Upper Tribunal Upholds FOIA Exemptions for Personal Data

[NAME] v [NAME] and [NAME] [2023] UKUT 80 (AAC)

1

IN THE UPPER TRIBUNAL Appeal No. UA-2022-001075-GIA ADMINISTRATIVE APPEALS CHAMBER

On appeal from the First-tier Tribunal (General Regulatory Chamber)

Between: [NAME] Appellant - v -

The [NAME]

1st Respondent and

Cambridgeshire County Council 2nd Respondent

Before: Upper Tribunal Judge Wikeley

Decision date: 28 March 2023

Decided on consideration of the papers

Representation: Appellant:

[redacted] 1st Respondent: [redacted] 2nd Respondent: [redacted] County Council

DECISION

The decision of the Upper Tribunal is to dismiss the appeal. The decision of the First-tier Tribunal dated 21 May 2022 made following the hearing on 13 May 2022 under number EA/2021/0351 does not involve any error of law. This decision is made under section 11 of the Tribunals, Courts and Enforcement Act 2007.

[NAME] v [NAME] and [NAME] [2023] UKUT 80 (AAC) Case no: UA-2022-001075-GIA

2 REASONS FOR DECISION

The issue on this appeal to the Upper Tribunal 1. This appeal concerns the interface between freedom of information legislation and data protection legislation.

2. A public authority may refuse a FOIA request where the information in question concerns the [NAME]’s own personal data, the principle being that the applicant should make any such request by way of a subject access request under the Data Protection Act (DPA) 2018 (see FOIA, section 40(1)). The parties to this appeal 3. The Appellant is the [NAME]. The First Respondent is the [NAME] while the Second Respondent is Cambridgeshire County Council (‘the Council’), the public authority concerned with [NAME]’s FOIA request. The essence of the background 4. The essence of the dispute in this case is captured in the opening paragraphs of the [NAME]’s Decision Notice IC-88694- G3P1, which [NAME] appealed to the First-tier Tribunal ([NAME]): The complainant requested information with regards to a complaint. Cambridgeshire County Council (the council) initially refused to provide the information as it considered it to be exempt under section 42(1) of the FOIA (legal professional privilege). During the Commissioner’s investigations it applied section 40(1) of the FOIA to refuse the information – the requestor’s own personal data. … The Commissioner’s decision is that section 40(1) is engaged and the council was correct to refuse to provide the information.

5. The [NAME]’s Decision Notice concluded as follows:

21. The information requested is in relation to a legal claim made by the complainant and gives advice on that claim and also advises on how to respond accordingly to the complainant. The Commissioner is therefore satisfied that this information ‘relates’ to the complainant.

22. As this information is about the complainant’s legal claim to the council, specifically giving advice on his claim and how to respond to him, the Commissioner is satisfied that the information would ‘identify’ the complainant.

23. The requested information is, therefore, the personal data of the complainant. As such, the Commissioner finds that section 40(1) of the FOIA is engaged and the council was correct to refuse the complainant’s information request.

6. The [NAME] dismissed the Appellant’s appeal against that Decision Notice and [NAME] now appeals (with the permission of the [NAME]) to the Upper Tribunal.

3 The background in more detail 7. This case has its roots in a planning application made by [NAME]’s mother in 1969. The Council rejected that application and the matter went to a planning appeal hearing in 1970. At the appeal, and in support of its decision, the Council produced road accident data relating to the site in question. [NAME]’s firm belief is that the Council provided the road accident plan knowing it to be false in material respects. [NAME] has been corresponding with the Council about this matter for some years (if not decades). The present appeal concerns five specific documents (referred to in this decision as ‘the 5 documents’) – two e-mails and three memos – passing between Council officers (or in one case, it seems, between a Council official and a councillor), which were related to a complaint or a legal claim arising from the planning dispute.

8. Between 2005 and 2007 the Council disclosed several hundred pages of documents to [NAME]. This disclosure appears to have been under the DPA 1998, on the basis that [NAME] had the right of access to his personal data. However, the Council withheld the 5 documents, applying the legal professional privilege (LPP) exemption under the DPA 1998. In the course of this process one of the Council’s officers expressed the view that [NAME]’s file “is about an issue, not an individual and therefore his right to see information comes under FOI”. A subsequent FOIA appeal by [NAME] to the information tribunal was dismissed (EA/2007/0023, on appeal from Decision Notice FS50098499).

9. In 2015 [NAME] made a further DPA application for access to the 5 documents. The Council took the view that the LLP exemption still applied and so again withheld the 5 documents in question.

10. In 2018 [NAME] made (at least) two further requests for access to the 5 documents.

11. First, in August 2018, he applied for access “under the new GDPR legislation”. The Council again refused this request, relying on the LPP exemption in what is now the DPA 2018.

12. Second, in September 2018, [NAME] made a further request under FOIA. The Council also refused this latter request. This refusal was initially made on the basis of the LPP exemption, which is also available to public authorities under FOIA (section 42). Latterly the Council changed horses mid-stream and relied exclusively on section 40(1) FOIA, on the basis that the 5 documents comprised personal data of which [NAME] was the data subject. 13. [NAME] then complained to the [NAME], who ruled in his Decision Notice that section 40(1) FOIA was engaged. He concluded that the 5 documents, which were held in a complaint file relating to [NAME], concerned his potential claim for a financial settlement arising out of the planning dispute. As such, the requested information gave advice on a legal claim and how to respond to that claim. The [NAME] concluded that the information was [NAME]’s personal data as it related to him and would identify him. [NAME] then appealed to the [NAME].

4 The First-tier Tribunal proceedings 14. The Appellant’s grounds of appeal to the [NAME] were somewhat discursive but involved three principal, albeit inter-related, challenges.

15. The first complaint was that the Council’s failure to inform him that it had shifted its ground of opposition to disclosure from the LPP exemption under FOIA to the section 40(1) exemption was a breach of natural justice, as the first he knew of this change of position was when he had received the [NAME]’s Decision Notice. The [NAME] rejected the argument that the late application of a different exemption amounted to a breach of natural justice, noting that all relevant matters were considered afresh before the [NAME].

16. The second ground of appeal was that the Council was estopped from reliance on FOIA section 40(1). [NAME] argued that as the Council had for several years led him to believe that LPP was the reason for non-disclosure, it could not now contend that the 5 documents constituted his personal data and apply section 40(1). The [NAME] ruled that the doctrine of estoppel did not apply – “Either his exemption under the FOIA applies, or it does not. It is not dependent upon early recognition or any other related reason for refusal of disclosure” (paragraph 24).

17. The third challenge was [NAME]’s submission that the information in the 5 documents could not be personal data as it related to an issue, and not to an individual, citing the observation by one of the Council’s officers (see paragraph 8 above). The [NAME] rejected the suggestion that this revealed any error of law on the part of the [NAME]: “To categorise information as part of an issue does not mean that it is not also Personal Data at the same time. The two are not mutually exclusive” (paragraph 24).

18. The [NAME] accordingly confirmed the [NAME]’s analysis as summarised at paragraphs 4 and 5 above.

19. The Tribunal Judge later granted the Appellant permission to appeal (I return later to make some observations on the grant of permission itself). The proceedings before the Upper Tribunal 20. There are three grounds of appeal to the Upper Tribunal in this case.

21. The first ground is that the [NAME] misdirected itself in holding that the 5 documents constitute personal data, when they relate to an issue (namely whether the Council produced false data at the planning appeal).

22. The second ground is that the [NAME] misdirected itself in holding that the doctrine of estoppel had no application, when the Council had been relying on LPP until a very late stage in the proceedings.

23. The third ground is that if the scales were evenly balanced then the [NAME] should have found for the Appellant as he came “to the Tribunal with clean hands” and as such “the Council cannot be allowed to win by trickery and subterfuge”.

24. All three parties have made detailed and helpful written submissions (in two rounds) on the appeal. There has been no application for an oral hearing of

5 the appeal. I am satisfied that it is fair and just to proceed to a decision on the papers, given that the issues have been well ventilated in the parties’ various written submissions. Analysis Ground 1: personal data 25. The first ground of appeal is that the [NAME] misdirected itself in holding that the 5 documents amount to the Appellant’s personal data. The Appellant’s case is that rather than constituting his personal data, the 5 documents relate to an issue, namely whether the Council produced a misleading road accident plan in 1970.

26. The legal framework is relatively straightforward.

27. Section 40(1) FOIA provides that “Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.” This is an absolute exemption and so is not subject to any public interest test (see section 2(3)(f) FOIA). The policy intention is clear, namely that disclosure of personal data should be determined under the DPA regime and not FOIA.

Accordingly, “personal data” is defined by reference to the DPA 2018 (see FOIA section 40(7)). Thus, section 3(2) DPA 2018 defines “personal data” as “any information relating to an [NAME]”. Section 3(3) further provides: ““[NAME]” means a [NAME] who can be [NAME], directly or indirectly, in particular by reference to— (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.” Plainly, that is a very broad definition.

28. The [NAME] was satisfied that the [NAME] had applied the correct legal test and that his Decision Notice involved no error of law. By the same token, I am satisfied that the [NAME] likewise applied the correct legal test and its decision involves no error of law.

29. The Appellant’s first ground of appeal is based on a fundamental misconception. His arguments proceed on the basis that any given document has one immutable character for all legal purposes. Therefore, he argues, as the 5 documents have been described at some point in the past as related to ‘an issue’ (be that a complaint, a legal claim or the (alleged) facts underpinning that complaint or claim), it follows that they cannot now be described as personal data. But, as the [NAME] correctly found, “To categorise information as part of an issue does not mean that it is not also Personal Data at the same time, The two are not mutually exclusive. Ultimately the Commissioner during her investigation has clearly, and properly in our view, [NAME] the withheld information included in the 5 documents in question as a subject access request for the Appellant’s own personal data” (paragraph 24).

30. Putting the point another way, the nature of a document will depend on the legal prism through which the document is being viewed. There is, moreover,

6 no absolute right to documents held by a public authority. In the context of a FOIA request, the [NAME] and the [NAME] were both correct to find that the section 40(1) exemption applied as the 5 documents comprised the Appellant’s personal data. In the context of a DPA subject access request, a different series of exemptions come into play, and the [NAME] has found that the Council was entitled to withhold the same information on the basis of LPP.

31. It follows that Ground 1 fails. Ground 2: estoppel 32. The second ground of appeal is that the [NAME] misdirected itself in holding that the doctrine of estoppel had no application to the circumstances of this case.

33. Unfortunately for [NAME], this ground of appeal also goes nowhere. The doctrine of estoppel is a common law notion which must give way to the principles of a statutory scheme. There is ample authority in the case law for the principle that a public authority is not estopped from relying on an exemption under FOIA simply because it has failed (whether consciously or by oversight) to rely on that same exemption at some earlier stage in the proceedings.

34. This principle was clearly established by the decision of Upper Tribunal Judge Jacobs in Information Commissioner v Home Office [2011] UKUT 17 (AAC); [2012] AACR 32 (emphasis added):

25. The right to information arises when a request is made. The public authority’s response is in relation to that request and is limited by the scope of that request. The right is a qualified one in that it is subject to the exemptions in sections 9, 12 and 14 and Part II. In some cases, the authority must not disclose information. An obvious example is section 44(1)(a), which exempts information for which disclosure ‘is prohibited by or under any enactment’. If the exemption is not absolute, the right to information is subject to the balance of public interest. Generally, though, the Act does not require the authority to rely on an exemption, whether absolute or not. It may decide not to rely on an exemption from the outset or it may change its mind later. [Counsel for the Commissioner] did not argue that this later change of position required the exercise of a discretion by the [NAME] or the First-tier Tribunal. She would have had considerable difficulty doing so, as the public authority is entitled to release information without reference to the Commissioner. But it is as much a change of position as relying on a new exemption. To that extent at least, the public authority is not committed to its initial position. 35. [ADDRESS] of Appeal, in the joined case of Birkett v Information Commissioner and DEFRA [2011] EWCA Civ 1606, adopted a similar approach in the parallel context of disclosure under the Environmental Information Regulations 2004, ruling that “the court must consider de novo the propriety of releasing the information. Such a process is bound to discover errors and omissions in the exceptions relied upon in initial

7 decisions, and it would be surprising, given the balancing exercise required by the Directive, if those errors were incapable of subsequent correction” (at paragraph 23).

36. True, section 17 of FOIA requires a public authority which is relying on an exemption to issue a [NAME] with a notice to that effect, specifying the exemption in question and stating why it applies. However, this is a purely procedural provision. A three-judge panel of the Upper Tribunal, reviewing [NAME] and related case law, has ruled as follows in [NAME] v [NAME] (Sections 23 and 24) [2021] UKUT 248 (AAC) (at paragraph 46): First, section 17 sets out an administrative process ([NAME] at [32] and Oxford Phoenix at [42]). Second, section 17 contemplates an informal procedure ([NAME] at [33]). Third, a public authority which specifies certain exemptions in its refusal notice under section 17 is not precluded from either dropping those exemptions or adding to them at a later stage ([NAME] at [25], [29] and [34]). Fourth, specifying an exemption which in the event is found not to apply is not a breach of section 17 (Malnick at [74]-[75] and Oxford Phoenix at [36]). Fifth, and furthermore, citing an obviously inapplicable exemption is also not a breach of section 17 (Oxford Phoenix at [40]). Sixth, and finally, the ultimate supervisory mechanism for public authorities’ reliance on exemptions is not section 17 itself but rather the decision-making functions of the [NAME] and on appeal the First-tier Tribunal ([NAME] at [33], Malnick at [75] and Oxford Phoenix at [40]).

37. It is therefore plain from the case law that there is no legal obligation on a public authority to plead all the potentially applicable exemptions that may apply under FOIA. It is equally plain that a public authority cannot be “estopped” from relying on a particular FOIA exemption simply because it did not rely on it at some earlier stage in the proceedings. It follows that having decided, albeit somewhat belatedly, that the absolute exemption under section 40(1) applied, the Council was entitled to decide to put all its eggs in one FOIA basket and rely on the personal data exemption, irrespective of whether there was one or more other exemptions (or exceptions) that might also apply. It may be that the public authority could have relied upon the LPP exemption. It may be that the Council could have sought to rely on the vexatious request exception under FOIA section 14. Be all that as it may, the Council had decided to nail its colours to the mast of section 40(1) and to rely exclusively on that exemption. There was, in any event, no unfairness so far as [NAME]’s participation in the appeal was concerned, as the application of the FOIA personal data exemption was considered afresh by the [NAME].

38. It follows that Ground 2 also cannot succeed. Ground 3: “trickery and subterfuge” 39. The third ground of appeal is that, if the scales were evenly balanced, then the [NAME] should have found for the Appellant as he came “to the Tribunal

8 with clean hands” and “the Council cannot be allowed to win by trickery and subterfuge”.

40. This ground of appeal is hopeless.

41. In the first place, the ‘scales’ are not evenly balanced. The challenges to the [NAME]’s Decision Notice exemplified by the first and second grounds of appeal are without foundation for the reasons explained above. Secondly, this is not a jurisdiction in which a party can receive ‘the benefit of the doubt’ – either the requested information was exempt as a matter of law under the claimed FOIA exemption or it was not. The [NAME]’s function was then to establish whether there was any error of law in the [NAME]’s Decision Notice. Thirdly, and in any event, there has been no ‘trickery and subterfuge’ in the conduct of these proceedings on the part of the public authority. For the reasons already given, the Council was entitled to revise its position as the FOIA process unfolded and there was no unfairness involved as the Appellant was given an opportunity to make his submissions to the [NAME] on the question of section 40(1).

42. I note that both of the Respondents to this appeal question whether this third ground of appeal can properly be characterised as a ‘point of law’. In the second round of submissions, they have each raised the possibility that this aspect of the Appellant’s case should be struck out under rule 8(2) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698) for want of jurisdiction (see Christie v Information Commissioner [2022] UKUT 315 (AAC) at paragraph 25). I can see some considerable merit in that argument. However, I have to bear in mind the overriding objective at all times, including the importance of acting proportionately and avoiding delay. A strike out under rule 8(2) requires that the appellant is given a prior opportunity to make representations in relation to the proposed striking out (rule 8(4)). In the circumstances of this case, where a proposed strike out had not been ventilated in the first round of written submissions, I considered it simplest to assume that ground 3 was within the proper scope of a point of law and to proceed to determine the appeal as a whole.

43. In any event, for all the reasons above, Ground 3 is without foundation. The First-tier Tribunal’s grant of permission to appeal 44. The [NAME]’s ruling on the Appellant’s application for permission to appeal to the Upper Tribunal set out the general principles involved and [NAME]’s proposed grounds of appeal. The [NAME] then concluded as follows:

11. The Applicant/appellant makes clear in this application that there is a subjective disagreement with the Tribunal’s decision, providing a variety of reasons and is effectively seeking to reargue issues of fact and judgment [sic] both on interpretation of the law and on the facts. The Applicant/appellant further raises an allegation of procedural unfairness, in that he effectively argues that the Tribunal has been distracted by lines of argument that were either untrue, irrelevant, or else became distorted in respect of the hearing in that the Second Respondent Council was guilty of malfeasance through trickery and subterfuge.

9 12. It seems to me that if the Tribunal failed properly to consider material evidence to the apparently straightforward issue before us, or were distracted by evidence that was untrue, irrelevant or became distorted in respect of the objective of the hearing, and the Applicant/appellant can establish this to the satisfaction of the [NAME] and that there was procedural unfairness, then the Applicant/appellant may have an arguable case and should be allowed an opportunity to make his appeal.

13.

Accordingly, I allow permission to appeal.

45. There are at least two inter-related difficulties with this grant of permission to appeal.

46. The first is that it is by no means clear whether the [NAME] Judge was granting permission to appeal on all the grounds of appeal or limited to Ground 3. I am inclined to the view that the former was the case.

47. Secondly, and more importantly, the basis for the grant of permission to appeal was unclear. Thus, in initial Observations on the consequential Upper Tribunal appeal, I confessed to having some difficulty in following the logic of paragraph 12 of the [NAME]’s permission ruling, as it appeared to be wholly circular. Having now had the benefit of the parties’ submissions on the appeal, I remain of that view. Put simply, this is a case in which permission to appeal should not have been granted by the [NAME]. However, permission having been granted, there is no way back.

48. In this context, I start by endorsing the observations of Upper Tribunal Judge Jacobs in Christie v Information Commissioner [2022] UKUT 315 (AAC) at paragraphs 18-25. Nothing I say should be regarded as detracting in any way from what Judge Jacobs said there. I simply add the following further brief observations on grants of permission to appeal by the [NAME].

49. What follows is not intended to be an exhaustive taxonomy. But there will clearly be some cases where the point at issue is the proper interpretation of some relevant statutory provision that has not previously been tested on appeal. That may well be a good reason for the [NAME] giving an applicant permission to appeal to the Upper Tribunal. There will be other cases where the point in dispute is some material procedural issue which may arise in other cases before the [NAME]. That again may well be a good reason for the [NAME] giving permission to appeal.

50. But there will be many other cases which on closer scrutiny may reflect no more than a generalised dissatisfaction with the outcome of the appeal and which at best amount to a ‘facts and reasons’ type of challenge. An appeal which ultimately rests only on the fact that the applicant – whether the [NAME], the [NAME] or the public authority – disagrees with the outcome does not raise an arguable error of law. It may be better for the [NAME] to refuse permission to appeal in these latter types of cases, bearing in mind that the applicant always has the right to renew their application afresh before the Upper Tribunal (at no or minimal cost) and the respondent has (or the respondents have) a reasonable expectation that they will not be put to the cost and trouble (as here) of participation in and

10 having to defend an Upper Tribunal appeal without good reason. With respect, and given its typical caseload across a wide range of jurisdictions, as a general rule the Upper Tribunal is better placed than the [NAME] to determine whether there is an arguable error of law in a ‘facts and reasons’ challenge. This was one such case. Indeed, had permission to appeal been refused by the [NAME], I consider it most unlikely that any Upper Tribunal Judge would have given permission to appeal on any of the grounds of appeal.

Conclusion 51. I conclude that the decision of the First-tier Tribunal involves no error of law. I therefore dismiss the appeal (Tribunals, Courts and Enforcement Act 2007, section 11). My decision is also as set out above.

Nicholas Wikeley

Judge of the Upper Tribunal

Approved for issue on: 28 March 2023