Upper Tribunal Upholds Essex Police's Refusal to Confirm Information

OUTCOME: Dismissed

TS v (1) The [NAME_1] (2) The Chief Constable of Essex Police [2016] UKUT 0455 (AAC)

GIA/2041/2014

1

IN THE UPPER TRIBUNAL

Case No: GIA/2041/2014 ADMINISTRATIVE APPEALS CHAMBER

DECISION BY THE UPPER TRIBUNAL (ADMINISTRATIVE APPEALS CHAMBER)

The DECISION of the Upper Tribunal is to dismiss the appeal.

The decision of the First-tier Tribunal (General Regulatory Chamber) dated 7 February 2014 does not involve an error on a point of law. The appeal is therefore dismissed.

This decision is given under section 11 of the Tribunals, Courts and Enforcement Act 2007.

REASONS

Introduction

1. The principal point of interest in this appeal lies in whether the First-tier Tribunal [“the FTT”] failed to examine carefully the reasoning behind the [NAME_1]’s Decision Notice as to whether data was or was not the personal data of the Appellant [[NAME_2]] and thus erred in law by reaching a conclusion on the basis of inadequate and indeed inaccurate reasoning. In this case, the [NAME_1] [“[NAME_1]”] had decided that the requested information did not constitute the Appellant’s personal data and thus his Decision Notice focussed on the reliance by the public authority - Essex Police – on section 40(5)(b)(i) of the Freedom of Information Act 2000 [“FOIA”] as a basis for its refusal of information to the Appellant. During the course of this appeal [NAME_1] conceded that the requested information did in fact constitute the personal data of the Appellant in addition to that of a third party. If the information was the Appellant’s personal data all along, was the tribunal in error of law in reaching the decision it did?

2. It is clear that the ownership of this data was an issue upon which the two Respondents were at odds in this appeal. Essex Police maintained that the data requested was entirely unconnected to the Appellant and thus reliance alone on section 40(5)(b)(i) of FOIA was entirely accurate. The requested data was the activations of Essex Police’s Automatic

GIA/2041/2014

2 Number Plate Recognition [“ANPR”] system in relation to a particular vehicle during the entirety of 28 February 2008.

3. I conclude that, first, the data requested did constitute the Appellant’s personal data along with that of a third party. However, this had no material impact on the outcome of this appeal before the FTT since the tribunal correctly concluded that it would be unfair to process the same by way of confirmation or denial. The fact that the information would also be personal data of the Appellant would only have provided a further and more absolute basis – namely reliance on section 40(5)(a) of FOIA – to refuse the appeal.

4. I gave permission to appeal on other grounds but these are of less significance. I deal with these grounds toward the conclusion of these Reasons. None of them founds the basis for a successful appeal against the tribunal’s decision.

5. The Appellant, [NAME_2], represented himself. [NAME_1] was represented by [NAME_3] of counsel and the Chief Constable of Essex Police (acting in the interests of that force) was represented by Mr [NAME_4] [NAME_4] of counsel. I am grateful to all of them for their written arguments which I have found enormously helpful. With the agreement of the parties, it has not been necessary for me to hold an oral hearing of this appeal.

6. I have read the First-Tier Tribunal and the Upper Tribunal bundle carefully before coming to my conclusions.

Background

7. What follows is a summary pertinent to this appeal. The requester and Appellant was [NAME_2]. [NAME_2] is a serving prisoner having been convicted of conspiracy to rob following trials in 2009 and 2010. He maintains his innocence of the charges on which he was convicted and states that the activities which led to his arrest – following a cash transit van – represented research for a book which he was writing. I should mention that [NAME_2] was, prior to his conviction, a writer specialising in stories of true crime focussed on professional armed robbery. He had published a number of books and had also made media appearances in connection with his writing.

8. On 28 February 2008 [NAME_2] claimed that he was conducting research for a book and that, as part of that research, he was the driver of a Vauxhall Vectra car number plated R529VLH and was following an old type [NAME_5] cash-in-transit van in Basildon, Essex. The owner and registered keeper of the Vauxhall Vectra was [NAME_2]’s passenger. [NAME_2] claimed to have followed the Loomis van through Basildon and then along the A127 towards London. He said he

GIA/2041/2014

3 eventually stopped following that vehicle, having turned off the A127 towards Brentwood. [NAME_2] and his passenger were later arrested and charged with conspiracy to rob. It was [NAME_2]’s case that Essex Police tampered with the evidence at his trial by substituting details of a newer van model for the old Loomis van he says he was following. When he sought disclosure of archive CCTV footage and ANPR data to support his version of events, he claimed that Essex Police suppressed the evidence and fabricated ANPR data via the police “Holmes” computer system. In short, he said he was deprived of a fair trial as part of a police “fit-up”.

9. [NAME_2] made a FOIA request on 11 April 2012 to Essex Police. The request [“the Request”] was in these precise terms: a) According to the National ANPR Data Centre [NADC – my addition], all ANPR data which is generated by automatic number-plate readers in Essex, belongs to and is owned by the Chief Constable to Essex Police. The NADC are merely the “controllers” of the data. b) On that basis, please can you provide me with the archive national ANPR details for all activations in relation to Vauxhall Vectra (index R529VLH) in Essex on 28 February 2008, in which it was confirmed by Essex Police that I was a passenger on that particular day. c) Should it be the case that this ANPR data has become deleted from the NADC database, please can you inform me, on whose authority was the data deleted and the precise date of the deletion. d) Just so there is no ambiguity or confusion as to the correct registration of the vehicle and the precise date of the information required. It is Vauxhall Vectra “Romeo-five-two-nine-Victor-Lima-hotel” on the Twenty- eighth of February Two-thousand-and-eight (see page 01 in the bundle attached).

10. Essex Police refused to confirm or deny whether it held this information. In refusing this Request, Essex Police relied on section 40(5)(b)(i) of FOIA, namely that confirming or denying would contravene the data protection principles.

11. [NAME_2] contacted [NAME_1] on 31 July 2012 to complain about the way his request for information had been handled. For the reasons set out in his Decision Notice dated 27 June 2013, [NAME_1] found that Essex Police were entitled to rely on the exemption in section 40(5)(b)(i) of FOIA. [NAME_2] appealed to the FTT on 9 July 2013.

The Tribunal Decision

12. The FTT considered the appeal on the papers alone as had been

agreed by [NAME_2] and [NAME_1], Essex Police playing no part in the

proceedings. On 7 November 2014 the FTT dismissed the appeal,

agreeing with [NAME_1] that the refusal by Essex Police to confirm or

deny whether information was held in reliance on section 40(5)(b)(i) of

GIA/2041/2014

4

FOIA was lawful since to do so would contravene the data protection

principles in relation to the personal data of a third party.

13. The FTT noted the background to the [NAME_2]’s belief

that the information would assist him to demonstrate that he was the

victim of a miscarriage of justice. It noted that [NAME_2] appeared to

have, in fact, obtained the requested information during the course of

the criminal proceedings against him. On 24 April 2009 the Crown

Prosecution Service had informed [NAME_2]’s solicitors that Essex

Police had no ANPR records for a vehicle registered as R529VLH

travelling on 28 February 2008. The FTT noted that, even if this were

so, [NAME_2] was still properly entitled to make the Request as

disclosure in response to a Request was disclosure to the world at

large.

14. The FTT identified that the issue was whether confirming or denying

if the information was held would breach the data protection principles

because the information would reveal personal data of the registered

keeper of the vehicle. [NAME_1] had held that disclosure would be unfair

and thus would breach the first data protection principle. The FTT ruled

that fairness required a balance of the interests at play but the interests

of the data subject required a high degree of protection [see paragraph

28 of the FTT’s Reasons].

15. The FTT considered whether the information was already in the public

domain by reason of the criminal trial and concluded that it was not.

The personal data of the third party was not specifically referred to in

any of the newspaper reports about both trials and was not mentioned

in the Indictment. The FTT found that there was “nothing to suggest

that the allegation that the vehicle in question was being driven in

Essex on that day was so fundamental to the charge against [NAME_2]

and the third party that the fact of the trial and the convictions can be

said to have put that information into the public domain” [paragraph 29,

FTT Reasons]. There would thus be some harm to the third party if the

information were to be disclosed in response to a FOIA request though

that harm – an invasion of privacy - would be relatively minor given that

the information had been part of a criminal trial.

16. The FTT endorsed the general expectation that information of this

nature, being personal data, would not be disclosed by a public

authority without a strong competing public interest in favour of

disclosure. Each case had to be considered on its particular facts in

order to determine whether disclosure would be fair in relation to the

subject of any personal data [paragraph 32, FTT Reasons].

17. Having regard to the competing interests in favour of disclosure, [NAME_2] stated that the requested information would help him challenge

his conviction and expose the wrong-doing of Essex Police. The FTT

GIA/2041/2014

5

accepted that, if [NAME_2] had been wrongfully convicted, this would be

a matter of considerable public interest. However the FTT held that it

was beyond its remit to make findings on such an issue and that there

was no proper evidence before it which would support such a finding.

There were other and more appropriate channels for [NAME_2] to seek

redress of any miscarriage of justice in relation to his conviction. It

observed that “the mere allegation that he has been wrongfully

convicted is not enough to outweigh the interest of the data subject”

[paragraph 33, FTT Reasons].

18. The FTT concluded that, although on the particular facts the invasion of

privacy would not be considerable, disclosure would not be fair. It was

thus not necessary to consider whether any conditions in Schedule 2 of

the Data Protection Act 1998 [“the DPA”] were met.

The Appeal to the Upper Tribunal

19. The First-tier Tribunal refused permission to appeal on 24 March

2014. [NAME_2] then applied to the Upper Tribunal for permission to

appeal on 15 April 2014 and Upper Tribunal Judge Jacobs refused

permission to appeal on the papers on 22 May 2014. As provided for

by rule 22(4)(a), [NAME_2] applied for his application to be reconsidered

at an oral hearing. His request was granted by Upper Tribunal Judge

Lloyd- Davies on 12 August 2014 and a hearing was listed to take

place before me on 29 January 2015. Unfortunately that hearing had

to be postponed because of problems transporting [NAME_2] from

prison to court.

20. Having reviewed the papers in preparation for the hearing I directed

some written submissions from [NAME_1] on a legal issue which had not

hitherto been contentious. I observed that [NAME_2], [NAME_1] and the

FTT had all accepted that the information which might be revealed by

Essex Police constituted the personal data of a third party. What did

not appear to have been considered is whether that information would

also constitute personal data belonging to [NAME_2] because either (a)

that information was processed by Essex Police during the course of

an investigation in order to learn something about both the third party

and [NAME_2] and/or (b) the third party’s personal information was

personal data affecting another individual.

21. In response to that direction, [NAME_1] filed submissions which accepted

that the information requested by [NAME_2] did in fact constitute both

his personal data and the personal data of the third party. In those

circumstances he stated that the exemption in section 40(5)(a) of FOIA

would also apply, since the requested information was personal data of

which [NAME_2] was the data subject. If that exemption did apply, [NAME_1] said it would have been more appropriate for [NAME_2] to seek it by

means of a subject access request pursuant to section 7 of the DPA.

GIA/2041/2014

6

22. At my invitation, [NAME_2] made written submissions in response to [NAME_1]’s concession. In summary these made reference to a subject

access request he had made to Essex Police in July 2012 for his

personal data. He said that he never formally made that application

since Essex Police told him on 31 July 2012, “before you submit your

application, that Essex Police will not provide you with any information

that relates to Automatic Number Plate Recognition (ANPR) systems

under the Subject Access Process” [Upper Tribunal bundle (UTB),

page 51]. [NAME_2] interpreted the response to his Subject Access

Request as sinister and suggested that his Request for information had

been re-routed down the wrong processing pathway by Essex Police in

order to provide sufficient time for the data to be automatically

deleted. I note that the automatic weeding facility for ANPR data was

enabled in April 2012 and prior to this date police forces were given the

opportunity to request the extraction of any data they required to be

retained [UTB, page 52].

23. Unfortunately, for a variety of logistical reasons, it was not possible to

arrange a hearing other than by way of telephone until 26 November

2015. [NAME_1] indicated that he did not wish to participate in that hearing

and so I heard from [NAME_2] alone. I granted permission to appeal

limited to the grounds set out in my ruling and reserved my position as

to whether Essex Police should be joined as a party to the proceedings

until I had read the submissions of [NAME_1]. Having considered those

submissions and with the consent of both [NAME_2] and [NAME_1], I joined

Essex Police as a party to this appeal on 22 April 2016.

24. After setting out the legislative framework, I will deal with the main

grounds of appeal in order of importance.

The Legislative Framework

25. Section 1(1)(a) of FOIA states that a person making a request for

information is entitled to be told in writing whether the public authority

holds that information. Section 1(6) refers to this as the public

authority’s duty to confirm or deny. If the information is held and none

of the exemptions in FOIA apply, the public authority should

communicate the information to the requester. The issue was whether

Essex Police was required to confirm or deny that it held the

information requested or whether it was exempt from the duty to do so

by reason of the provisions of section 40 of FOIA.

26. Section 40(1) provides that any information to which a request for

information relates is exempt information if it constitutes personal data

of which the applicant is the data subject. Section 40(5) reads as

follows:

“The duty to confirm or deny -

GIA/2041/2014

7

(a) does not arise in relation to information which is (or if it were held by

the public authority would be) exempt information by virtue of

subsection (1) and

(b) does not arise in relation to other information if or to the extent that

either –

(i) the giving to a member of the public of the confirmation or denial that

would have to be given to comply with section 1(1)(a) would (apart

from this Act) contravene any of the Data Protection Principles or

section 10 of the Data Protection Act 1998 or would do so if the

exemptions in section 33A(1) of the Act were disregarded, or

(ii) by virtue of any provision of Part IV of the Data Protection Act 1998

the information is exempt from section 7(1)(a) of that Act (data

subject’s right to be informed whether personal data being processed).”

27. The effect of section 40(5)(b)(i) is that if, by simply confirming or

denying that it holds the information, any of the data protection

principles or section 10 of the DPA (processing likely to cause damage

or distress) would be contravened, the public authority is exempt from

the duty to do so.

28. The first data protection principle provides that personal data shall be

processed fairly and lawfully and in particular shall not be processed

unless at least one of the conditions in Schedule 2 of the DPA is met.

The term “process” is defined in section 1 of the DPA and includes

disclosure to a third party or to the public at large.

29. Finally, the definition of personal data is set out in section 1(1) of the

DPA. It is:

“data which relates to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of,

or is likely to come into the possession of the data controller,

and includes any expression of opinion about the individual and any

indication of the intentions of the data controller or any other person in

respect of the individual.”

That definition imposes two requirements: identifiability and the

relation between the individual and the data.

Grounds 4 and 5

30 When giving permission to appeal, I noted that the FTT had jurisdiction

to undertake a full review of the merits of [NAME_1]’s decision and to

substitute its own view if it considered that [NAME_1]’s decision was wrong.

[NAME_1]’s Decision Notice determined that the requested information did

not constitute [NAME_2]’s personal data. Given that [NAME_1] had

conceded that the information did constitute [NAME_2]’s personal data, I

considered it arguable that the FTT failed in its inquisitorial function to

examine carefully the reasoning behind the Decision Notice about the

GIA/2041/2014

8

nature of the data in question. It simply failed to address it. That had

some relevance since the FTT might have found the information should

have been sought via a Subject Access Request pursuant to section 7

of the [NAME_2] could have been advised accordingly. If that

were the case, the FTT might also have made enquiry as to whether

Essex Police had provided appropriate assistance and advice to [NAME_2] when he made his request for information in accordance with its

duty under section 16(1) of FOIA.

The Parties’ Arguments

31. [NAME_1] conceded that the requested information was also [NAME_2]’s

own personal data. In so doing, he had regard to the context of the

Request; noted that the Request specifically stated that [NAME_2] was

a passenger in the vehicle at the relevant time; considered that

confirmation or denial would reveal (a) the precise times at which [NAME_2] and the third party were at specific locations and (b) that Essex

Police were or were not investigating the activities of the vehicle; and

considered that, in the light of this, the information was indeed the

personal data of [NAME_2] as well as the third party. He submitted that,

in those circumstances, section 40(5)(a) of FOIA also applied so as to

exempt Essex Police from the duty to confirm or deny.

32. Further he submitted that the FTT had not erred in law by not

investigating the matter since there was a well-established convention

that, where a matter is not in issue, a tribunal has no obligation to go

behind the parties’ agreement on that matter. [NAME_2]’s Notice of

Appeal disclaimed any reliance as to whether or not the DPA regime

was more appropriate than the FOIA regime. Indeed, [NAME_1] said this

was not a case where the applicability of the DPA was obvious.

Confirmation or denial of the fact that Essex Police held a licence plate

number would on its own only identify personal data of the

registration holder. It was only in combination with the Request, stating

that [NAME_2] was a passenger in the car at the relevant time, that it

was apparent that confirmation or denial might also reveal [NAME_2]’s

personal data. Finally, given that both sections 40(5)(a) and 40(5)(b)(i)

were absolute exemptions, [NAME_2] would not have been assisted in

obtaining the information by an FTT decision either that section

40(5)(a) applied or any consideration whether Essex Police had

complied with its duty to provide advice or assistance to him. The

chronology showed that Essex Police had in fact given [NAME_2]

information about the possibility of a Subject Access Request under

the DPA and had expressed its view about the likely outcome of such a

request.

33. Essex Police accepted that it had not found it easy to determine

whether the requested information was [NAME_2]’s personal data at all.

It was accepted that, where [NAME_2] was identifiable from the context,

GIA/2041/2014

9

that context also revealed something about him but it was submitted

that this link might not be sufficient to warrant classification as

biographical information in a significant sense (applying the leading

authority of Durant v Financial Services Authority [2003] EWCA Civ

1746). If [NAME_1]’s concession was correct, this had no material impact

on the outcome of the appeal.

34. Essex Police submitted that the information would be mixed personal

data – of [NAME_2] and the third party – and, in those circumstances,

the data controller was not obliged to attempt an analysis as to which

of them was the more significant and then to recognise that person’s

right to protection. Upholding the exemption by reference to the

information being the personal data of a third party was a complete

answer to [NAME_2]’s appeal. The fact that it was also his data would

only have provided a further lawful basis on which to refuse the appeal.

35. Finally Essex Police agreed with [NAME_1] that the FTT was not obliged to

go behind the manner in which the appeal was put by the parties.

There was no need to consider this matter where the issue which the

parties did want determining had the effect of resolving both issues.

There was no error of law or alternatively none which was material to

the outcome.

36. For the avoidance of doubt, Essex Police denied any police

wrongdoing.

37. [NAME_2]’s submissions focussed in considerable detail on the process

whereby he came to be convicted and on what he considered to be a

less than adequate response to requests for information made by both

him and by his legal team of Essex Police during the course of the

criminal trial. He averred that Essex Police had failed to fulfil its

statutory function to provide advice and assistance to him pursuant to

s.16(1) of FOIA. Essex Police had sent him down the wrong data

request access pathway – that was a means to stall him so that it could

expunge the ANPR data relating to his case.

The Upper Tribunal’s Analysis

38. It is no part of my role to pass an opinion on the overall conduct of

Essex Police towards [NAME_2] nor to venture any opinion on either the

merits of or the circumstances surrounding his conviction.

39. Was [NAME_2]’s Request for his own personal data? In determining

whether information constituted personal data, [NAME_4] referred me

helpfully to the relevant case law. When determining whether

information constitutes personal data because of the likelihood of

identification, the tribunal’s approach should be to take account of “all

the means likely reasonably to be used either by the controller or by

GIA/2041/2014

10

any other person to identify the said person”. This is the wording of

recital 26 of directive 95/46/EC which formed the basis for the DPA and

which was adopted by Judge Mullan in Information Commissioner v

Magherafelt District Council [2012] UKUT 263 (AAC) at paragraphs

63,79, and 86. It is also necessary for the FTT to consider the context

in which the data appears (see paragraph 18 of the decision of Judge

Jacobs in [NAME_6] v [NAME_1] & London Fire and

Emergency Planning Authority [2014] UKUT 310 (AAC)). It must also

follow that the Request itself forms part of the context against which

identification takes place.

40. Durant v Financial Services Authority [2003] EWCA Civ 1746 continues

to be the leading authority on whether data “relates” to an individual so

that it is personal data. To summarise: first, the information must be

biographical in a significant sense and second, it must have the

putative data subject as its focus. Thus it must be possible to identify a

living individual and that person must either be among the focuses of

the information or the information must be biographical in a significant

sense [see the analysis of Auld LJ in paragraph 28 of Durant]. [NAME_4] suggested that another way of thinking about this test was to

consider (a) if the information said anything non-anodyne about an

individual or (b) if the individual was merely incidental to or a bit-part in

that information.

41. In this case, Essex Police accepted that [NAME_2] was identifiable from

the context and that the context also revealed something about him.

However, it submitted that the link was insufficient to warrant

classification as biographical in a significant sense. At most

confirmation or denial might tell the public that [NAME_2] was in a

vehicle in Essex on a particular day which was picked up on ANPR

camera(s). Where the car did not belong to [NAME_2] and there was

nothing to suggest how long he was inside the vehicle, Essex Police

submitted that “it was something of a stretch” to say that confirmation

or denial could affect his privacy in a material sense.

42. [NAME_1] submitted that confirmation or denial of whether the information

was held at the time of the Request would effectively reveal the precise

times at which [NAME_2] and the third party were at specific locations

and, importantly, that the police were or were not investigating the

activities of the vehicle and who was travelling in it at the relevant time.

This was because it was likely that the information would have been

deleted if the police had not been processing that information for

investigatory purposes.

43. [NAME_2] submitted that the requested material was clearly his

personal data as well as that of the third party. He emphasised the

fact that he was actually the driver of the vehicle rather than the

passenger but I have decided nothing material turns on that issue

GIA/2041/2014

11

when considering if the requested information was also his personal

data.

44. On this issue, I accept in large part the submissions of [NAME_1]. The

Request made clear that [NAME_2] was an occupant of the named

vehicle on the date in question. He was thus identifiable from the

context. Confirmation or denial that, at the time of making the

Request [my emphasis], Essex Police held the ANPR data requested

would have revealed that the police were or were not investigating the

activities of the vehicle and by implication, the activities and identities

of both of its occupants. Given those circumstances, it is difficult to

envisage that the requested information was not biographical about

[NAME_2] in a significant sense. To use [NAME_4]’s suggested test, [NAME_2] was not merely incidental to the information and it said

something non-anodyne about him, namely that he might or might not

be the subject of a police investigation. The context and the timing of

the Request are the two crucial factors which drive my analysis, in the

circumstances of this case, towards the conclusion that the requested

data was also [NAME_2]’s own data. However, I find that [NAME_1] goes

too far in suggesting that confirmation or denial would effectively

reveal the precise times at which [NAME_2] and the third party were at

specific locations since the Request makes reference only to

presence in Essex in a vehicle on a particular date.

45. What is the effect of that analysis on the FTT’s decision? There are two

issues to consider: (a) the way in which the FTT approached its task on

appeal and (b) the effect in law of a finding that the requested

information also constituted the personal data of [NAME_2].

46. I have been referred to case law about the function of the FTT and

accept that this is at least, in part, investigatory rather than adversarial

[see paragraph 33 of [NAME_6] v [NAME_1] and the

Department for Business, Innovation and Skills [2014] EWCA Civ

1050]. I also accept that it is the task of the FTT to decide the

case before it unless it sees reason to investigate further.

47. In this case [NAME_2] did not dispute that the requested information

would constitute the personal data of a third party. His Notice of Appeal

disclaimed reliance on any issue as to whether or not the DPA regime

was more appropriate than the FOIA regime. [NAME_1] also submitted

that this was not a case where the applicability of the DPA was obvious

since it was only apparent that confirmation or denial might also reveal

[NAME_2]’s personal data when considering the information requested

in combination with the Request itself.

48. [NAME_2] contended that the FTT erred in law on this issue and he

relied on what he said was the FTT’s failure to address the evidence of

alleged police wrong-doing. Unfortunately that submission does not

GIA/2041/2014

12

grapple with the issues of law I have to address. The FTT had to

consider the applicability of section 40(5) to the requested information

– the complex history of dealings between [NAME_2]

was not a matter on which it was necessary for the FTT to either find

facts or to express a conclusion.

49. I disagree with [NAME_1] that the applicability of the DPA was not obvious.

In coming to that view I accept that the [NAME_6] decision - relating to

the context in which the requested data appears - post-dated the

decision under appeal. However, I note that the tribunal asked itself the

following in paragraph 26 of its Reasons:

“In our view, the proper starting point is to identify what personal data

would be disclosed if the Public Authority were to confirm or deny

whether it holds the requested information”.

The tribunal went on to analyse what the ANPR data might reveal but it

is clear that its conclusions were shaped by the parties’ agreement that

the information was the personal data of the registered owner. I find it

very surprising that the FTT did not, when undertaking the task it had

set itself, ask whether the requested data also constituted the personal

data of [NAME_2]. It knew he was an occupant of the vehicle and had

clear evidence before it to that effect. The test in Durant would have

been well known to it. Identifying what personal data might be

disclosed also, as a matter of logic, engages consideration of whose

personal data that might be.

50. Ultimately, however, I observe that the manner in which the FTT

approached its task will be of no consequence unless the effect in law

of a finding that the requested data was also [NAME_2]’s data would

have altered the tribunal’s ultimate conclusion, namely that Essex

Police did not have to disclose the information.

51. There can be no doubt that the data was both that of [NAME_2] and of

the third party, that is, mixed personal data. [NAME_1] v [NAME_1] (EA/2008/0001) supports the proposition that if

information incorporates the personal data of more than one person,

the data controller is not required to attempt an assessment as to

which of them is the more significant and then to recognise the rights to

protection of that individual and ignore the rights of the other data

subjects. Thus, applying [NAME_1], the presence of [NAME_2]’s data in

the requested information made no difference to the FTT’s

conclusion that the exemption in rule 40(5)(b)(i) should apply as the

information was personal data of a third party.

52. Further, if the requested data was also the personal data of [NAME_2],

the FTT could also have lawfully dismissed the appeal on the basis that

the exemption in section 40(5)(a) applied. Thus, I conclude that any

error of law on the part of the FTT about the nature of the

information was immaterial to the outcome of this appeal.

GIA/2041/2014

13

53. Finally, in my grant of permission I suggested that, if the requested

data was also personal data which should have been the subject of a

Subject Access Request, [NAME_2] could have been advised

accordingly and enquiry might have been made by the FTT as to

whether Essex Police had provided appropriate advice to him in

accordance with its duty under section 16(1) of FOIA when he made

the Request.

54. Having reviewed the material in the FTT bundle, I have come to the

conclusion that Essex Police did, for example, provide advice to [NAME_2] about requesting his personal data under the DPA in its letter

dated 19 July 2012. Indeed, the lengthy correspondence between all

three parties prior to the FTT appeal concerned whether the request

was made under the DPA or FOIA and thus which was the appropriate

approach to the appeal. It is also clear that [NAME_2] had in the past

made a number of Subject Access Requests to Essex Police and

clearly knew of this parallel route as a means to obtain information.

55. Given my conclusion set out in paragraph 52, there is nothing of

substance in ground 5 of my permission grant. I hereby dismiss

grounds four and five of my permission grant.

Grounds 1 and 2

56. I considered that it was arguable that the FTT had failed to apply the

test of “reasonable necessity” in condition 6(1) of Schedule 2 to the

DPA and had instead applied a public interest test and, further, that it

had erred either (a) in failing to apply the test set out in Goldsmith

International Business School v the [NAME_1] and the

Home Office [2014] UKUT 563 or (b) by providing inadequate reasons

for its decision.

57. Section 40(5)(b)(i) engages consideration as to whether the data

protection principles would be contravened by disclosure of the

requested information. As previously noted, the First Data Protection

Principle sets out three requirements for the processing of non-

sensitive personal data. Processing must be fair, lawful and must not

be done unless at least one of the conditions in Schedule 2 is met. If

processing is not fair or lawful, the first data protection principle is

breached regardless of whether a Schedule 2 condition is satisfied.

58. Here both [NAME_1] and the FTT considered the question of whether

disclosure of the personal data would be fair and concluded it would

not. The FTT considered the merits when reaching its conclusion and

thus stated that it did not need to consider whether any conditions in

Schedule 2 were met.

GIA/2041/2014

14 59. I accept the submissions made by [NAME_1] that the

FTT’s review of the merits on the issue of fairness and its conclusion in

that regard was a decision properly open to it and not erroneous in law.

In those circumstances, it was not necessary for it to consider

Schedule 2 or the test in Goldsmith. I also accept that the FTT did not

err in applying a form of public interest balance when deciding the

question of fairness. It considered the harm to the third party; that

party’s reasonable expectations; and the countervailing public interest,

all of which were proper matters for it to take into account.

60. I note that [NAME_2] did not make detailed submissions on these

grounds.

61. I dismiss grounds one and two.

Ground Three

62. I questioned whether the FTT could have been improperly influenced

by its belief that [NAME_2] had other more appropriate channels

available to him to seek redress for a claimed miscarriage of justice. I

was unclear about the evidential foundation for that finding.

63. The FTT noted that [NAME_2] had set out at length his arguments in

favour of disclosure which he said would help him challenge his

conviction and expose police wrong-doing. It also noted the view of [NAME_1] that challenging his conviction was a personal interest and exposing

police wrong-doing was speculative.

64. The FTT accepted that there was a public interest in reversing wrongful

convictions but it had no jurisdiction to determine whether [NAME_2]

had been wrongfully convicted. It went further by stating that there was

no proper evidence before it that could support the proposition that [NAME_2] had been wrongfully convicted. There were other more

appropriate channels for [NAME_2] to seek redress for any miscarriage

of justice. The mere allegation that he had been wrongfully convicted

was insufficient to outweigh the interest of the data subject given

that there might be some harm to the data subject flowing from

disclosure.

65. I accept that the FTT would have been aware of the routes whereby

miscarriages of justice might be challenged. [NAME_1] supported by

Essex Police, drew my attention to the FTT’s finding that, despite the

public interest in reversing wrongful convictions, there was no evidence

before it to support the proposition that [NAME_2] had been wrongfully

convicted. I agree those were findings which he says the FTT were

entitled to make on its review of the material before it and were

sufficient to found its conclusion that [NAME_2]’s beliefs did not

GIA/2041/2014

15

constitute a public interest in disclosure that could outweigh the

interests of the third party.

66. On reflection, I accept those submissions. I have considered carefully

the submissions made by [NAME_2] which centre on his bluntly

expressed belief that Essex Police have behaved wrongfully by “fitting

him up”. I reiterate that I express no view on that allegation and nor am

I in a position to make findings on it. I can only consider whether the

FTT erred in law in its approach to the balancing exercise on this

issue. For the reasons set out in paragraph 65, I have come to the

clear conclusion that this ground of appeal has no merit and

accordingly I dismiss it.

Conclusion

67. I have determined that the FTT did not materially err in law when

reaching its decision in this appeal and I dismiss this appeal for the

reasons I have given.

[NAME_7] QC Judge of the Upper Tribunal 11 October 2016.

[signed on original as dated]