Upper Tribunal Allows Appeal on FOIA Section 40(2) Reasoning

OUTCOME: Allowed

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 1 IN THE UPPER TRIBUNAL Appeal No: GIA/1847/2018

ADMINISTRATIVE APPEALS CHAMBER

Before: Upper Tribunal Judge Wright

DECISION

The Upper Tribunal allows the appeal of the appellant.

The decision of the First-tier Tribunal dated 8 May 2018 under reference EA/2017/0220 involved an error on a material point of law and is set aside.

The Upper Tribunal is not able to re-decide the appeal. It therefore refers the appeal to be decided entirely afresh by a completely differently constituted First-tier Tribunal and in accordance with the Directions set out below.

This decision is made under section 12(1) and 12(2)(a) and 12(2)(b)(i) of the Tribunals, Courts and Enforcement Act 2007.

DIRECTIONS

Subject to any later Directions by a Judge of the First-tier Tribunal, the Upper Tribunal directs as follows:

(1) There shall be an oral hearing before the First-tier Tribunal of the appeal. The appellant will be entitled to attend that hearing as will the Information Commissioner and Stratford-on-Avon District Council.

(2) The First-tier Tribunal should have regard to the points made below.

REASONS FOR DECISION

1. This is an appeal by [NAME_1] against the First-tier Tribunal’s decision of 8 May 2018 (“the tribunal”). That tribunal was concerned with a request for information that [NAME_1] had made to Stratford-on-Avon District Council (“the Council”) on 23 January 2017.

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 2 2. To understand that request it is necessary to know that [NAME_1] had previously made a complaint of misconduct against a local authority councillor of the Council in relation to her role in the handling of a planning matter. [NAME_1] had himself been a district councillor on the Council at an earlier point in time. His complaint against the councillor was not upheld. The request of 23 January 2017 under the Freedom of Information Act 2000 (“FOIA”) was for “..all [correspondence] relating to my complaint”. The Council provided [NAME_1] with all the information he had requested except for the advice provided to the Council’s ‘Monitoring Officer’ by an “Independent Person” appointed for that purpose under section 28(7) of the Localism Act 2011. Materially, that advice included the comments of the councillor against whom the complaint had been made on the complaint.

3. The Council refused to provide [NAME_1] with the Independent Person’s advice. It relied on sections 36(2)(b) and (c) and 40(2) of FOIA. Under section 36 of FOIA, the Council took account of the “qualified person’s opinion” provided by its “Head of Governance and Democracy and Monitoring Officer”. [NAME_1] complained to the Information Commissioner (“the ICO”) against the Council’s refusal to provide him with this information but, in a Decision Notice dated 4 September 2017, she upheld the Council’s reliance on section 36(2)(b)(i) and (2)(c) of FOIA. In these circumstances the ICO did not go on to consider section 40 of FOIA as the section 36 exemptions were sufficient to uphold the Council’s decision and dismiss [NAME_1]’s complaint.

4. As the tribunal noted, the ICO was satisfied that both of the section 36 exemptions relied on by the Council were engaged in this case. The ICO said the following on this aspect of the complaint before her (at paragraph 34 of the Decision Notice):

“…With regard to s. 36(2)(b)(i), it is reasonable to consider that IPs would be constrained by the knowledge that their views in respect of

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 3 allegations could be made public, which in turn would be likely to prejudice the free and frank provision of advice. With regard to s. 36 (2)(c), this may refer to an adverse effect on a public authority’s ability to offer an effective public service or to meet its wider objectives or purpose. In the Council’s view, it is reasonable to consider that the disclosure of the [NAME_4]’s views may lead to a number of outcomes, including IPs being less willing to engage frankly with the process, and including possible prejudice in the event of a further complaint being made to the LGO”.

5. Turning then to public interest balance (section 36 only being a qualified exemption), the ICO had concluded that in the circumstances of this case it lay in maintaining the section 36 exemptions. In so concluding the ICO gave weight to the views of the Qualified Person that disclosure would inhibit the future provision of advice to the Council, which could prejudice the effective conduct of public affairs. The ICO also relied on the fact that the IPs themselves had objected to disclosure of the advice and concluded that they had a reasonable expectation that their advice would not be disclosed under the terms of their appointment. She concluded that the public interest in conducting thorough investigations, including the [NAME_4]’s contribution, was high, whereas the public interest in the particular information requested in this case was not significant, despite the local interest in the underlying planning issue in respect of which the [NAME_1]’s complaint had arisen.

6. I consider it important to observe at this stage that not only did the ICO not consider section 40(2) of FOIA but she also did not give any express consideration to whether the councillor against whom the complaint had been made had a legitimate expectation that her comments to the [NAME_4], and set out in the [NAME_4]’s advice, would not be disclosed

7. [NAME_1] appealed against the ICO’s decision notice. In dismissing his appeal on the papers (i.e. without a hearing), the tribunal said the following by way of conclusion.

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 4 “25. The Tribunal regrets that it has not received the benefit of the Information Commissioner’s views as to the application of s. 40 (2) FOIA in this case. However, we concluded that it would be fair and just to consider its application without reverting to the parties for additional submissions because that exemption was clearly “in play” in the appeal, having been relied on by the Council initially and raised again in its submissions to the Tribunal. We concluded that in these circumstances, the other parties should be viewed as having chosen not to comment on that claimed exemption when given the opportunity. We also noted that the Appellant’s pleaded case had only ever been directed towards the public interest test, which is not relevant to the application of s. 40(2) FOIA, and so it seemed unlikely that he would now wish to comment on the engagement of an unqualified exemption.

26. In considering whether there was a real and significant risk that an inhibition of the [NAME_4]’s views would result from disclosure, the Decision Notice (paragraphs 26 and 43) took into account the Council’s submission that, although the names of the IPs are in the public domain, their views are not routinely published. At paragraph 51, the Decision Notice records that the IPs had themselves objected to disclosure of their views. Whilst it was submitted by the Council that the IPs had a reasonable expectation that their views would be treated as confidential, we note that the IPs would have been unaware, at the time they provided their advice to the Monitoring Officer, whether the complaint would proceed to a hearing or not. It is clear from the Council’s letter to the Information Commissioner (page 98, open bundle) that their views would be made public in the context of a formal panel hearing.

27. The Decision Notice thus attributed considerable weight to the argument that the IPs would be inhibited in giving robust advice if they knew that their views were to be made public, and that this would in turn prejudice the effective conduct of public affairs. However, in our view, the Decision Notice failed when assessing the public interest balance to take into account the fact that the [NAME_4]’s views would in any event have become public if a hearing had been directed.

28. We consider that the failure to consider this point was a material one in weighing the undoubted public interest in seeing the Council’s procedures being conducted in accordance with its published policies as against the stated preferences of the IPs. The fact that the Council’s formal processes envisage disclosure of the [NAME_4]’s advice in certain circumstances lends weight, in our view, to the Appellant’s arguments in favour of transparency. Weighing these factors into the balance, we would have reached a different conclusion on the public interest test to the one reached in the Decision Notice.

29. However, we agree with the Council that details of unsubstantiated complaints against councillors ought not generally to be disclosed to the world at large under the provisions of FOIA. We consider that the proper approach to such information is to consider the rights of the councillor concerned as a data subject. We are satisfied that the Council could not disclose the councillor’s personal data in this case (consisting of their name and opinions expressed about them) without

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 5 breaching the data protection principles and that s. 40 (2) FOIA is therefore engaged.

30. We are not satisfied that s. 40 (2) FOIA may also be applied to the personal data of the [NAME_4]’s, as their names are already in the public domain, they occupy senior public roles, and their views may be disclosed if there is a public hearing.

31. For the above reasons, whilst we find that the Decision Notice was erroneous, we do not direct the disclosure of the withheld information because we conclude that it is exempt from the duty of disclosure under s. 40 (2) FOIA”.

8. After a hearing, I gave [NAME_1] permission to appeal against the tribunal’s decision. I said that it was arguable the tribunal had erred in law in failing to make sufficient findings of fact and in failing to give adequate reasons to explain why it had concluded on the evidence that the information in respect of the councillor was exempt from disclosure under section 40(2) of FOIA. I unpacked this further as follows in my grant of permission to appeal.

“As the First-tier Tribunal noted, it had not had the benefit of the Information Commissioner’s view on section 40(2). Moreover, it found in favour of [NAME_1] on section 36 and in respect of section 40(2) as it applied to the two IPs. In effect, therefore, the sole basis for the tribunal finding that the information sought was not disclosable was because section 40(2) did apply to the councillor. The only argument made to the First-tier Tribunal for section 40(2) applying to the councillor was that set out in Stratford-on-Avon’s submission of 19 December 2017. Neither that document nor the First- tier Tribunal’s decision identifies which ‘data protection principle’ applied. The second respondent’s letter of 17 February 2017 did, however, refer to disclosure being contrary to the first data protection principle (page 42), as set out in paragraph 1 in Schedule 1 to the Data Protection Act 1998, but did not say which condition in Schedule 2 to the Data Protection Act 1998 was also in play. The reference to the councillor’s “legitimate expectation” in the second respondent’s submission of 19 December 2017 indicates it may have been condition 6 in Schedule 2.

None of these legislative steps, however, is worked through in the tribunal’s decision.

Arguably more importantly, it is arguable that the tribunal’s reasoning and fact-finding failed to identify and explain the evidential basis for the councillor’s ‘legitimate expectation’ that, in the context of the investigations of complaints made against her in her role as a councillor, her personal information would be treated confidentially. The documents at pages 107 to 140 of the First-tier Tribunal’s open bundle may arguably not identify the basis for this legitimate

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 6 expectation. See, for example, “Will your complaint be investigated” section of the document at pages 124-126 of that bundle. It may be noteworthy that the only reference to confidentiality is seemingly in respect of the report on a complaint which has been subject of a formal investigation (see page 126), but the confidence spoken of there attaches only to the draft report sent to a complainant and the councillor who is the subject of the complaint. Moreover, what is then said in section 6 of the same document, on page 127 of the same bundle, about ‘sensitive evidence’ may not support there being a legitimate expectation about confidentiality always attaching to a councillor’s data in respect of a complaint about his or her discharge of his or her functions as a councillor. The perspectives of the individuals set out on pages 130, 131 and 133-134 of the same bundle may also be relevant to the holding of the legitimate expectation on which the second respondent relied.”

9. I have since had the benefit of a substantive written response to the appeal from the ICO, which does not support it, a short note from the second respondent allying itself with the ICO’s response and a very short reply to those responses from [NAME_1] as follows.

“I would like to reiterate that this has never been about individual personalities, but the transparency and accountability of procedures involving elected members in Local Government.

The principle of a local authority’s accountability to the public, to demonstrate that its decisions were reached in an open, fair and reasonable manner, is essential for an authority to maintain its integrity and ensure the confidence of the community in them.”

10. In effect, therefore, the defence of the tribunal’s decision has fallen to the ICO. She argues, in essence, that although the tribunal’s reasoning was shortly expressed it accurately stated the relevant law, it had come to a fully defensible conclusion on that law and its reasoning was sufficiently full.

11. As the concern on this appeal relates to the adequacy of the tribunal’s reasoning about why the exemption in section 40(2) of FOI applied to the information sought by [NAME_1], I need only set out the law in and relevant to section 40 of FOIA. Insofar as is relevant, section 40 provided at the material time as follows.

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 7 “40 Personal information.

(1)Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2)Any information to which a request for information relates is also exempt information if— (a)it constitutes personal data which do not fall within subsection (1), and (b)either the first or the second condition below is satisfied.

(3)The first condition is—

(a)in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene—

(i)any of the data protection principles, ….”

The Data Protection Act 1998 has since been overset by the Data Protection Act 2018 but it was the former that was in place at the time of [NAME_1]’ request. By section 1(1) of the Data Protection Act 1998 (“the DPA”) “personal data” is defined as:

“data which relate to a living individual who can be identified—

(a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual”

Section 4 of the DPA addressed ‘the data protection principles’ and provided that:

“4.-(1)References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

(2)Those principles are to be interpreted in accordance with Part II of Schedule 1.

(3)Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply.

(4)Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.”

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 8

The first data protection principle under the DPA was found in paragraph 1 in Schedule 1 to that Act and provided as follows:

“1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a)at least one of the conditions in Schedule 2 is met, and

(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

(It has not been argued that ‘sensitive personal data’ was in issue in this case.)

Lastly in terms of the legislative jigsaw, one of the ‘Schedule 2 conditions’ required under paragraph 1(a) in Schedule 1 to the DPA (and that applicable in this case) was in paragraph 6(1) of Schedule 2 to the DPA and provided:

“6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”

12. I accept that the first two concerns I raised when giving permission to appeal (which data protection principle applied and the lack of identification by the tribunal of the applicable condition in Schedule 6 to the DPA) did not give rise to any material error of law on the part of the tribunal. In essence this is because I agree with the ICO’s argument that the tribunal’s reference in paragraph 18 of its decision to “fair and lawful processing” was sufficient. I set out that paragraph 18 in full and in context of its surrounding paragraphs.

“14. The Appellant’s Notice of Appeal dated 29 September 2017 relied on grounds related to principles of transparency, accountability and public confidence in the conduct of local government. We have interpreted these grounds as not including a challenge to the engagement of s. 36 FOIA in relation to the information requested, but rather to consist of a challenge to the correctness of the Information Commissioner’s conclusion that the public interest balancing exercise favoured withholding the requested information.

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 9 15. The Information Commissioner’s Response dated 17 November 2017 maintained the analysis as set out in the Decision Notice and applied for the Notice of Appeal to be struck out as having no reasonable prospect of success because the grounds of appeal alleged no error of law. That application was refused by the Chamber’s Registrar on 6 December 2017, who directed that the appeal should be determined by a Tribunal panel.

16. The Appellant’s Reply dated 3 December 2017 repeated his concerns about the integrity of the Council’s procedures and the desirability of full scrutiny by residents and rate-payers.

17. The Council’s Response dated 19 December 2017 referred to the statutory regime for the appointment of IPs and the Council’s internal procedures and policies. We note that, if the Monitoring Officer had had decided that a formal investigation should have been undertaken in this case, a public hearing would have ensued (see “Protocol Relating to Independent Persons”, page 121 open hearing bundle) at which the IPs would have been expected to give their views orally or in writing and that these would be minuted.

18. The Council’s Response made clear that, in addition to adopting the Information Commissioner’s submissions on s. 36 FOIA, it continued to rely on s. 40 (2) FOIA. This was because the withheld information contains the personal data of the councillor who was the subject of the complaint, and also the personal data of the [NAME_4] who provided the advice to the Monitoring Officer. The Council submitted that the councillor against whom the complaint had been made and the [NAME_4] both had a legitimate expectation that the Council, as the data controller, would treat the withheld information as confidential in circumstances where the complaint against the councillor had been found to be unsubstantiated. It submitted that the disclosure of the requested information would have breached the Data Protection Act’s requirement for fair and lawful processing in these circumstances.

19. The parties and the Tribunal agreed that this matter was suitable for determination on the papers in accordance with rule 32 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, as amended. The Tribunal considered an agreed open bundle of evidence comprising 140 pages, including submissions made by both parties, for which we were grateful. We also considered a small closed bundle, comprising the withheld information only.” (I have underlined the relevant part of paragraph 18 about ‘fair and lawful’ processing.)

13. However, despite the ICO’s argument, I do not consider the tribunal’s reasoning shows it adequately explored and addressed the legitimate expectation of the councillor on which the section 40(2) exception was based by the Council. It was effectively this basis alone on which the tribunal upheld the decision that the information was not to be provided to [NAME_1]. The ICO had not entered the section 40 terrain

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 10 at all or addressed the basis for the councillor having a legitimate expectation. Moreover, the tribunal had found against the ICO and the Council on the applicability of the section 36 exemption and on section 40(2) applying to the IPs. Therefore, the sole basis for its decision that the [NAME_4]’s advice could not be provided to [NAME_1] was because the section 40(2) exemption applied to it and that was only because disclosure of the information provided by the councillor in that advice would not be “fair and lawful”.

14. What, however, did the tribunal make of the asserted legitimate expectation held by the councillor, given its sole and central importance? The tribunal set out the Council’s case on this at paragraph 18 of its decision. That was, as there set out, as follows “the withheld information contains the personal data of the councillor who was the subject of the complaint….. The Council submitted that the councillor against whom the complaint had been made …..had a legitimate expectation that the Council, as the data controller, would treat the withheld information as confidential in circumstances where the complaint against the councillor had been found to be unsubstantiated. However, that statement of the Council’s case does not explain the basis on which the councillor would have had such an expectation and nor is such a basis obviously settled by the evidence before the tribunal (see my comments in the final paragraph of my grant of permission to appeal set out in paragraph eight above). Furthermore, the tribunal’s conclusion on this part of the case before it, which is confined to a few lines in paragraph 29 of the tribunal’s decision, does not address this either.

15. It is no answer, or at least no complete answer, to an adequacy of reasons challenge to say, as the ICO argues, that the tribunal could have decided that the councillor had a legitimate expectation. In one sense it did that because it agreed with the Council’s case before it. But that leaves unexplained the deficit, as I see it, in the Council’s case, namely the evidential basis for the councillor’s legitimate expectation. I do not consider that reference to what the Council said in this case to the

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 11 tribunal on this issue (at page 32 of the First-tier Tribunal’s open appeal bundle) meets this deficit as what is there set out is simply a longer form of asserting that the councillor had a legitimate expectation, it does not identify the basis on which that expectation would have been held.

16. Nor do I consider that the [NAME_1]’s legally imprecise grounds of appeal to the tribunal removed this point, or section 40(2), as issues the tribunal needed to address in deciding his appeal. The tribunal (rightly) went on to decide the section 40(2) exemption, having found in [NAME_1]’ favour on section 36, because section 40(2) remained in issue before it and went to whether the information could be disclosed. However, bearing in mind the First-tier Tribunal’s inquisitorial function in information rights appeals, [NAME_1]’s reliance on principles of transparency, accountability and public confidence in the conduct of local government on their face were in my judgment just as much raising issues on the appeal about the ‘fair and lawful’ processing of the councillor’s data in her role on the complaint against her as a councillor as they were the public interest balance under section 36 of FOIA. Moreover, whether the councillor in fact had a legitimate expectation that her comments to the [NAME_4] on a complaint which was then found to be unsubstantiated would not be disclosed seems, in my judgment, to go to the issues of ‘fair and lawful’ processing in the ‘transparency of local government’ context advanced by [NAME_1] in his grounds of appeal.

17. This is not, I wish to emphasise, a conclusion that the tribunal was wrong in the conclusion to which it came. Plainly it could have, and could still, come to the decision that disclosing the councillor’s comments to the [NAME_4] in the latter’s advice on the complaint was covered by the exemption in section 40(2) of FOIA (because to do so would not be “fair and lawful”). All I am deciding is that the tribunal’s fact-finding and reasoning was not sufficient to explain its decision that the section 40(2) exemption was met in circumstances where the basis for the

[NAME_1] –v- [NAME_2] [2019] UKUT 317 ([NAME_3])

GIA/1847/2018 12 asserted legitimate expectation of the councillor was not necessarily apparent from the evidence before the tribunal.

18.

For the reasons given above, the tribunal’s decision dated 8 May 2018 must be set aside. The Upper Tribunal is not in a position to re-decide the first instance appeal. The appeal will have to be re-decided completely afresh by an entirely differently constituted First-tier Tribunal of the General Regulatory Chamber (Information Rights), at an oral hearing. [NAME_1] attended an oral hearing of his application for permission to appeal before the Upper Tribunal and should make all best efforts to attend the hearing before the new First-tier Tribunal.

19. [NAME_1]’s success on this appeal to the Upper Tribunal on error of law says nothing one way or the other about whether his appeal will succeed on the facts before the First-tier Tribunal, as that will be for that tribunal to assess in accordance with the law and once it has properly considered all the relevant evidence.

Signed (on the original) Stewart Wright Judge of the Upper Tribunal

Dated 17th October 2019