or Y% an A* grade at GCSE is clearly not personal data about that headteacher. That is not to say that the purpose for which [NAME_4] is used is not relevant to determining whether it is personal data; it is simply to say that this particular purpose is not relevant on the facts of this example. 110. The Appellant’s reliance on the Court of Appeal’s judgment in [NAME_19] may therefore not be well placed. The proper analysis of [NAME_19] is set out by the Court of Appeal in [NAME_14] paragraph 66. In [NAME_19], the requestor sought the names of certain officials. In that context, the Court of Appeal held that a person’s name is personal data, when it is available in conjunction with job-related [NAME_4]. [ADDRESS] endorsed, at paragraph 21, the Commissioner’s guidance to the effect that it is not necessary to apply the Durant test if data is obviously about an individual or is clearly linked to him; and it held that [NAME_8] had erred in applying the Durant test to [NAME_3] sought in that case because the officials’ names were obviously about them. 111. The [NAME_19] judgment is not authority for the proposition that job-related [NAME_4] is always personal data: in that case, the “personal data” was the officials’ names. It is certainly not authority for the proposition that any and all job-related [NAME_4] is personal data, without an examination of the specific [NAME_4] in issue and a consideration of the surrounding factual context. 112. Thus, as above, if job-related [NAME_4] is to be considered personal data, it must “relate to” an identified or identifiable individual on the facts, either in the sense that it is obviously about that individual or clearly linked to him, under [NAME_19] paragraph 21, or in the sense that it has biographical significance and focuses on him, under Durant paragraph 28. 113. I have not needed to reach any concluded view as to whether the survey results ‘related to’ the Chief Inspector to the extent they may have expressed an aggregated opinion or view about his job performance or his values as one of the senior managers. This is because [NAME_8] did not decide the point and therefore it is not material to this appeal. I am satisfied that [NAME_8] only decided that the requested [NAME_4], the survey results, did not satisfy the ‘identifies’ limb so as to make it personal data of the Chief [NAME_8] did not err in so finding. Therefore, [NAME_8] did not err in finding that the section 40 FOIA exemption did not apply to the survey results which had been requested. I now set out my reasons for this in relation to ground 2. Ground 2

Appeal No. GIA/2301/2019 (V – CVP)

24 114. To establish that the section 40(2) FOIA exemption is engaged, the Appellant would also have to succeed in its second ground of appeal that the requested [NAME_4] identifies the Chief Inspector of [NAME_9] and [NAME_8] erred in finding it did not do so. I reject this ground and find that [NAME_8] did not err in law in making its decision. 115. [NAME_8]’s essential reason for concluding that section 40(2) FOIA is not engaged is that the disputed [NAME_4] cannot be used to identify the [NAME_9] Chief Inspector. It is therefore convenient to consider the Appellant’s complaint in this regard first. 116. In its Grounds of Appeal, the Appellant complains that it is in fact possible to identify the [NAME_9] Chief Inspector by using the disputed [NAME_4] together with other [NAME_4] in the public domain. 117. In response to this ground and having heard further submissions, I agree with the analysis already set out by the [NAME_23] Judge Wright in refusing permission to appeal on the papers, namely that this argument is “no more than an attempt to have the Upper Tribunal reassess the factual merits of the case, which absent a pure irrationality challenge to that assessment (which is not made), is not an error of law ground”. 118. On the facts, when one examines the disputed [NAME_4] the survey answers do not relate to and identify only the one specific manager (ie the Chief Inspector) and even external [NAME_4], such as the name of the Chief Inspector, when combined with the requested [NAME_4] does not assist in narrowing down the data to identify the Chief Inspector or any specific individual. The Staff Survey questions ask about [NAME_1] managers (or [NAME_9] managers) generally, not about any specific person or manager such as the Chief Inspector. 119. Although I accept that the survey results are labelled [NAME_9], the questions, and thus the answers, mostly refer to [NAME_1] managers. Further, even if the answers could be accepted to refer to [NAME_9] managers rather than [NAME_1] managers generally, it is accepted by the Appellant that there were around 60 staff in the [NAME_9], at the relevant time and there would have been several layers of management and multiple managers. Therefore, it is difficult to see that [NAME_8] has erred in concluding that the requested survey answers do not narrow the pool of managers referred to sufficiently to identify the Chief Inspector personally, even if coupled with other externally available [NAME_4]. 120. As already identified, there is nothing wrong, let alone irrational, in [NAME_8]’s conclusion on the facts of this case. The Appellant had not shown – and cannot show – any way in which one could in practice use the disputed [NAME_4] to identify the [NAME_9] Chief Inspector, either on its own or together with other [NAME_4]. 121. There is nothing in “those data”, for the purposes of section 1(1) of the Data Protection Act 1998, that will enable or contribute to his identification: Commons Service Agency, paragraph 24. Indeed, it was clearly the objective of those who prepared the disputed [NAME_4] that it should be fully anonymised in this fashion: see above, regarding the broader policy for conducting the [NAME_10].

Appeal No. GIA/2301/2019 (V – CVP)

25 122. I had granted permission to appeal on this Ground with reluctance not on the basis that the disputed [NAME_4] could be used to identify the [NAME_9] Chief Inspector, but on the basis there may be “an absence of authority on the question of whether [NAME_4] has to relate to and identify only one person in order to identify that person or whether it can relate to and identify that person and a small pool of other people thus constituting personal [NAME_4] even where that data cannot be analysed so that it solely identifies and relates to a single person” (permission decision [27]). 123. However, I am satisfied as the Commissioner argues that it is an essential requirement, indeed the touchstone, of “personal data” that it is ‘personal’ to an individual. 124. Thus: (i). Directive 95/46 focuses very clearly on “an identified or identifiable person”, singular: Article 2(a) and Recital (26). Similarly, section 1(1) of the Data Protection Act 1998 is explicit that the data must relate to “a living individual”, singular. While the language used is different, the use of the singular is the same in both instruments; (ii) it is that single, living individual who should be identifiable. Article 2(a) of Directive 95/46 refers to “an identified or identifiable person” where “an identifiable person is one who can be identified…”. Similarly, Section 1(1) of the Data Protection Act 1998 is explicit that the data must relate to a living individual”, singular, “who can be identified…”; (iii) the data must “relate to” that single living individual. Hence one must consider whether the data are obviously about the individual or are clearly linked to his activities, or if they are not clearly so one must consider whether the data have biological significance or have that individual as their focus: Durant, [28]; [NAME_19], [2]1. (iv) it is permissible to anonymise data, so that the data of individuals can no longer be identified: Recital (26) of the Directive; Commons Services Agency, paragraphs 24-27. Such anonymisation can be done inter alia by aggregating the underlying [NAME_4] to turn it into statistics: R (Department of Health) v [NAME_17], paragraphs 51-55.

125. So, with respect to my observations in granting permission, the first is correct subject to qualification. The particular data does have to relate to a single individual, and it must be possible to identify that individual; however, it does not have to be [NAME_3] itself that identifies that individual, as identification could be done either by using [NAME_3] on its own, or by using other [NAME_4] together with it: section 1(1) of the Data Protection Act 1998. 126. It will be a matter of fact in each case whether particular [NAME_4] relates to an individual, and whether that individual can (on that [NAME_4] alone, or together with other [NAME_4]) be identified. Where [NAME_4] relates a group of individuals, such as the “small pool” that I envisaged, the Commissioner explained in her Code of Practice on Anonymisation at p.26-27 that: “[NAME_4] that enables a group of people to be identified, but not any particular individual within the group is not personal data. Conversely, [NAME_4] that does enable particular individuals within a group – or all the members of a group – to be identified will be personal data in respect of all the individuals who can be identified.”

Appeal No. GIA/2301/2019 (V – CVP)

26

127. So [NAME_3] about the small pool is capable of being “personal data” to the extent that it is possible to identify one or more individuals within the pool, either from that [NAME_4] alone or by using that [NAME_4] together with other [NAME_4]. To the extent that other individuals within the pool cannot be identified, [NAME_3] that relates to them cannot be personal data. 128. I agree with the example relied on by [NAME_7], if [NAME_4] relates to persons living on a particular street then it might be capable of being the “personal data” of some of those people, as some of them might be identifiable from using [NAME_3] together with entries on the Land Registry or the Electoral Roll; equally some of it might not be personal data, if it relates to residents who are children, student tenants who are registered to vote elsewhere, or tenants who have not consented to their names being published on the public Electoral Roll. 129. Where it is possible to identify one or more members of a group to which [NAME_4] relates, then those parts of [NAME_3] that “relate to” those identified individuals will be “personal data”. Where it is not possible to disentangle [NAME_3] and relate it to those individuals it will not be personal data. I agree with another example of [NAME_7]. If [NAME_3] about the persons living on the particular street were to be that payments totalling £X have been made to persons living on that street, it would not be possible to say that a payment had been made to any particular individual, or to any particular household, at all or in any particular amount. Even though certain individuals might be identified as living on the street, [NAME_3] does not “relate to” those individuals. 130. Despite the skill with which he presented the Appellant’s case, I did not find [NAME_6]’s example of the [NAME_26] helpful. If it is known that each member of a pool has the diagnosis and any specific individual can be identified as being within that pool from other available data then of course they will be identified and the data will relate to them making it personal data. 131. I am satisfied that the second of my observations in granting permission to appeal is therefore not correct, insofar as it envisages [NAME_4] being “personal data” in circumstances where no individual is identified or identifiable, and/or in circumstances where [NAME_3] in question does not relate to identified or identifiable individuals. That approach is not compatible with the legislative framework, or with the Directive which the legislation is intended to implement, or with the body of caselaw interpreting that regime. It would moreover be surprising in its implications. Large swathes of published data, published by a whole range of bodies and organisations, which had been considered to have been adequately anonymised as a result of being aggregated, should be considered to be in fact personal data and would potentially have been unlawfully published. 132. Therefore, I am satisfied that there was no error in [NAME_8]’s approach, either in law or in fact in finding that the requested [NAME_4] did not constitute personal data. [NAME_8] concluded that it was not possible, using the disputed [NAME_4] alone or in conjunction with other [NAME_4], to identify the [NAME_9] Chief Inspector, and that conclusion was unassailable.

Appeal No. GIA/2301/2019 (V – CVP)

27 133. That, together with the reasons contained in my closed decision, is sufficient to dispose of the first two grounds of appeal on section 40(2) of FOIA. The disputed [NAME_4] does not comprise “personal data” and [NAME_8] did not err in finding that the exemption did not apply. Ground 4 – section 36 FOIA – prejudice to the effective conduct of public affairs 134. I am however satisfied that the Appellant’s fourth ground of appeal is established – that [NAME_8] erred in law when deciding that the section 36 exemption did not apply to the requested [NAME_4]. This is for the reasons submitted by [NAME_6] as set out above, with which I agree. 135. I am satisfied that [NAME_8] failed to take account of and/or give appropriate weight to the relevant evidence of [NAME_12] as to the impact of disclosure of the requested reports and failed to give sufficient reasons for rejecting her evidence. 136. [NAME_12] set out her reasons at some length in open and closed within her witness statement at [36]-[45] for believing that section 36 of FOIA applied and that disclosure of the requested [NAME_4] would prejudice the effective conduct of public affairs. 137. The kernel of [NAME_8]’s reasons for rejecting [NAME_12]’s evidence is set out at [22] of the decision: ‘We find no persuasive evidence in [NAME_12]’s statement pointing to real risk of participation in the survey diminishing as a consequence of survey results being released into the public domain. It is common ground that those who participate in surveys do so anonymously and, where very small units are involved, analysis of results by group is not undertaken anyway. We have been shown no convincing evidence to substantiate the theory that participation statistics are affected by any release, or anticipated release of [NAME_10] survey results, much less any evidence pointing to that being likely in the case of [NAME_9]’. [emphasis added] 138. I begin by fully accepting that a degree of circumspection about reliance on a ‘chilling effect’ may be justified where there is simply an assertion that that is what will occur. At paragraph 21 of the ICO’s submissions, the ICO notes that in Davies v IC [2019] UKUT 185 (AAC), the Tribunal noted that “assertions of a ‘chilling effect’…are to be treated with some caution.” The Appellant accepted and positively submitted as much before me at the oral permission hearing in this case, as I record at paragraph 39 of my determination granting permission. A degree of circumspection or caution does not however mean (and is not suggested in any of the authorities to mean) that this threshold can never be discharged (particularly given the low degree of likelihood required), nor that it cannot properly be discharged on the basis of evidence in writing setting out the basis of the view taken that such a chilling effect will occur, as occurred in this case. 139. I also accept that the Upper Tribunal should be slow to interfere with the fact finding of the first-tier tribunal and it should show restraint in assessing whether [NAME_8] has taken account of evidence and given sufficient reasons. The extent of [NAME_8]’s duty to give adequate reasons is set out in South Bucks District Council v [NAME_22] (No 2) [2004] UKHL 33: and DH v IC and Bolton Council [2016] UKUT 0139 (AAC), [34].

Appeal No. GIA/2301/2019 (V – CVP)

28 140. However, while [NAME_8] suggests it has considered all [NAME_12]’s evidence at [19], [NAME_8]’s decision states at [22] that there is no evidence in this case that participation statistics in the case of [NAME_9] would likely be affected by any release of the [NAME_10] survey results. 141. With the respect to the otherwise careful reasoning of [NAME_8], this conclusion at [22] overlooks the detailed evidence of [NAME_12] at in particular [36]-[45] of her witness statement (particularly closed passages at [38] and [42] that I address in the closed reasons). [NAME_12] was stated to be an experienced and senior civil servant (the [NAME_11]’s Chief Economist). In her statement [NAME_12] gave examples of teams within the [NAME_10] who do not complete the survey because of FOIA concerns: see [36(v)] but particularly the effects within the [NAME_9]: see closed statement at [38] and [42]. Therefore, [NAME_12] gave specific evidence in relation to the [NAME_9] in this regard contrary to the suggestion by [NAME_8] at [22] of its decision as underlined. 142. Insofar as, contrary to the above, the evidence of [NAME_12] was taken into account by [NAME_8], I am not satisfied it was taken into account or given proper weight in determining whether prejudice would be caused by the release of the requested reports. Another way of formulating this error of law is that I am not satisfied that [NAME_8] gave sufficient reasons at [22] for rejecting [NAME_12]’s evidence. There was specific and relevant evidence in support of the Appellant’s case that [NAME_12] believed there were possible chilling effects of disclosure on the participation by the [NAME_9]. I am satisfied that [NAME_8] did not demonstrate that it took into account this specific evidence or, if it did so, gave sufficient reasons for rejecting it. 143. The Commissioner has taken issue with the suggestion that the evidence of [NAME_12] was not challenged on the basis of what was said by it in its submissions of 28 May 2019. It is right to say that the evidence of [NAME_12] was challenged in the submissions of the Commissioner dated 28 May 2019 which were before [NAME_8] even though there was no oral evidence or cross examination of her. 144. One of the points taken by the Commissioner in the May 2019 submissions is an apparent inconsistency between the two important paragraphs of [NAME_12]’s closed evidence relating to the effect on [NAME_9] at [38] and [42] of that statement (see para.6.b of the submissions). There was also a submission on behalf of the Commissioner that the evidence of [NAME_12] in this regard was implausible. However, these suggestions were not put to her as no party to the proceedings required an oral hearing before [NAME_8]. Neither did [NAME_8] demonstrate that it expressly relied on these submissions to reject this specific evidence. 145. I find that this is a material error of law on the part of [NAME_8]. The First Respondent did address and dispute [NAME_12]’s evidence at [38] and [42] on the effect on [NAME_9] in its submissions dated 28 May 2019. However, [NAME_8] failed explicitly to address [NAME_12]’s specific evidence and the Commissioner’s submissions in reply. Rather it, incorrectly, found at [22] of the decision (as underlined) that there was no evidence on the issue. I address this further in closed. 146. Whether or not [NAME_12]’s evidence on this particular point or generally should be accepted by [NAME_8] will be for a further constitution of [NAME_8] to decide at a remitted hearing on whether the section 36(2) exemption applies. The weight which

Appeal No. GIA/2301/2019 (V – CVP)

29 should be attached to this evidence is in dispute. It is very much a fact-finding exercise for a specialist fact finding tribunal to determine. I am not satisfied that it would be just or fair for me to re-make the decision in the circumstances where I have not heard from the witness or heard submissions on the facts as to the weight which should be attached to her evidence. Conclusion and Disposal 147.

For the reasons set out above, I reject the Appellant’s first and second grounds of appeal. I am satisfied that [NAME_8] did not err in concluding that the personal data exemption under section 40 FOIA did not apply to the requested [NAME_4]. However, I am satisfied that [NAME_8] erred in law in making its decision that the section 36 exemption did not apply. I set aside [NAME_8]’s decision in that regard and remit the issue of whether the section 36 exemption applies to be reconsidered by a freshly constituted [NAME_8]. [NAME_8] should make its own directions as to the form of the fresh hearing, the admission of evidence and other consequential matters.

Rupert Jones

Judge of the Upper Tribunal

Signed on the original on 10 May 2021