Upper Tribunal Allows Appeals on FOIA National Security Exemptions

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC)

1

IN THE UPPER TRIBUNAL Appeal No. [NAME] CHAMBER [NAME] & [NAME]

On appeal from the First-tier Tribunal ([NAME] Chamber) (Information Rights)

Between: The Foreign, Commonwealth and Development Office Appellant - v -

The [NAME] First Respondent - and -

[NAME] ([NAME]) [NAME]-[NAME] ([NAME]) [NAME] ([NAME]) Second Respondents

Before: Mrs Justice Farbey DBE Upper Tribunal Judge Mullan Upper Tribunal Judge Wikeley

Hearing date: 1 July 2021 & 2 July 2021 Decision date: 1 October 2021

Representation: Appellant: [redacted] Department First Respondent: [redacted] Respondents: [redacted]

[NAME] of Counsel For Prof [NAME]-[NAME]: [NAME] of Counsel For [NAME]:

[NAME] of Counsel

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 2 DECISION

The unanimous decision of the Upper Tribunal is to allow the appeals.

The decision of the First-tier Tribunal ([NAME] Chamber) (Information Rights) dated 13 November 2020 on a preliminary issue under file references EA/2019/0212, EA/2019/0450 and EA/2020/0142 involves an error on a point of law. The First-tier Tribunal’s decision is accordingly set aside and re- made in the following terms:

The First Respondent’s decision that it was open to the Foreign, Commonwealth and Development Office (the Appellant in the First-tier Tribunal proceedings) to maintain the exemptions under the Freedom of Information Act 2000 (‘FOIA’), sections 23(1) and 24(1) “in the alternative” was correct as a matter of law.

This decision is given under section 12(2)(a) and 12(2)(b)(ii) of the Tribunals, Courts and Enforcement Act 2007.

REASONS FOR

DECISION Introduction 1. This appeal concerns the inter-relationship between the two national security exemptions under sections 23(1) and 24(1) of the Freedom of Information Act 2000 (FOIA) together with section 17 of the same Act.

2. Section 23(1) of FOIA, an absolute exemption, provides that “Information held by a [NAME] authority is exempt information if it was directly or indirectly supplied to the [NAME] authority by, or relates to, any of the bodies specified in subsection (3).” Section 23(3) then lists a number of security bodies, starting with the Security Service and the Secret Intelligence Service.

3. Section 24(1) of FOIA, a qualified exemption, provides that “Information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security”.

4. Section 17 of FOIA deals generally with refusals of requests made under the Act. It requires any [NAME] authority refusing a FOIA request to issue the [NAME] with a notice which, amongst other things, “specifies the exemption in question” (section 17(1)(b)). The central issue in dispute 5. The [NAME] identifies the central issue for us to decide in the following way (in her Response to the appeal at para 1): This appeal concerns whether a [NAME] authority responding to a FOIA request is entitled to rely on sections 23(1) and 24(1) FOIA in the alternative, so as to protect the interests of national security by masking, in particular, whether or not the information requested relates to a section 23(3) security body.

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 3 6. [NAME], one of the three requesters involved in these proceedings (who all see the issue in the same way), frames the central question for determination in a rather different way (in his Response to the appeal at para 1): The FTT was faced, and the UT is now faced on appeal, with a straightforward question of law: when s.17(1)(b) FOIA requires a [NAME] authority to “specify” an exemption upon which it relies, is that [NAME] authority entitled (in the circumstances of the mutually-exclusive ss.23 and 24 FOIA, or at all) to “mask” which exemption it actually relies upon by also stating a dummy exemption it does not rely upon (and cannot rely upon as a matter of law), so as to avoid disclosing which is the applicable exemption? 7. Put simply, the Foreign, Commonwealth and Development Office (the [NAME]) and the [NAME] submit that a [NAME] authority is entitled to rely on FOIA sections 23 and 24 in the alternative, where on the facts only one such exemption applies, as a means of “masking” the involvement (or indeed non-involvement) of a security body. The requesters argue, in short, that the deployment of such a fiction is incompatible with the [NAME] authority’s duty under FOIA section 17. The First-tier Tribunal decided this preliminary point in the requesters’ favour and the [NAME] now appeals to the Upper Tribunal, supported by the Commissioner.

8. Our unanimous conclusion, in summary, is that the [NAME] was entitled to rely on FOIA sections 23(1) and 24(1) in the alternative, so as to protect the interests of national security by masking whether or not the information requested relates to one of the security bodies listed in section 23(3). It follows that the [NAME]’s original Decision Notices were correct as a matter of law on this point in each case and the First-tier Tribunal’s decision on the preliminary issue was made in error. The context in which the central issue arises 9. The First-tier Tribunal was concerned with appeals in relation to three FOIA requests made to the [NAME].

10. On 10 May 2018 [NAME] made a FOIA request to the [NAME] for all documents relating to the case of [NAME] and [NAME], opponents of the Gaddafi regime who had been unlawfully rendered to Libya, where they were tortured. Their ordeal led to the UK government issuing a [NAME] apology, which recognised that its actions had “contributed to [their] detention, rendition and suffering”, and settling legal proceedings brought by the couple.

11. On 6 March 2019 [NAME], a historian with a special interest in British foreign policy in Italy immediately after the Second World War, made a FOIA request to the [NAME] for the declassification of a specific file on the political situation in Italy in 1947, held at The National Archive (TNA, formerly the [NAME] Office).

12. On 14 April 2019 [NAME], a biographer, made a FOIA request to the [NAME] for two other TNA classified files, both relating to the Soviet spy [NAME].

13. In each of the three cases the [NAME] replied that information within the scope of the request was held but that it would not be supplied because it was exempt

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 4 either under section 23(1) (information supplied by, or relating to, bodies dealing with security matters) or section 24(1) (national security). Implicit in each refusal was an acknowledgment that the exemptions under sections 23(1) and 24(1) were mutually exclusive. That proposition has been agreed as correct on all sides before both the First-tier Tribunal and Upper Tribunal. However, the [NAME] went on to explain that it was citing the two exemptions “in the alternative” because “it is not appropriate, in the circumstances of the case, to say which of the two exemptions is actually engaged so as not to undermine national security or reveal the extent of any involvement, or not, of the bodies dealing with security matters”.

14. All three requesters complained to the [NAME]. Following lengthy investigations, she upheld the [NAME]’s right to cite sections 23(1) and 24(1) “in the alternative”. The [NAME] concluded that the information sought was exempt under one or other of those subsections but did not inquire into, much less determine, which of the two exemptions was applicable. All three requesters then lodged appeals with the First-tier Tribunal.

15. The First-tier Tribunal (Judge Anthony Snelson and Judge Moira Macmillan) held a hearing on 13 November 2020 on the preliminary issue as to whether the [NAME]’s decision that it was open to the [NAME] to maintain the section 23(1) and 24(1) exemptions “in the alternative” was correct in law. The First-tier Tribunal’s unanimous decision (dated 29 December 2020) was that the Commissioner’s approach was wrong as a matter of law. The First-tier Tribunal subsequently gave the [NAME] permission to appeal to the Upper Tribunal on this preliminary issue. The Upper Tribunal hearing 16. We held a conventional oral hearing of the [NAME]’s three appeals on 1 and 2 July 2021, albeit that some of those involved observed the hearing remotely. The [NAME] (the Appellant) was represented by [NAME] and [NAME] of counsel. The [NAME] was represented by [NAME] of counsel. [NAME] and [NAME] were represented by [NAME] and [NAME] of counsel respectively. We are indebted to counsel on all sides for their co-operation in avoiding the duplication of submissions, given the overlapping interests. We are especially indebted to those counsel who acted pro bono. We are satisfied that all possible arguments have been properly ventilated. We should emphasise for the record that there were no closed written submissions and there was no closed hearing. The roadmap for this decision 17. We start by providing an overview of the relevant legislative framework (paragraphs 18-25) before considering the proper approach to statutory interpretation (paragraphs 26-28) and the national security context (paragraphs 29-34). After considering the [NAME]’s guidance on the inter- relationship of sections 23 and 24 of FOIA (paragraphs 35-38), we discuss the nature of section 17 of FOIA (paragraphs 39-48) and in particular focus on the meaning of “specify” in section 17(1)(b) (paragraphs 49-58). We also address the practical consequences of our decision (paragraphs 59-63) and explain why the NCND (neither confirm nor deny) provisions do not provide an adequate

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 5 solution to the problem that has been identified (paragraphs 64-70). Finally, after reference to other official guidance (paragraphs 71-75), we analyse the human rights dimension (paragraphs 76-84). The legislative framework 18. Under section 1 of FOIA any person who makes a request of a [NAME] authority has two rights. The first is the right “to be informed in writing by the [NAME] authority whether it holds information of the description specified in the request” (section 1(1)(a)). The second, if that is the case, is the right “to have that information communicated to him” (section 1(1)(b)).

19. Assuming that the duty to confirm or deny does not arise, then the [NAME]’s section 1(1)(a) right to be informed does not apply where either a provision in Part II confers an absolute exemption or (in the case of a qualified exemption) “the [NAME] interest in maintaining the exclusion of the duty to confirm or deny outweighs the [NAME] interest in disclosing whether the [NAME] authority holds the information” (section 2(1)).

20. Furthermore, the [NAME]’s section 1(1)(b) right to have information communicated does not apply to any information which is exempt under Part II to the extent it is covered by an absolute exemption or to the extent “the [NAME] interest in maintaining the exemption outweighs the [NAME] interest in disclosing the information” (section 2(2)).

21. However, the key provisions for our purposes are sections 17, 23 and 24. The material provisions of section 17 read as follows: 17.— Refusal of request (1) A [NAME] authority which, in relation to any request for information, is to any extent relying on a claim that any provision of Part II relating to the duty to confirm or deny is relevant to the request or on a claim that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which— (a) states that fact, (b) specifies the exemption in question, and (c) states (if that would not otherwise be apparent) why the exemption applies. (2) Where— (a) in relation to any request for information, a [NAME] authority is, as respects any information, relying on a claim— (i) that any provision of Part II which relates to the duty to confirm or deny and is not specified in section 2(3) is relevant to the request, or (ii) that the information is exempt information only by virtue of a provision not specified in section 2(3), and (b) at the time when the notice under subsection (1) is given to the applicant, the [NAME] authority (or, in a case falling within section 66(3) or (4), the responsible authority) has not yet reached a decision as to the application of subsection (1)(b) or (2)(b) of section 2, the

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 6 notice under subsection (1) must indicate that no decision as to the application of that provision has yet been reached and must contain an estimate of the date by which the authority expects that such a decision will have been reached. (3) A [NAME] authority which, in relation to any request for information, is to any extent relying on a claim that subsection (1)(b) or (2)(b) of section 2 applies must, either in the notice under subsection (1) or in a separate notice given within such time as is reasonable in the circumstances, state the reasons for claiming— (a) that, in all the circumstances of the case, the [NAME] interest in maintaining the exclusion of the duty to confirm or deny outweighs the [NAME] interest in disclosing whether the authority holds the information, or (b) that, in all the circumstances of the case, the [NAME] interest in maintaining the exemption outweighs the [NAME] interest in disclosing the information. (4) A [NAME] authority is not obliged to make a statement under subsection (1)(c) or (3) if, or to the extent that, the statement would involve the disclosure of information which would itself be exempt information.

22. Section 23 provides as follows: 23.— Information supplied by, or relating to, bodies dealing with security matters (1) Information held by a [NAME] authority is exempt information if it was directly or indirectly supplied to the [NAME] authority by, or relates to, any of the bodies specified in subsection (3). (2) A certificate signed by a Minister of the Crown certifying that the information to which it applies was directly or indirectly supplied by, or relates to, any of the bodies specified in subsection (3) shall, subject to section 60, be conclusive evidence of that fact. (3) The bodies referred to in subsections (1) and (2) are— (a) the Security Service, (b) the Secret Intelligence Service, (c) the Government Communications Headquarters, (d) the special forces, (e) the Tribunal established under section 65 of the Regulation of Investigatory Powers Act 2000, (f) the Tribunal established under section 7 of the Interception of Communications Act 1985, (g) the Tribunal established under section 5 of the Security Service Act 1989, (h) the Tribunal established under section 9 of the Intelligence Services Act 1994,

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 7 (i) the Security Vetting Appeals Panel, (j) the Security Commission, (k) the National Criminal Intelligence Service (l) the Service Authority for the National Criminal Intelligence Service, (m) the Serious Organised Crime Agency, (n) the National Crime Agency, and (o) the Intelligence and Security Committee of Parliament. (4) In subsection (3)(c) “the Government Communications Headquarters” includes any unit or part of a unit of the armed forces of the Crown which is for the time being required by the Secretary of State to assist the Government Communications Headquarters in carrying out its functions. (5) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) which was directly or indirectly supplied to the [NAME] authority by, or relates to, any of the bodies specified in subsection (3).

23. Section 23 is an absolute exemption (see FOIA section 2(3)(b)). The security bodies listed in section 23(3) are not listed as [NAME] authorities by virtue of section 3 and Schedule 1 to FOIA. In addition, and rather by way of belt and braces, the first three agencies listed in section 23(3) are expressly excluded from the definition of “government department” (see FOIA section 84). We accept that the combined effect of these provisions is to signal a clear Parliamentary intention that there should be no question of requiring the disclosure of any information which was directly or indirectly supplied by, or relates to, any of the specified security agencies.

24. Section 24 provides as follows: 24.— National security (1) Information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security. (2) The duty to confirm or deny does not arise if, or to the extent that, exemption from section 1(1)(a) is required for the purpose of safeguarding national security. (3) A certificate signed by a Minister of the Crown certifying that exemption from section 1(1)(b), or from section 1(1)(a) and (b), is, or at any time was, required for the purpose of safeguarding national security shall, subject to section 60, be conclusive evidence of that fact. (4) A certificate under subsection (3) may identify the information to which it applies by means of a [NAME] description and may be expressed to have prospective effect.

25. Section 24 is a qualified exemption by virtue of the simple fact it is not listed in section 2(3) of FOIA as one of the absolute exemptions. As already noted, it is also agreed on all sides that sections 23 and 24 are mutually exclusive, given

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 8 that the material scope of section 24(1) is by definition “Information which does not fall within section 23(1)”. Approaches to statutory interpretation and [NAME]

26. Lord Bingham described the proper approach to the task of statutory interpretation in the following terms in R ([NAME]) v Secretary of State for Health [2003] UKHL 13, [2003] AC 687:

8. The basic task of the court is to ascertain and give effect to the true meaning of what Parliament has said in the enactment to be construed. But that is not to say that attention should be confined and a literal interpretation given to the particular provisions which give rise to difficulty. Such an approach not only encourages immense prolixity in drafting, since the draftsman will feel obliged to provide expressly for every contingency which may possibly arise. It may also (under the banner of loyalty to the will of Parliament) lead to the frustration of that will, because undue concentration on the minutiae of the enactment may lead the court to neglect the purpose which Parliament intended to achieve when it enacted the statute. Every statute other than a pure consolidating statute is, after all, enacted to make some change, or address some problem, or remove some blemish, or effect some improvement in the national life. The court's task, within the permissible bounds of interpretation, is to give effect to Parliament's purpose. So the controversial provisions should be read in the context of the statute as a whole, and the statute as a whole should be read in the historical context of the situation which led to its enactment.

27. The principles in [NAME] are well-established and received recent endorsement by the Supreme Court in R (Fylde Coast Farms Ltd) v Fylde BC [2021] UKSC 18, [2021] 1 WLR 2794. Relying on Lord Bingham’s remarks, Lord [NAME] said the following at paragraph 6: Even where particular words used in a statute appear at first sight to have an apparently clear and unambiguous meaning, it is always necessary to resolve differences of interpretation by setting the particular provision in its context as part of the relevant statutory framework, by having due regard to the historical context in which the relevant enactment came to be made and, to the extent that its purpose can be identified (which may require examination of admissible travaux preparatoires), to arrive at an interpretation which serves, rather than frustrates, that purpose.

28. In paragraph 30 of its decision, the First-tier Tribunal noted that a key FOIA provision in this case – section 17(1) – was part of the legislative framework and so had to be read in the context of the FOIA scheme as a whole. Thereafter, however, the First-tier Tribunal ignored that requirement and adopted what was clearly a literal approach to statutory construction. In so doing, it disregarded the [NAME] stipulation that the task of the judicial body is, in [NAME] terms, to seek to establish and give effect to the purpose Parliament was seeking to achieve and, in more specific terms, to set a particular provision within its broader legislative context. In this case, that mandated a requirement to consider section 17(1) in the context of both sections 23 and 24.

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 9

The national security context 29. Sections 23 and 24 of FOIA have yet to receive detailed analysis in the case law of either the Supreme Court or the Court of Appeal. There is, however, ample existing Upper Tribunal authority.

30. So far as section 23 is concerned, in Commissioner of the Police of the Metropolis v Information Commissioner and Rosenbaum [2021] UKUT 5 (AAC) (or “[NAME]”) Judge Markus QC (at paragraphs 35 and 43) approved the following 14 principles extracted from the case law by [NAME] (also appearing there for the Commissioner). These principles draw from the following cases: Home Office v Information Commissioner and Cobain [2015] UKUT 27 (AAC); APPGER v Information Commissioner and Foreign and Commonwealth Office [2015] UKUT 377 (AAC), [2016] AACR 5; [NAME] v [NAME]’s Office and Cabinet Office [2016] UKUT 535 (AAC), [2017] AACR 26; Corderoy v Information Commissioner [2017] UKUT 495 (AAC), [2018] AACR 19; and [NAME] v [NAME] and [NAME] [2020] UKUT 32 (AAC), [2020] 1 WLR 3319:

1. Section 23 affords the “widest protection” of any of the exemptions: [NAME] at [19(b)] and [29].

2. The purpose of section 23 is to preserve the operational secrecy necessary for section 23(3) bodies to function: [NAME] at [50].

3. It is “Parliament’s clear intention that, because of what they do, there should be no question of using FOIA to obtain information from or about the activities of section 23 bodies at all”. The exclusion of the section 23(3) bodies from the scope of FOIA was shutting the front door, and section 23 was “a means of shutting the back door to ensure that this exclusion was not circumvented”: [NAME] at [16].

4. The legislative choice of Parliament was that “the exclusionary principle was so fundamental when considering information touching the specified bodies, that even perfectly harmless disclosure would only be made on the initiative or with the consent of the body concerned”: [NAME] at [28]; [NAME] at [53].

5. Asking whether the information requested is anodyne or revelatory fails to respect the difficulty of identifying what the revelatory nature of the information might be without a detailed understanding of the security context: [NAME] at [42]; [NAME] at [59].

6. When applying the “relates to” limb of sections 23(1) and (5), that language is used in “a wide sense”: [NAME] at [25]; [NAME] at [59]; [NAME] at [40].

7. The first port of call should always be the statutory language without any judicial gloss: [NAME] at [23]; [NAME] at [51]; [NAME] at [40].

8. With that warning in mind, in the context of “relates to” in section 23, it may sometimes be helpful to consider the synonyms of “some connection” or “that it touches or stands in some relation to” ([NAME] at [13], [25]) or to consider whether the request is for “information, in a record supplied to

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 10 one or more of the section 23 bodies, which was for the purpose of the discharge of their statutory functions” ([NAME] at [21], [26]; [NAME] at [57]). But the “relates to” limb must not be read as subject to a test of focus ([NAME] at [14] or directness ([NAME] at [59]-[60]).

9. The scope of the “relates to” limb is not unlimited and there will come a point when any connection between the information and the section 23(3) body is too remote. Assessing this is a question of judgment on the evidence: [NAME] at [62].

10. The assessment of the degree of relationship may be informed by the context of the information: [NAME] at [4] and [67].

11. The scope of the section 23 exemption is not to be construed or applied by reference to other exemptions, including section 24: [NAME] at [17]; [NAME] at [45] and [52].

12. In a section 23(1) case, regard should be had as to whether or not information can be disaggregated from the exempt information so as to render it non-exempt and still be provided in an intelligible form: [NAME] at [43].

13. Section 23(5) requires consideration of whether answering “yes” or “no” to whether the information requested is held engages any of the limbs of section 23: [NAME] at [43], [82] and [92].

14. The purpose of section 23(5) is a protective concept, to stop inferences being drawn on the existence or types of information and enables an equivalent position to be taken on other occasions: [NAME] at [60].

31. So far as section 24 is concerned, [NAME] has provided us with a more compendious package of six principles derived from the case law: (1) The term national security has been interpreted broadly and encompasses the security of the United Kingdom and its people, the protection of democracy and the legal and constitutional systems of the state: Secretary of State for the Home Department v Rehman [2001] UKHL 47, [2003] 1 AC 153, paras 15-16 per Lord [NAME], para 50 per Lord Hoffmann and para 64 per Lord Hutton. (2) A threat to national security may be direct (the threat of action against the United Kingdom) or indirect (arising from the threat of action directed against other states): [NAME], paras 16 and 64. (3) Section 24 is not engaged, unlike the majority of the qualified exemptions, by a consideration of prejudice. Its engagement is deliberately differently worded. (4) The term “required” means “reasonably necessary”: [NAME] v [NAME] & Department for Transport [2011] 1 Info LR 664, para 33. (5) National security is a matter of vital national importance in which the Tribunal should pause and reflect very carefully before overriding the sincerely held views of relevant [NAME] authorities: [NAME] v [NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 11 Commissioner & Ministry of Defence [2011] UKUT 153 (AAC), [2011] 2 Info LR 75, para 56 (citing [NAME]). (6) Even where the chance of a particular harm occurring is relatively low, the seriousness of the consequences (the nature of the risk) can nonetheless mean that the [NAME] interest in avoiding that risk is very strong: [NAME], para 47. As the Upper Tribunal put it: “the reality is that the [NAME] interest in maintaining the qualified national security exemption in section 24(1) is likely to be substantial and to require a compelling competing [NAME] interest to equal or outweigh it”: [NAME] v [NAME], Home Office and Metropolitan Police Service [2016] UKUT 461 (AAC), para 58 (approving [NAME]). That does not mean that the section 24 exemption carries “inherent weight”, but is rather a reflection of what is likely to be a fair recognition of the [NAME] interests involved in the particular circumstances of a case in which section 24 is properly engaged. 32. [NAME] does not cite an authority for the third of his principles relating to section 24, but it is none the worse for that. It is amply made out on a plain reading of the language of Part II of FOIA.

33. In terms of the linkage between sections 23 and 24, and approaches to their construction, an earlier three-judge panel of the Upper Tribunal expressed the point in the following terms in APPGER v Information Commissioner and FCO [2015] UKUT 377 (AAC):

17. This broad approach by reference to identified bodies [in section 23] is not narrowed by the qualified exemption in section 24(1), namely that information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security. This is a safety net provision which recognises that national security issues may arise in respect of information that is not within the absolute section 23 exemption. Rather this safety net provision reinforces the view that Parliament's intention was to put section 23 bodies outside the ambit of the right to information conferred by FOIA and a narrow approach to an absolute exemption would not promote that purpose.

34. We turn now to summarise the [NAME]’s guidance on how sections 23 and 24 inter-relate. The [NAME]’s guidance 35. In September 2012 the [NAME] issued detailed guidance on How sections 23 and 24 interact. At this stage we refer to this document simply to illustrate what the Commissioner has identified as the potential problem with the inter-relationship between sections 23 and 24 (see in particular paragraph 26 of the guidance and the example that follows below). Putting that example in context, the guidance includes the following passage at paragraphs 21-27 (excluding a short extract cited from FOIA after paragraph 25; “NCND” is the conventional abbreviation for the “neither confirm nor deny” response):

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 12 Sections 23(1) and 24(1)

21. Although many requests that raise national security concerns could be responded to using the NCND provisions, there will be situations when it is obvious that the information is held. This may be as a result of official statements to that effect. In these situations the use of NCND would serve little purpose. In these cases the Commissioner would encourage [NAME] authorities to confirm that the information is held.

22. When it is obvious that the information is held, but not obvious whether its contents relates to a security body, this in itself may be worthy of protection. The dilemma for the [NAME] authority is that relying on either section 23(1) or section 24(1), alone, would reveal whether the requested information relates to a security body.

23. In these circumstances the [NAME] authority should not attempt to apply the NCND provisions in order to avoid citing an exemption from the duty to communicate the actual information. Even though relying on just one of the exemptions from the duty to communicate information would itself reveal something of the nature of the information, this is not a basis for engaging sections 23(5) or 24(2). As discussed above, the only basis for applying sections 23(5), or 24(2), or both, is what would be revealed by confirmation or denial that the information is held.

24. When it is obvious the information is held and therefore the [NAME] authority sees no value in refusing to confirm or deny, or if the NCND provisions can’t be engaged on the facts of the case, the [NAME] authority will be faced with the problem of applying either section 23(1) or section 24(1). The Commissioner has developed an approach to deal with this situation, which is set out below. Section 23(1) and 24(1) are mutually exclusive 25. Sections 23(1) and 24(1) are mutually exclusive. This means they cannot be applied to the same request. … 26. The fact that section 24(1) can only be applied to information that is not protected by section 23(1) can present a problem, if a [NAME] authority does not want to reveal whether a section 23 security body is involved in an issue. If it could only cite section 24(1) in its refusal notice, this would disclose that no section 23 body was involved. Conversely, if only section 23(1) was cited, this would clearly reveal the involvement of a security body. To overcome this problem the Commissioner will allow [NAME] authorities to cite both exemptions ‘in the alternative’ when necessary. This means that although only one of the two exemptions can actually be engaged, the [NAME] authority may refer to both exemptions in its refusal notice. Example In this hypothetical example, the government announce that a terrorist suspect, Mr X, has been apprehended but very few details are released. This prompts an FOI request to the Home Office for information on the circumstances of the arrest. It may well be that the

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 13 arrest was the result of a well executed, intelligence led, security operation. However it is equally plausible that the local police made the arrest following a report that someone had been acting suspiciously and the significance of the arrest was only realised later. It is clear, because of the Government’s announcement, that the [NAME] authority would hold information on the circumstances of the arrest, but it may not want to reveal whether a security body was involved. If the Home Office was unable to cite sections 23(1) and s24(1) in the alternative, it would be faced with having to identify the actual exemption being relied on. If it relied on section 23(1), it would reveal the involvement of a security body, or if it relied on section 24(1) then this would reveal the security bodies were not involved.

27. Previously, where [NAME] authorities have been concerned that being able to rely only on either section 23(1) or section 24(1) would reveal the involvement or not of a security body, they have tried to avoid the problem by applying the NCND provisions of the two exemptions. This is the case despite the fact that confirming the information is held would not reveal anything which needed to be protected. The perceived problem is that if the [NAME] authority confirms the information is held, it would then have to rely on just one exemption to withhold it. The Commissioner is satisfied that allowing [NAME] authorities to cite sections 23(1) and 24(1) in the alternative is the pragmatic solution to the problem. There are benefits to the applicant in that they at least receive confirmation that the information is held. In addition the [NAME] authority is not placed in the odd position of refusing to confirm whether information is held where it obviously is and so avoids looking unnecessarily obstructive. Refusal notices 28. When a [NAME] authority cites sections 23(1) and 24(1) in the alternative, consideration needs to be given to the contents of the refusal notice. Technically section 17(1) requires [NAME] authorities to specify the exemption they are relying on. However, it is important in these circumstances that the refusal notice effectively disguises which provision actually applies. Therefore, the Commissioner will accept a refusal notice which cites both exemptions, stating that they are being cited in the alternative and then explaining why each one could apply. As section 24 is qualified, the refusal notice would also have to explain the application of the [NAME] interest test to that provision. 36. [NAME]’s submission was that the example given in paragraph 26 of the [NAME]’s guidance was an illustration of a real life practical dilemma and not simply a hypothetical problem. Thus reliance on e.g. section 23 alone could give rise to what was described as the “revelatory problem” – it could reveal a fact not previously in the [NAME] domain, namely the involvement of one of the listed security agencies. The consequential harm to national security interests in the event of such disclosure could be slight or could be serious, but either way there was a genuine policy concern. Echoing this approach, [NAME] posited what he characterised as the central legislative policy question in the following terms: if Parliament had clearly expressed its intention to protect information where its disclosure might damage national security interests, even if that information was apparently anodyne, then why

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 14 would it have left unprotected another type of information where revealing such material might put the [NAME] at risk? 37. The requesters’ response was two-fold. First, it was argued that the [NAME] needed to provide evidence of actual harm that had eventuated as a result of the revelatory problem. We disagree – this is ultimately a question of statutory construction that does not turn on factual evidence. In any event, the example given in the [NAME]’s guidance is sufficient to demonstrate that the problem is real and not imagined. Second, it was submitted that the probable impact of such “give away” disclosure was likely to be limited. We agree with [NAME] that the evaluation of the risk to national security is a matter for the executive. Moreover, Parliament had made it clear that impact of any degree on national security interests where section 23 bodies were involved was to be avoided. The revelation of such information always had the potential to be damaging (see further the 3rd, 4th and 5th principles expounded in [NAME] (see paragraph 30 above)).

38. We return later to consider the status of the [NAME]’s guidance (see paragraphs 71-72 below). For the present we turn to consider the nature of section 17 of FOIA. FOIA section 17: a procedural provision 39. We have already set out the material parts of section 17 above (see paragraph 21). Although it has not received close attention in the superior courts, the nature and purpose of section 17 of FOIA has been considered in a trilogy of Upper Tribunal decisions: DEFRA v Information Commissioner and Birkett [2011] UKUT 39, [2012] AACR 32 (“[NAME]”); [NAME] v [NAME] & Advisory Committee on Business Appointments [2018] UKUT 72 (AAC), [2018] AACR 29 (“[NAME]”) and [COMPANY] v [NAME] & Medicines and Healthcare Products Regulatory Agency [2018] UKUT 192 (AAC) (“[NAME]”). 40. [NAME] establishes that there is no legal bar on a [NAME] authority subsequently relying on an exemption which it failed to mention in its original section 17 notice. One reason for this, as held by Upper Tribunal Judge Jacobs, was that section 17 involves a purely “administrative process” (emphasis in the original in the passage that follows):

32. As I read section 17, what the authority has to do is to identify the information covered by the request and then either disclose it or say why it is not doing so. That is an administrative process. 33. [NAME] pointed out that section 17 is not a formal decision that is subject to a form of appeal under section 50. I would generalise that submission and say that the process undertaken by the [NAME] authority is not an adjudicative procedure that results in a decision. I note the contrast between the language of section 17 and section 50. Under the former, the language suggests a degree of informality: the [NAME] authority gives the applicant notice that specifies an exemption and states why it applies. Under the latter, the language suggests a degree of formality: the Commissioner serves a decision notice that requires steps to be taken to remedy a failure to comply. That reflects the Commissioner's role as a decision-maker rather than an administrator. (I also note that section 50

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 15 merely provides for an application to determine whether the [NAME] authority has acted in compliance with Part I, not directly for a challenge to the section 17 notice. However, that wording is necessary in order to include an application if the [NAME] authority has not given a notice as required.)

34. I note that under section 17(1) the [NAME] authority must identify the exemption on which it is relying. That suggests a current position. If the authority were committing itself for the future, I would have expected relies.

41. Judge Jacobs’s decision was upheld on appeal by the Court of Appeal (Birkett v DEFRA [2011] EWCA Civ 1606, [2012] AACR 32) but there was no further analysis of the section 17 procedure or its implications.

42. Subsequently the three-judge panel in [NAME] confirmed that section 17 is not designed to control the correctness or otherwise of a [NAME] authority’s reliance on any given exemption. The Upper Tribunal reasoned as follows (with emphasis added):

74. The first decision-maker in the statutory process is the [NAME] authority. Its duties are found in Part 1 of FOIA. An authority must confirm or deny whether requested information is held, and communicate the information which it holds, unless a relevant exemption applies: section 1(1). If an authority communicates information it must do so in accordance with section 11. Where it refuses to either confirm or deny, or to communicate information, it must issue a refusal notice in accordance with section 17 setting out all the exemptions claimed and why they apply. A [NAME] authority which correctly applies one of the exemptions on which it relies but incorrectly relies on [NAME], and provides reasons and information in accordance with section 17, has complied with its duties under Part 1. It has complied with its duties under section 1 because section 1 permits it to withhold information to which any exemption applies. It has complied with its duties under section 17 because it has set out the basis on which it is claiming all exemptions relied on. It does not matter that it also incorrectly relies on other exemptions because the scheme of Part 1 means that, although a [NAME] authority must state all the exemptions which it relies upon, it need only be right about one of them.

75. This analysis is consistent with the powers of the Commissioner to issue a decision notice under section 50(4). Under paragraph (a) the Commissioner must require a [NAME] authority to take steps to correct a failure to communicate information or issue confirmation or denial where it is required to do so by section 1(1). But where one exemption is correctly relied on by the authority, there has been no failure to comply with section 1(1) even if the other claimed exemptions do not apply. This explains why section 50(4) does not make any provision for a decision notice to address those other exemptions. Under paragraph (b), the Commissioner must specify the steps to be taken to correct a failure to comply with sections 11 or 17. But, even if an authority wrongly relied on some exemptions included in its refusal notice, this would not amount to a failure to comply with either section.

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 16 43. The Upper Tribunal in [NAME] was not directly faced with the conundrum posed by specifying sections 23 and 24 “in the alternative”. However, the passage as highlighted in paragraph 74, which is pitched at a high level of generality, supports the analysis advanced by both the [NAME] and the [NAME] in the present proceedings.

44. Paragraphs 74 and 75 of [NAME] were then considered by Judge Markus QC in [NAME] ([NAME] again appearing for the Commissioner), where she observed as follows (emphasis as in the original):

38. If in these passages the Upper Tribunal had said that section 17 required an authority to be correct about one exemption, that would have supported [NAME]’s contention that section 17 has a substantive content. But that is not what the Tribunal said. It said that the authority must be correct about an exemption in order to comply with Part 1. The Upper Tribunal then made clear that it is section 1 which requires an exemption to be correctly relied upon, and section 17 which requires proper notification of all exemptions relied on.

45. This passage again emphasises the procedural nature of section 17. Having cited [NAME], Judge Markus QC further observed as follows (emphasis added): 40. [NAME] said that, if section 17 is limited to matters of process, an authority could comply with that provision by relying on an obviously inapplicable exemption. That may be so, but it would be of no avail to the authority because doing so would lead to an adverse decision by the Commissioner under section 50(4)(a). It would not enable the authority to avoid its obligations under FOIA. Indeed, if the Commissioner is not empowered to require an authority to reconsider a request, that may well provide an incentive against an authority abusing section 17 in such a manner.

46. We agree with the propositions that [NAME] derived from this trilogy of Upper Tribunal authority and which he developed in his oral submissions. First, section 17 sets out an administrative process ([NAME] at [32] and [NAME] at [42]). Second, section 17 contemplates an informal procedure ([NAME] at [33]). Third, a [NAME] authority which specifies certain exemptions in its refusal notice under section 17 is not precluded from either dropping those exemptions or adding to them at a later stage ([NAME] at [25], [29] and [34]). Fourth, specifying an exemption which in the event is found not to apply is not a breach of section 17 ([NAME] at [74]-[75] and [NAME] at [36]). Fifth, and furthermore, citing an obviously inapplicable exemption is also not a breach of section 17 ([NAME] at [40]). Sixth, and finally, the ultimate supervisory mechanism for [NAME] authorities’ reliance on exemptions is not section 17 itself but rather the decision-making functions of the [NAME] and on appeal the First-tier Tribunal ([NAME] at [33], [NAME] at [75] and [NAME] at [40]).

47. The First-tier Tribunal barely mentioned this trilogy of Upper Tribunal authority. Its decision contains no direct citation from either [NAME] or [NAME]. There is a brief reference in para 44 of the decision to the passage at paras 37-40 of [NAME], and hence indirectly to [NAME]. The First-tier Tribunal expressed its agreement with the proposition that citation of exemptions was a procedural rather than substantive requirement, but concluded that “the

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 17 (procedural) obligation on the [NAME] authority under s.17 is to identify the exemption(s) on which it in fact relies. A response which cites an exemption which the authority knows to be inapplicable does not ‘specify’ the exemption relied upon” (para 44).

48. The requesters also downplay the trilogy of Upper Tribunal authority while content to concede that it has procedural aspects. It is our view that the Upper Tribunal authority is relevant and, as noted in paragraph 46 above, assists in the resolution of the question whether sections 23 and 24 may be deployed as alternatives. The meaning of “specify” in section 17(1)(b) of FOIA 49. We have concluded that the requirement in section 17(1)(b) of FOIA that a [NAME] authority, when refusing an information request by relying on an exemption, must issue the [NAME] with a notice which, amongst other things, “specifies the exemption in question”, is satisfied when the notice specifies the sections 23 and 24 exemptions in the alternative. That much is obviously and uncontroversially so where the [NAME] authority holds some information which is covered by section 23 and other information that comes within section 24. But it also applies in the situation where the information that is held falls exclusively within either section 23 or section 24. We arrive at that conclusion by applying both the ordinary meaning of the words and a purposive construction to the statutory text.

50. As to the former, on the ordinary meaning of the word, we are of the view that a notice which states that the [NAME] authority is relying on one of two exemptions in the alternative is “specifying” the exemption on which it relies (albeit with one other on which it does not). The simple requirement that the refusal notice “specifies the exemption in question” does not, in and of itself, preclude the use of masking by reliance on sections 23 and 24 in the alternative. In the relatively informal context of section 17, “specifies” means no more than “cites” or “identifies”. The First-tier Tribunal fell into error by in effect importing into section 17(1)(b) an implied substantive obligation that a [NAME] authority must specify only a valid exemption.

51. In seeking to advance their construction of section 17(1)(b), the requesters placed great emphasis on section 17(4). This provides that a “[NAME] authority is not obliged to make a statement under subsection (1)(c) or (3) if, or to the extent that, the statement would involve the disclosure of information which would itself be exempt information”. As such, a [NAME] authority is relieved of the duty to provide the reasons why it states that an exemption applies where to do so would involve the disclosure of exempt information. In contrast, it was pointed out, section 17(1)(b) was not qualified in any way by section 17(4). As such, it was suggested, section 17(1)(b) was an absolute requirement. This superficially attractive argument is unpersuasive for two reasons. First, it assumes too much, not least that Parliament identified but then dismissed the revelatory problem, and indeed made a conscious decision to run the risk of harm to national security interests by prohibiting an “in the alternative” refusal notice notwithstanding the broad policy thrust evident in sections 23 and 24. Second, and in any event, it assumes what it purports to prove, namely that section 17(1)(b) is only susceptible of one reading.

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 18 52. As to the need for a purposive construction, section 17 must be construed not in isolation but alongside and in harmony with other statutory provisions in the same scheme. We therefore return to the principles concerning the relationship between sections 23 and 24, which we set out at paragraphs 29 to 33 above, and emphasise in particular what has been set out in the case law, in [NAME] but forceful terms, about the national security context. Thus, for example, the Upper Tribunal said the following at paragraphs 19b and 29 of [NAME]: 19b. This suggests an intention by Parliament to afford a wide degree of protection for information relating to the security bodies. Indeed, of all the exemptions under FOIA, s.23 affords the widest protection. … 29. I agree, for the reasons above, with the [NAME] that the very fact that section 23 is engaged is highly material (paragraph 19a-19c), not least because, as he remarks, “of all the exemptions under FOIA, s.23 affords the widest protection” (paragraph 19b).

53. In [NAME], the Upper Tribunal remarked as following at paragraph 16:

Second, it is inconsistent with Parliament’s clear intention that, because of what they do, there should be no question of using FOIA to obtain information from or about the activities of section 23 bodies at all. There is no point sending a letter making a FOIA request to [NAME]. As [NAME] put it, Parliament had shut the front door by deliberately omitting the section 23 bodies from the list of [NAME] authorities.

54. We were also referred to R v Shayler [2002] UKHL 11, [2003] 1 AC 247 and the comments of Lord Bingham at paragraph 12:

There is much domestic authority pointing to the need for a security or intelligence service to be secure. The commodity in which such a service deals is secret and confidential information. If the service is not secure those working against the interests of the state, whether terrorists, other criminals or foreign agents, will be alerted, and able to take evasive action; its own agents may be unmasked; members of the service will feel unable to rely on each other; those upon whom the service relies as sources of information will feel unable to rely on their identity remaining secret; and foreign countries will decline to entrust their own secrets to an insecure recipient: see, for example, [NAME] v [COMPANY] (No 2) [1990] 1 AC 109, 118C, 213H-214B, 259A, 265F; Attorney General v Blake [2001] 1 AC 268, 287D-F. In the [COMPANY] (No. 2) case, at p 269E-G, Lord Griffiths expressed the accepted rule very pithily:

"The Security and Intelligence Services are necessary for our national security. They are, and must remain, secret services if they are to operate efficiently. The only practical way to achieve this objective is a brightline rule that forbids any member or ex-member of the service to publish any material relating to his service experience unless he has had the material cleared by his employers. There is, in my view, no room for an exception to this rule dealing with trivia that should not be regarded as confidential. What may appear to the writer to be trivial may in fact be the one missing piece in the jigsaw sought by some hostile intelligence agency.”

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 19 55. We agree with the [NAME] that both section 23 and section 24 are concerned with the protection of national security and that the mutual exclusivity arises because section 24 is the subsidiary, safety net provision. We also agree that the specification of sections 23 and 24 in the alternative must be permitted to avoid adverse consequences of a significant nature. We discuss the substantive consequences of permitting specification in the alternative below.

56. We also return to the trilogy of Upper Tribunal authority on the nature and purpose of section 17 as set out in paragraphs 39 to 48. We repeat that we are satisfied that this authority supports the analysis advanced by both the [NAME] and the [NAME] in the present proceedings.

57. As was noted above, we have also been referred to the [NAME]’s guidance on the interaction of sections 23 and 24. Although the guidance document is not binding on us, we note that the [NAME], a key player in the FOIA scheme, permits [NAME] authorities to specify sections 23 and 24 in the alternative. We return to other aspects of the guidance below.

58. We are therefore of the view that the [NAME] was entitled to rely on sections 23(1) and 24(1) FOIA in the alternative, so as to protect the interests of national security by masking whether or not the information requested relates to one of the security bodies listed in section 23(3). Practical consequences 59. [NAME] submitted that permitting a [NAME] authority to specify sections 23(1) and 24(1) in the alternative would have adverse consequences for a [NAME]. He put that assertion in the following way in paras 31 and 32 of his written response to the [NAME] appeal:

31. Finally, one of the bases upon which the [NAME] commends its interpretation to the Upper Tribunal at §12(d) of its Grounds of Appeal is that it creates “no vice” in terms of the proper procedural working of FOIA.

32. This is not correct. By not having information about which exemption is relied upon, a [NAME] cannot make an informed decision about whether or not to pursue an appeal. This is critical given the difficulty in mounting a challenge to a s.23 exemption (as a result of it ordinarily being an absolute exemption) as opposed to mounting a challenge to a s.24 exemption, where the Tribunal will consider and weigh the [NAME] interest questions.

60. We agree that any challenge by a [NAME] to a [NAME] authority’s specification of exemptions in the alternative will be more complex where one of those exemptions is absolute and the other is qualified. However, the additional cost, time and work involved is not insurmountable. As noted above, the First-Tier Tribunal’s decision in [NAME] dealt with the specification of sections 23(5) and 24(2) in the alternative. The Tribunal observed as follows on the consequences of allowing the [NAME] authority to do that (at para 112): First, [NAME] argues that it is unsatisfactory to claim ss. 23(5) and 24(2) in tandem, as the [NAME] cannot know if the NCND exemption is said to be absolute (s.23(5)) or dependent on proof of harm and subject to the [NAME] interest balancing test (s.24(2)). Clearly, this puts [NAME] at some disadvantage, but such disadvantage stems from the nature of

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 20 secret material relating to national security. The disadvantage can be overcome by the [NAME] arguing (as, in [NAME], they have done) the balance of [NAME] interests in all cases in which both provisions are claimed. Beyond that, the remedy must lie with the Tribunal, in satisfying itself, with the benefit of having seen the material in question if any, whether an exemption has been properly claimed. (For s 24(2) we find that the information, if and to the extent that it exists, is subject to similar [NAME] interests and the same balance as we discuss below for s. 27.)

61. We agree. In any event, and leaving national security considerations aside, any challenge under FOIA of a refusal of a request for information can be costly, time-consuming and problematic. In [NAME], Judge Jacobs set out some of the principal difficulties as follows: 62. [NAME] emphasised the uncertainty that [NAME]'s interpretation would produce for those who request information. She was supported by [NAME] in pointing out the inconvenience and cost when the whole basis of a case is changed. I do not underestimate the sheer frustration, delay and financial cost that can be involved. [NAME]'s experience in DEFRA provides a graphic example. However, this is a matter of degree. The position of those who request information is inherently uncertain. They do not know the information and have to work partly in the dark. And the case may change significantly once the Commissioner has seen the information and served a decision notice. A change of position by the [NAME] authority may make little or no difference or it may make things worse, possibly considerably worse. The difference will vary from case to case. Moreover, the effect would be the same if the Commissioner or the tribunal exercised the discretion to allow the new exemption to be raised. Certainty would only be enhanced in those cases in which the discretion was not exercised. Looking at the matter overall, certainty is not a sufficient reason to bar a [NAME] authority from raising a new exemption without permission.

62. It is not simply that requesters may be faced with considerable uncertainty in circumstances where a [NAME] authority raises a new exemption late in the day. As [NAME] pointed out, there may be other situations in practice in which a [NAME]’s task may be made more onerous. A [NAME] authority may cite multiple exemptions, some absolute and some qualified. A [NAME] authority may be genuinely unsure as to which exemption applies and so cite two exemptions in the alternative. A [NAME] authority may specify an exemption which is not applicable on the current state of the law but where the authority wishes to overturn that orthodoxy in the current case and for the future. In all these situations (and [NAME]) the [NAME] may be put to extra work in challenging the refusal.

63. Furthermore, we recognise that in the [NAME] scheme requesters who receive adverse decisions from [NAME] authorities or the [NAME] may often be left in the dark as to the basis on which the decision was made e.g. where there is closed material or a closed judgment. It is in such cases that the respective roles of the [NAME] and the First-tier Tribunal come to the fore in scrutinising the arguments advanced in closed by the [NAME] authority. In any event, we repeat what we said at paragraph 55 above, namely that the specification of sections 23 and 24 in the

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 21 alternative must be permitted to avoid potentially adverse consequences of a significant nature. In that regard, the practical consequences for requesters in not knowing the whole basis on which the request was refused may be a small price to pay. They do not persuade us that, as a matter of law, a [NAME] authority is not permitted to state the exemptions in the alternative. The NCND provisions 64. We were also referred at various junctures to the NCND provisions that relate to the FOIA national security exemptions. It will be recalled that a [NAME] authority’s duty to comply with section 1(1)(a) of FOIA is known as the “duty to confirm or deny” (see section 1(6)).

65. However, section 23(5) of FOIA provides that “The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) which was directly or indirectly supplied to the [NAME] authority by, or relates to, any of the bodies specified in subsection (3).” 66. Section 24(2) in turn provides that “The duty to confirm or deny does not arise if, or to the extent that, exemption from section 1(1)(a) is required for the purpose of safeguarding national security.” 67. It was accepted on all sides that sections 23(5) and 24(2) were not mutually exclusive and could be properly cited in the alternative. In that regard we agree with the analysis of the First-tier Tribunal in [NAME] v [NAME] & FCO (EA/2011/0049-0051), as set out in paragraphs 91 to 109 of its decision (footnote omitted):

91. The right neither to confirm or deny under s.23(5) whether information is held has been claimed in this case together with s.24(2) S.24(1) “Information which does not fall within section 23(1) is exempt information if exemption from section 1(1)(b) is required for the purpose of safeguarding national security.” 92. However s.24 is a qualified exemption and subject to the [NAME] interest test.

93. The Tribunal has given careful consideration to whether the “Neither Confirm Nor Deny” provisions of s.23(5) and s.24(2) may be claimed together. In a series of Tribunal cases, starting with [NAME] authorities with responsibilities for security matters have routinely claimed both the s.23(5) and s.24(2) NCND provisions in respect of the same request. This enables the [NAME] authority to keep secret any involvement of a s.23 security body in a matter. The consistent use of ss.23(5) and 24(2) together ensure that requests made for similar information some time apart do not disclose, through whether both or only one of the NCND exemptions is claimed, if a s.23 body has acquired, or ceased to have, an involvement in a matter. 94. [NAME] argue that ss.23 and 24 are mutually exclusive adopting the arguments in [NAME] on Information Rights chapter 17, and that the NCND provisions of ss.23(5) and 24(2) cannot be used in the alternative, without identifying which exemption is actually in play. [NAME] argue that [NAME] was wrongly decided.

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 22 95. [NAME] was decided on the papers, without the benefit of oral submissions from counsel. Nevertheless, it has been followed in many cases since, and [NAME] authorities attach considerable importance to the ability to claim both NCND provisions together in matters where national security considerations are at stake. It will often be the case that information relating to national security has been supplied both by s.23 bodies and by other bodies, such as police forces, the Diplomatic Service or HM Revenue and Customs. These latter bodies may be covered by the qualified NCND provision of s. 24(2).

96. In the light of the submissions by [NAME], and the importance attached by [NAME] authorities to the ability to claim s.23(5) and s.24(2) together, the Tribunal has reviewed carefully whether the conclusion reached in [NAME] is one it can follow.

97. It is in the nature of the security services that much or all of what they do is necessarily secret. That is why s.23 is an absolute exemption. Necessary secrecy also extends to keeping secret the fact of whether a security body has an involvement with a matter. The Tribunal was taken to the dicta of [NAME] of [NAME] in the Supreme Court case of Regina (A) v Director of Establishments of the Security Service [2009] UKSC 12. This concerned the jurisdiction of the Investigatory Powers Tribunal. [NAME] spoke of: “the self-evident need to safeguard the secrecy and security of sensitive intelligence material, not least with regard to the working of the intelligence services” and of the need: “to protect the ‘neither confirm nor deny’ policy (equally obviously essential to the effective working of the services).” 98. The Tribunal attaches considerable importance to the availability of NCND in national security matters. The Tribunal does not need to consider whether [NAME]’s dicta is in any way binding upon us. It is sufficient to note his comments as an authoritative statement of a view we had reached independently on the evidence before us.

99. In support of [NAME]’s case that the s.24 provisions are an alternative to the s.23 provisions [NAME] points to the introductory words of s.24 which provide that “Information which does not fall within section 23(1) is exempt information if …”. This, she say, limits the scope of s.24 to information not caught by s.23. This argument requires s.24 to be read as a whole (i.e. as one single “provision” for FOIA purposes, rather than as separate provisions) and that it and s.23 are mutually exclusive. 100. [NAME] for the [NAME] submits that this argument must fail, as s.1(1) sets out two distinct types of right to information. First, there is the right “to be informed in writing by the [NAME] authority whether it holds information of the description specified in the request” (s.1(1)(a)). Second, there is the right “to have that information communicated to him” if it is held (s.1(1)(b)). This second right only arises where the first one is engaged. Where NCND is correctly applied, the first right is disapplied, and the second never comes into play.

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 23 101. The exemptions in Part II of FOIA therefore should not be read as single monolithic provisions. Rather, they consist of distinct provisions, some of which go to the first type of access right, and some to the second. S.24(1) is a provision which, in terms, concerns only the s.1(1)(b) right. It arises only where s.23(1) does not. S.24(2), however, is a separate provision, concerned only with the s.1(1)(a) right. It is not mutually exclusive with section 23(5). 102. [NAME] drew attention to the specific terms of the NCND provision at s.23(5). This is drawn more widely than many other NCND provisions in the Act in that it covers “information (whether or not already recorded)”. This contrasts with the definition of information in s. 84 “Information ... means information recorded in any form”. 103. The wider definition serves to protect information (which may not be recorded) that a s.23 body is not involved. Such information could be of value to a hostile agency, and the terms of s.23(5) put it beyond doubt that NCND may be used in such circumstances, rather than a simple denial. This serves further to reinforce the importance to be attached to the ability to make a NCND response. 104. It is in the nature of NCND that it covers circumstances in which information is not held, as well as circumstances in which information is held. It can be used to protect sources, and to avoid inferences being drawn from acknowledgement of the fact that certain information is not held. Moreover if NCND could not be used in circumstances in which information was not held, there would be little point in it, as it would then amount to an acknowledgement that information was held. 105. If no information is held, from either s.23 or s.24 sources, that absence of information is, by its nature, indivisible. As there is nothing to attribute separately to ss.23(5) and 24(2), it is logical to claim them together. 106. [NAME] further argues that, had Parliament intended the use of s.23(5) to debar the use of s.24(2) (or vice versa) it would have said so on the face of the Act. The Tribunal agrees. 107. First, it is common for a [NAME] authority to claim more than one exemption in respect of a single request for information. If Parliament had intended the exemptions in ss.23 and 24 to be an exception to this [NAME] rule, it would surely have said so. 108. Second, intelligence information, of the sort likely to be caught by ss.23 and 24, is often made up of fragmentary data. In its nature, it may come from multiple sources. The overwhelming importance of the ability to use NCND responses in relation to national security matters, and to do so in relation to information from all sources, renders it highly improbable that Parliament would have intended the use of these exemptions to be, uniquely, subject to greater restrictions than other exemptions. 109. Therefore the Tribunal concludes that a proper construction of ss.23 and 24 allows the NCND provisions of ss.23(5) and 24(2) to be claimed together, in relation to a single request for information. The words “information which does not fall within section 23(1)” are not to be read as

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 24 rendering the NCND provisions of ss.23(5) and 24(2) as mutually exclusive, but rather as a means of defining national security information which comes from sources other than the bodies named in s.23(3).

68. We are mindful that the First-tier Tribunal there was dealing with two exemptions which were not mutually exclusive. Nonetheless, in our view much of the reasoning underlying the conclusion that the NCND provisions could be relied on in the alternative applies equally in the context of the main provisions in sections 23 and 24.

69. However, the requesters submitted that the fact that sections 23(5) and 24(2) could be cited in the alternative by a [NAME] authority provided a simple and ready-made legislative solution to concerns about the revelatory problem. As such, they argued, there was no lacuna which justified a finding that the mutually exclusive sections 23(1) and 24(1) could also be specified in the alternative.

70. We found this a singularly unattractive argument for a number of reasons. First, it is by no means obvious that a [NAME] authority can rely on the NCND provisions where the mischief is not what would be revealed by confirmation or denial that the information is held, but rather the potential harm that could result from disclosure of the precise national security exemption relied upon. Second, reliance on the NCND provisions in the alternative would result in requesters being provided with even less information about the fate of their requests – they would not even know whether relevant information of any sort was held. As the Upper Tribunal observed in [NAME], “no doubt because of the expected and confirmed involvement of the security bodies a ‘neither confirm nor deny approach’ was correctly not advanced by the respondents under section 23” (at paragraph 60). Third, such a response would in some cases result in patent absurdity, e.g. where the very fact that material information was held was on the [NAME] record (for example, where the existence of files containing national security-related information has been revealed by TNA index searches). To that extent reliance on NCND instead of sections 23 and 24 in the alternative would undermine rather than further the legislative purpose of FOIA. More generally, the [NAME]’s right under section 1(1)(a) of FOIA to be told if information is held is respected by specification of sections 23 and 24 in the alternative, whereas both section 1(1) rights would be rendered nugatory by using NCND. The official guidance 71. We have referred above to the guidance issued by the [NAME] in September 2012 on How sections 23 and 24 interact (see paragraphs 35-38). [NAME] and [NAME] referred us to several passages in the guidance which they submitted supported their approach to the proper construction of section 17. For example, para 24 refers to “the problem of applying either section 23(1) or section 24(1)”; likewise para 26 refers to the “problem” being addressed by the fact that “the Commissioner will allow [NAME] authorities to cite both exemptions ‘in the alternative’ when necessary” (emphasis in the original). This is described as “the pragmatic solution to the problem” of undesirable disclosure (para 27). Furthermore, “technically section 17(1) requires [NAME] authorities to specify the exemption they are relying on. However, it is important in these circumstances that the refusal notice

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 25 effectively disguises which provision actually applies. Therefore, the Commissioner will accept a refusal notice which cites both exemptions, stating that they are being cited in the alternative and then explaining why each one could apply” (para 28).

72. In summary, the requesters argue that this shows that the Commissioner is assuming for herself the right to provide a discretionary solution to avoid an unfortunate problem which had not been foreseen by the drafters of FOIA. However, this submission falls into the trap of seeking to interpret an independent regulator’s guidance as if it were statute when such guidance is neither a source of binding law nor a formal aid to construction, but rather a regulator’s expert and independent view as to how to apply the law in practice. In addition, the requesters’ reading as to the significance of the use of the term “pragmatic” in paragraph 27 of the guidance and “technically” in paragraph 28 means those single words are doing a lot of heavy lifting.

73. We also recognise that previously, in March 2012, the Ministry of Justice had issued a document entitled Freedom of Information Guidance: Exemptions guidance – Section 23: information supplied by, or relating to, bodies dealing with security matters. Page 4 of that document included the following passage (emphasis added): Use of section 23(5) and 24(2) exemptions together In practice it is very rare that a neither confirm nor deny response will cite just section 23, as this will confirm that the question of whether or not information is held relates to one of the section 23 bodies. Therefore, to avoid releasing information about one of these bodies which has not already been released, it will be necessary to rely upon neither confirm nor deny under both section 23 and section 24. By using both exemptions it obscures the fact that a section 23 body may or may not have been involved. This is permissible in contrast to the application of section 23(1) and section 24(1) to withhold information that the duty under section 1(1)(b) applies to, where the exemptions are mutually exclusive, although there are instances where they may appear together to withhold different information. The ability to use section 23(5) and section 24(2) together in respect of the same information is important in order to maintain the principle that information about section 23 bodies is exempt. The use of section 24(2) requires full consideration of the [NAME] interest in disclosure (for more information see the detailed exemptions guidance on section 24).

74. Page 8 of the Ministry of Justice guidance included the following passage: Relationship with other exemptions There is nothing to prevent the use of other exemptions if a section 23 and/or a section 24 exemption is relied upon in relation to the same information. While section 23(1) and section 24(1) cannot be cited for the same information (except in the context of a neither confirm nor deny response) it is possible to use them in the same response cumulatively, i.e. if they apply to different information. 75. [NAME], in particular, relied on this brief document and these passages in support of the proposition that sections 23(1) and 24(1) could not be relied on in

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 26 the alternative. The short answer is that the Ministry of Justice guidance is just that, guidance. The mere fact that it omits what is often the standard official disclaimer in a foreword to the effect that the document is not intended to be a definitive statement of the law does not give it any added weight. The Ministry of Justice guidance is not an authoritative statement as to the proper interpretation of FOIA. It reflects no more than a civil service understanding of what the law is at a given point in time and cannot be regarded as an aid to construction. In any event, it is far from clear that the guidance contemplated the issue as identified by the example in the Commissioner’s own guidance. The human rights dimension 76. [NAME] resists the [NAME]’s appeal on an alternative basis, namely that the Upper Tribunal should interpret FOIA on the basis that his rights are engaged under article 10 of the European Convention on Human Rights (“the Convention”). Article 10(1) protects rights to freedom of expression and includes the right to receive and impart information and ideas without interference by a [NAME] authority. [NAME] submitted that it also includes a right of access to information. In so far as the interpretation of FOIA for which the [NAME] contended would permit the masking of an exemption, it would infringe the right of access to information. We should therefore reject that interpretation (Human Rights Act 1998, section 3) which would also be a matter of concern in light of the particular importance attributed to article 10 rights by Parliament (Human Rights Act, section 12).

77. In support of his submissions, [NAME] relied on the judgment of the Grand Chamber of the [ADDRESS] of Human Rights in [NAME] v Hungary (2020) 71 EHRR 2. In that case, the Court reviewed its previous case law and extended the scope of article 10 to include the right of access to information in certain circumstances. [ADDRESS] observed at paragraph 148: Thus…since the Convention was adopted the domestic laws of the overwhelming majority of Council of Europe member States, along with the relevant international instruments, have indeed evolved to the point that there exists a broad consensus, in Europe (and beyond), on the need to recognise an individual right of access to State held information in order to assist the [NAME] in forming an opinion on matters of [NAME] interest. 78. [ADDRESS] went on to hold at paragraph 156: In short, the time has come to clarify the classic principles. [ADDRESS] continues to consider that “the right to freedom to receive information basically prohibits a Government from restricting a person from receiving information that [NAME] wish or may be willing to impart to him”. Moreover, “the right to receive information cannot be construed as imposing on a state positive obligations to collect and disseminate information of its own motion”. [ADDRESS] further considers that art. 10 does not confer on the individual a right of access to information held by a [NAME] authority nor oblige the Government to impart such information to the individual. However, as is seen from the above analysis, such a right or obligation may arise, firstly, where disclosure of the information has been imposed by a judicial order which has gained legal force (which is not an issue in the present case) and, secondly, in circumstances where access to the information is instrumental for the individual’s exercise of his or her right to

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 27 freedom of expression, in particular “the freedom to receive and impart information” and where its denial constitutes an interference with that right.

79. We were left in some doubt as to how these passages in [NAME] are applicable to the issue before us. We are not now considering whether the requesters should be given access to any of the withheld information which will be a matter for the First-tier Tribunal when it comes to determine the substantive appeal. We agree with [NAME] that [NAME] does not deal with the question of what must be provided to a requestor by way of reasons for refusal to give access to information, which is all that we are being asked to decide. We do not regard [NAME] as establishing the procedural right to be informed in all circumstances and irrespective of any damage to the [NAME] interest of the reasons for withholding access to information.

80. Even setting aside these concerns, [NAME]’s submissions face the hurdle that they are inconsistent with the domestic approach to date. In [NAME] v [NAME] and the Cabinet Office [2020] UKUT 242 (AAC), the Upper Tribunal (Judge Wright) considered the effect of [NAME]. He held that the Tribunal was bound by the conclusion (albeit obiter dicta) of the majority of the Supreme Court in Kennedy v Charity Commission [2014] UKSC 20, [2015] AC 455 and of at least two members of the Court in British Broadcasting Corporation v [NAME] (No 2) [2012] UKSC 4, [2012] 1 WLR 439. Judge Wright held:

56. The respondents argue that although technically obiter I should follow the reasoning of Supreme Court in Kennedy on Article 10(1) of the ECHR on the basis that it was a point which was fully argued out before the Supreme Court and considered in great depth by it. In these circumstances the respondents argue that the Supreme Court’s view on Article 10(1) was at the “almost virtually binding” end of the spectrum of highly persuasive dicta: see APPGER v ICO and FCO [2015] UKUT 377 (AAC); [2016] AACR 5 at paragraph [49] and, to similar effect, Brunner v Greenslade [1971] Ch 993 at pages 1002- 1003. They further relied on R (Youngsam) v Parole Board [2017] EWHC 729 Admin; [2017] 1 WLR 2848 at paragraphs [20]-[40] for the proposition that where the Supreme Court has articulated a statement of principle, including on the interpretation and application of Convention rights, which was intended to be followed by all courts and tribunals of an inferior jurisdiction, it ought to be so followed, regardless of whether it is technically obiter.

57. From this starting point the respondents argue that subsequent caselaw of the ECtHR (in this case Magyar) which is contrary or different in material effect to the clearly reasoned view of the Supreme Court in Kennedy cannot alter the approach to precedent. Section 2(1) of the Human Rights Act 2000 – with its requirement on all domestic courts and tribunals to “take into account” any decision of the ECtHR when deciding a question which has arisen in connection with a Convention right – is simply that, so the respondents argue. It amounts to an obligation to take into account the ECtHR’s decision in Magyar but not to follow it where it conflicts with the (effectively) binding superior domestic court authority of Kennedy. The respondents relied for this aspect of their argument on [NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 28 v Lambeth LBC [2006] UKHL 10; [2006] 2 A.C. 465 and R (RJM) v SSWP [2008] UKHL 63; [2009] 1 AC 311. In the latter [NAME] said this. ‘64. As a matter of principle, it should be for this House, not for the Court of Appeal, to determine whether one of its earlier decisions has been overtaken by a decision of the ECtHR.’ 58. I agree with the respondents. 59.…Magyar has expanded the understanding of Article 10(1) so that as a matter of ECtHR law it now covers, albeit in limited circumstances, a right of access to information. This was not disputed before me. However, the view of five members the Supreme Court in Kennedy, as well as the Court of Appeal in Kennedy and two if not three members of the Supreme Court in [NAME] (No.2), in my judgment, is that domestic law does not consider Article 10(1) extends to include a right of access information, and I consider myself bound by the rules of precedent to follow this view.” 81. [NAME] submitted that we would be free to, and should, take a different view to the Supreme Court, given the obiter nature of the various relevant passages of [NAME] and the developments represented by [NAME] since those cases were decided. Nor should we regard ourselves as bound by the single-judge decision in [NAME] which had failed to recognise the development to the article 10 jurisprudence which [NAME] had established. We should take our lead from the Convention case law in accordance with the well-known dictum of Lord Bingham in R (Ullah) v Special Adjudicator [2004] UKHL 26, [2004] 2 A.C. 323, para 20: “The duty of national courts is to keep pace with the Strasbourg jurisprudence as it evolves over time: no more, but certainly no less”.

82. We decline to reach the conclusion that a right of access to information exists in English law. There is no binding domestic authority to that effect. We agree with the conclusion of Judge Wright in [NAME] and would gratefully adopt his reasoning which is detailed and thorough. We agree with [NAME] that there would be no purpose in revisiting the reasoning in [NAME] which would amount to revisiting the reasoning in [NAME] which followed full argument in the Supreme Court. We agree with [NAME] that [NAME]’s submissions in any event fail to deal with the qualified nature of article 10 rights and fail to deal with how the carefully calibrated scheme of FOIA yields any disproportionate interference with the rights in article 10(1) which would be a necessary condition of any infringement. We do not agree that anything in FOIA is capable of lessening (as opposed to enhancing) the right to information contained in sensitive material, and do not accept that the interpretation which we have reached is incompatible with the requesters’ article 10 rights 83. [NAME] submitted that the [NAME]’s interpretation would be incompatible with article 6(1) of the Convention which guarantees the right to a fair trial in relation to the determination of a person’s civil rights and obligations. Even assuming that the right of access to information were to engage a civil right in some fashion, we were left unclear as to how the scheme of FOIA breaches any fair trial right. [NAME] submitted that tribunal proceedings would be unfair if the requestor had to mount hypothetical arguments about one limb of a section 17 notice which would not represent the [NAME] authority’s true reason for withholding information. That submission ignores the scrutiny which both the

[NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) [NAME] & [NAME] 29 independent [NAME] and the First-tier Tribunal provide, and their ability to probe [NAME] authorities in order to ensure that the FOIA exemptions are properly and lawfully applied. We have already rejected the submission that the additional burdens of litigation (such as they are) would be sufficient to overcome the risk to national security that the requestors’ submissions entail. We were provided with no other particularised example of a potential article 6 breach that the legislation would engender if interpreted in accordance with [NAME]’s submissions. We would reject this part of [NAME]’s challenge.

84. Finally, we disagree with [NAME]’s characterisation of the [NAME]’s position as condoning untrue or misleading decisions by [NAME] authorities. Anyone reading a decision founded on section 23 or section 24 in the alternative will appreciate – or can find out – that he or she cannot receive certain information because it is information supplied by, or relating to, bodies dealing with security matters, or exempt from disclosure on national security grounds. The individual would not know which of the exemptions applied but there would be nothing untrue or misleading. We regard this part of [NAME]’s submissions as inaccurate.

Conclusion 85. For all these reasons, we conclude that the exemptions in sections 23(1) and 24 may as a matter of law be specified under section 17 in the alternative and that the national security imperative will permit this in practice. Accordingly, the [NAME]’s appeal is allowed.

Mrs Justice Farbey DBE Chamber President

Kenneth Mullan Judge of the Upper Tribunal

Nicholas Wikeley

Judge of the Upper Tribunal

Authorised for issue on 1 October 2021