Upper Tribunal Allows Appeal on Personal Data Disclosure

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 1 IN THE UPPER TRIBUNAL Appeal No. [NAME]/2288/2018 ADMINISTRATIVE APPEALS CHAMBER

Before: Upper Tribunal Judge K [NAME] QC

The decision of the Upper Tribunal is to allow the appeal. The decision of the First- tier Tribunal made on 24th May 2018 under number EA/2017/0197 was made in error of law. Under section 12(2)(a) and (b)(i) of the Tribunals, Courts and Enforcement Act 2007 I set that decision aside and remit the case to a differently constituted tribunal which will consider afresh the issues raised in this appeal.

REASONS FOR DECISION

1. This appeal arises from a request made by [NAME] to the Devon Partnership NHS Trust (‘the Trust’) under the Freedom of Information Act 2000 (‘FOIA’) for information about [NAME] employed by the Trust. He said: “I would like to know the dates that they have undertook training for doing assessments under the Care Act 2014 section 9 and also the training they have received for implementation of Care Act 2014 and any qualifications so achieved.” 2. The Trust refused the request, relying on section 40(2) of FOIA. The Trust’s position, as subsequently explained to the [NAME] and which was put before the FTT, was that it considered the level of detail sought would be overly intrusive, that neither individual was a senior manager nor holding a position within the Trust that warranted a greater level of accountability, and that professional registration could be verified by other means through professional bodies. The Trust stated that FOIA requests had been used to target individual members of staff by individuals dissatisfied with the care received and so would normally refuse that level of detail sought, although each case was considered on its merits.

3. The [NAME] agreed that that exemption applied. [NAME] appealed to the First-tier Tribunal (‘FTT’) which, in a decision dated 24th May 2018, decided that the information was not exempt.

4. I gave the [NAME] permission to appeal on two grounds. First, whether the FTT should have taken into account the possibility that, if disclosed, the information could come into the hands of people other than [NAME] and the possible consequences for the individual employees should that take place. Second, whether the FTT’s approach to the risks to the individuals was irrational.

5. I gave directions for [NAME] to provide a written response to the appeal and for a reply by the Commissioner, with which both parties complied. [NAME] sought to make further submissions in response to the Commissioner. By a separate ruling dated 10th January I refused to permit him to make further submissions, for reasons which I explained there. [NAME] has continued to communicate with the Upper Tribunal to express his dissatisfaction with the position, but he has put forward nothing which requires me to revisit that ruling. Nonetheless, when

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 2 considering and deciding this appeal I was alert to the possibility of allowing [NAME] to address any new point which arose and which he had not already been able to address. As it turned out, there was no need to do so. 6. [NAME] requested that I determine the appeal on the papers, without an oral hearing. He explained his difficulties in participating as a result of his limited financial resources and health issues. The Commissioner requested an oral hearing due to the “complexity of the issues in this case” and argued that holding a hearing in the absence of [NAME], but taking into account his written submissions, would not disadvantage him. I decided to determine the appeal without an oral hearing, for reasons explained in the Ruling of 10th January: in essence, because I did not consider that the issues were of a complexity that called for an oral hearing, the parties had both provided full written submissions, and in the particular circumstances of this case it would not be fair to do so.

Legislation and case law 7. FOIA provides for a number of exemptions from the general right to information in section 1(1) FOIA. This case is concerned with the exemption in section 40(2). The effect of this subsection, along with section 40(3) and the relevant provisions of the Data Protection Act 1998 (or, since 24th May 2018, the Data Protection Act 2018 but which makes no material difference for present purposes), is that information which is the personal data of a third party is exempt from disclosure if disclosure would not be compatible with the data protection principles in the Data Protection Act (‘DPA’). It is common ground in this appeal that the information requested is “personal data”.

8. The first data protection principle provides that “personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless (a) at least one of the conditions in Schedule 2 is met”. The condition in question in this case is condition 6(1) which provides “The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.” 9. Whether this condition is met involves consideration of three questions (see Lady Hale DP in South Lanarkshire Council v [NAME] [2013] UKSC 55; [2013] 1 WLR 2421 at [18]): (i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? 10. In Goldsmith International Business [COMPANY] v [NAME] and the Home Office [2014] UKUT 563 (AAC) Upper Tribunal Judge Wikeley set out eight

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 3 propositions derived from case law as to the approach to answering the above questions.

The [NAME]’s decision 11. The Commissioner decided that disclosure of the information would not be fair. Taking into account that the individual [NAME] workers did not hold senior positions or public facing roles, disclosing that level of information would not be within their reasonable expectations. Although the Trust had not provided specific evidence in support of its claim that staff had been targeted in the past after releasing information in response to FOIA requests, the Commissioner accepted that the nature of the information could lead to employees being put under unreasonable pressure. The Commissioner accepted there was a general public interest in transparency of public bodies and that, although [NAME] had not specified why he was requesting the information, there was a legitimate interest in ensuring that employees are sufficiently trained and qualified to undertake their role. However, there was no specific mandatory training for staff and the Trust had provided assurance that the two employees were suitably trained and qualified. Therefore the Commissioner concluded that disclosure of the information was not of sufficient wider public interest to warrant overriding the rights and expectations of the individuals.

The First-tier Tribunal’s decision 12. Before determining the appeal, the FTT had directed [NAME] to explain why he wanted the information. It summarised his response in its reasons. [NAME] had said that he was a mental health patient, explained some of the risks that he faced, and said that in any appeal against a Care Act assessment the “capacity and skill set” of the assessing officers was highly relevant. He made some general points about the right of patients to be treated by appropriately qualified staff. He did not say that he had been or was to be assessed under the Care Act, nor did he say what if any professional relationship the two employees had to him, although the FTT said “it may be surmised that he has asked for information… because they are, or may become, his [NAME] workers (directly or in a managerial capacity) and/or responsible for his needs assessment”.

13. At paragraph 58 the FTT correctly noted that a purely private interest was capable of amounting to a legitimate interest under condition 6(1). The majority of the FTT addressed fairness and the application of condition 6(1) together. They noted the importance to an individual of assessment under the Care Act and of those carrying out the assessments having the necessary skills and being appropriately trained, and of the risks to [NAME] if his needs were not properly met. [NAME] had a legitimate interest in knowing what training [NAME] workers who would be carrying out his assessment had had, and this could not be achieved in a less intrusive way. Therefore disclosure of the information was reasonably necessary to promote that interest. They found that the individuals did not have a reasonable expectation that the information would not be disclosed, in particular because the

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 4 information was not particularly personal, and that the risk of the individuals being targeted did not outweigh [NAME]’s interest in disclosure.

14. The minority member disagreed with the majority in that he considered that disclosure was not warranted in the light of the effects on the individuals of the information being widely available and taking into account that there was no wider public interest in the information being generally available.

Submissions 15. I gave permission to appeal on two grounds advanced by the [NAME], both relating to the FTT’s approach to the third question that arises under condition 6(1). Ground 1 is that the FTT did not in substance take into account the effect of disclosure of the information to the world at large. Ground 2 is that the FTT’s approach to the effects of disclosure was irrational.

16. In his submissions sent in response to the appeal, [NAME] argues that, as FOIA does not limit the use that a person can make of information provided to them, the effect of the possible uses cannot be relevant to disclosure under FOIA. He says that there are many forms of distress and stress, it is not clear what the Commissioner was concerned with in this case and no evidence of the effects on individuals was provided. He makes various submissions about the reasonableness of his request and that the information relates only to the individuals’ professional roles. He acknowledges that being questioned about qualifications can place strain on an individual but that this comes as part of a professional’s job and is not unreasonable in the circumstances. 17. [NAME] says that there is value in information about a person’s qualifications being made publicly available: it may be “a great asset in clinical negligence cases”; activists can use the information to “bring pressure on an organisation to maintain a good service”; and it might assist others in making complaints about services. He challenges the notion of seeking to avoid “inappropriate” complaints, as the complaints process itself will determine appropriateness.

Discussion Ground 1.

18. The first substantive question addressed by the FTT was “[NAME] have a legitimate interest in the information such that disclosure is ‘necessary’”. I note that this elides the first and second questions that arise under Condition 6(1) of Schedule 2 of DPA. The FTT referred to the [NAME]’s guidance, “Requests for personal data about public authority employees”, and noted that the guidance stated that “a FOIA disclosure is to the world at large and information released under FOIA is free from any duty of confidence”. Having criticised the Commissioner’s guidance for conflating legitimate interest with prejudice to the rights and freedoms of others (I observe in passing that the criticism in my view is misplaced, but I do not need to address that further here) the FTT continued at paragraph 58 as follows:

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 5 “…the whole world principle is not inviolable and a measure of common sense needs to be applied to it. The world would only find out the requested information if either the Trust or [NAME] publicises it. The Trust controls what it publicises. There would be no obvious motive for [NAME] to publicise the information.” 19. The above passage formed part of the FTT’s consideration of whether [NAME] had a legitimate interest in the information but it is clear that its approach to what it described as the “whole world principle” also influenced its approach to the third of the three questions arising under Condition 6(1): whether disclosure was unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. In addressing that issue the FTT made no mention of the fact that on disclosure under FOIA the public authority would lose control of the information. Instead the FTT considered solely how [NAME] might use the information (paragraphs 75 and 76). The FTT failed to address the possible consequences of the information being disclosed to individuals other than [NAME].

20. This was the wrong approach in law. In [NAME] v [NAME] and others [2015] UKUT 0449 (AAC), Upper Tribunal Judge Jacobs said at [23] that, in addressing the second and third stages of condition 6(1), it is important to take into account that disclosure under FOIA would be free of any duty of confidence. The FTT’s observations at paragraph 58, cited above, miss the point. On disclosure under FOIA the Trust would no longer control the information and so could not ensure that it was not publicised. [NAME]’s reason for wanting the information was relevant to whether his interest was legitimate but not to the potential effects of disclosure to the world at large. In the latter respect, his lack of motivation to publicise the information was irrelevant. It is important to note that section 40(3)(a) of FOIA is concerned with disclosure to “a member of the public” rather than to a particular person or for any particular purpose. In this context there is no significance in the statutory language referring to “a member of the public” rather than the public at large.

21. This error is fundamental to the FTT’s approach to this appeal and the decision cannot stand in the light of it. Ground 2 22. The majority of the FTT addressed the possible effects of disclosure at paragraphs 75 and 76. In summary, the FTT decided that the effects would not constitute an excessive interference in the rights of the data subjects because: “76. …If someone makes inappropriate complaints, they can no doubt be summarily dismissed. If someone, armed with information, targets individual members of staff for the alleged inadequacy of the care they provide, the merits of the individual case have to determine what happens. The Tribunal, whilst accepting the legitimacy of [NAME]’s interest in the requested information, has already commented that he would be unwise to place too much weight on whether particular employees have had particular ongoing training: his use of the information should be proportionate and if it is not he may find that his representations are not heeded.” 23. This reasoning fails to address the core of the concerns raised by the Trust and accepted by the [NAME]. While the Trust may well be able to

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 6 manage complaints and other issues raised through its own processes, that would not of itself relieve individual staff members of the stress of being made subject to inappropriate complaints nor of being targeted in other ways. The FTT did not address the case which was put before it in this regard and, for that, was in error.

24. It seems to me that the error in the FTT’s approach here is at least in part a consequence of the error identified under Ground 1. As I have said, it is apparent from paragraph 75 that the FTT considered the consequences of disclosure to [NAME] only and so did not have in mind that there may be others who are inclined to use the information for other purposes.

25. I fully accept that the case put before the FTT as to the effects of disclosure was rather thin, being based on the Trust’s assertions at page 54 of the FTT bundle, but I cannot conclude that it would have made no difference had the FTT addressed it. It was for the FTT to assess the likely effects of disclosure, affording such weight as it thought appropriate to the Trust’s description of previous experiences. I note the points made by [NAME] about the value of disclosure and the possible effects on individuals. Those are points which he may make to the next tribunal.

Conclusions 26. In the light of these errors, and in particular the first under Ground 1 which goes to the heart of the FTT’s evaluation of the questions which arise under condition 6(1) in schedule 2 of the DPA, the FTT’s decision must be set aside. I am not able to remake the decision. The appeal will have to be determined again by a different tribunal, and so I have remitted it for that purpose.

27. The next tribunal will consider the appeal afresh. It will not be bound in any way by the findings of the last tribunal. The fact that I have allowed the appeal does not give any indication as to what the result will be next time. That is entirely a matter for the tribunal that considers the appeal.

Some other observations 28. In considering the grounds of appeal in this case, I detected a fundamental misconception in the FTT’s approach to the relationship between the DPA and FOIA, and it is appropriate to mention this so as to assist the next FTT in approaching the case on a correct basis.

29. At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v [NAME] [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”. FOIA creates a general right to information subject to the exemptions in

[NAME] v [NAME] ([NAME]) [2019] UKUT 29 (AAC)

[NAME]/2288/2018 7 section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]: “…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.” 30. It seems to me that the FTT’s failure to recognise the different focus of FOIA and the DPA may have led it astray in its assessment of [NAME]’s interest in the information, an example being its statement at paragraph 63 that “the point about FOIA is that members of the public are, subject to the exemptions, entitled to information held by public authorities so that they can make their own judgements.” 31. Finally, although when I gave permission to appeal I did not consider that there was an arguable error of law in the FTT’s failure to mention the guidance in Goldsmith, I am concerned that its approach to necessity may have been unduly narrow. The next tribunal would be well-advised to have regard to the Goldsmith guidance which makes it clear that the question whether there are alternative measures (Proposition 5) is a relevant but not the only consideration in relation to necessity as explained in propositions 3 and 4. What must be established is a pressing [NAME] need and that there are no other means of meeting it (see the [NAME]’s guidance, “Personal information” at paragraph 110).

32. I should make clear that these observations are made for the assistance of the next tribunal. The parties did not make submissions on these points in this appeal and they do not form any part of my reasons for allowing the appeal.

Signed on the original [NAME] on 23rd January 2019 Judge of the Upper Tribunal