Upper Tribunal Upholds Release of Anonymised Homelessness Data

OUTCOME: Dismissed

The Information Commissioner v [NAME_1] [2018] UKUT 229 (AAC)

GIA/2444/2017 1 IN THE UPPER TRIBUNAL Appeal No. GIA/2444/2017 ADMINISTRATIVE APPEALS CHAMBER

Before: Upper Tribunal Judge K Markus QC

The appeal is dismissed

REASONS FOR DECISION

Introduction

1. For many years the Department for Communities and Local Government (‘[NAME_2]’)1 has collected quarterly statistics on homelessness from every local authority in England. The data is supplied by authorities on P1E forms. The data provides a wide range of evidence about homelessness including the numbers of homeless households, reasons for homelessness, types of accommodation, the makeup of the households by reference to ethnicity, gender, disability and dependents, the outcomes of applications and accommodation provided.

2. The data for the year April 2012/2013 was published by the [NAME_2] on its website, unredacted. Data for earlier years was not published. On 7 December 2015 [NAME_1] requested the data supplied through the P1E returns for the financial years 2009/10, 2010/11 and 2011/12. The [NAME_2] refused the request, initially relying on section 12 of the Freedom of Information Act (‘FOIA’), but later by relying on section 22 (exemption for future publication) and, in relation to some of the data, section 40(2) of FOIA (exemption for personal data).

3. The Information Commissioner upheld the [NAME_2]’s reliance on section 22 and did not consider section 40(2). [NAME_1] appealed to the First-tier Tribunal (‘FTT’). [NAME_1] nor the Information Commissioner requested an oral hearing. The [NAME_2] was aware of the appeal but did not seek to participate. [NAME_3] determined the appeal on the papers. 4. [NAME_3] decided that section 22 did not apply and so considered whether the information was exempt under section 40(2). Section 40(2) had been relied on by the [NAME_2] in relation to “small data”, i.e. data regarding 5 or fewer individuals or households. [NAME_3] decided that that information did not constitute “personal data” as defined by section 1(1) of the Data Protection Act 1998 (‘DPA’) and so was not exempt from disclosure. With permission given by me on 25 September 2017 the Information Commissioner appealed to the Upper Tribunal against the section 40(2) decision only.

5. The [NAME_2] was notified of the appeal and informed the Upper Tribunal that it did not wish to participate. An oral hearing took place before me on 10 May 2018.

1 It is now the Ministry of Housing, Communities and Local Government

GIA/2444/2017 2 The Information Commissioner was represented by [NAME_4] of counsel. [NAME_1] appeared in person. I am grateful to both for their clear and helpful written and oral submissions.

The relevant law

6. The applicable legislation in this appeal is that which was in force prior to the Data Protection Act 2018 and the amendments to FOIA made by the 2018 Act.

7. Information within section 40(2) of FOIA is subject to an absolute exemption from the duties under section 1 FOIA. Section 40(2) provided at the relevant time: ‘(2) Any information to which a request for information relates is also exempt information if - (a) it constitutes personal data which do not fall within subsection (1), and (b) either the first or the second condition below is satisfied.

(3) The first condition is - (a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene -(i) any of the data protection principles...’ 8. The definition of “personal data” in section 1(1) of DPA was as follows: ‘“personal data” means data which relate to a living individual who can be identified – (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.’ 9. The DPA implemented Directive 95/46/EC and the definition of personal data in section 1(1) gave effect to recital 26 of the Directive which provided: “(26) Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable;…” 10. The correct approach to the application of section 1(1)(b) to disclosure of anonymised data was addressed by the House of Lords in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550. That decision was discussed by the Administrative Court in R (Department of Health) v Information Commissioner [2011] EWHC1430 (Admin). Cranston J explained that the House of Lords had decided that, even though the data controller holds the key to identification of individuals to which the data relates, whether it is personal information when disclosed depends on “whether any living individuals can be identified by the public following disclosure of the information” (paragraph 52). In

GIA/2444/2017 3 Information Commissioner v Magherafelt District Council [2013] AACR 14 the Upper Tribunal said that the decision in Department of Health meant that the proper approach to whether anonymised information is personal data within section 1(1)(b), for the purposes of a disclosure request, is to consider whether an individual or individuals could be identified from it and other information which is in the possession of, or likely to come into the possession of a person other than the data controller after disclosure.

11. In the Department of Health case Cranston J said at paragraph 66 that the assessment of the likelihood of identification included “assessing a range of every day factors, such as the likelihood that particular groups, such as campaigners, and the press, will seek out information of identity and the types of other information, already in the public domain, which could inform the search.” 12. As for the likelihood of identification, Recital 26 of the preamble to the Directive provides that “account should be taken of all the means likely reasonably to be used”. In Magherafelt the Upper Tribunal acknowledged the “motivated intruder” test advanced by the Information Commissioner: “37 …A ‘motivated intruder’ was ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’. The question was then one of assessment by a public authority as to ‘… whether, taking account of the nature of the information, there would be likely to be a motivated intruder within the public at large who would be able to identify the individuals to whom the disclosed information relates.’ 13. While not expressly adopting that test, the approach of the Upper Tribunal in that case was consistent with it. A similar approach was taken by the Court of Session (Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at paragraph 24: “…it is not just the means reasonably likely to be used by the ordinary man on the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist…” 14. The Information Commissioner’s Code of Practice on “Anonymisation: managing data protection risk” provides guidance at page 22/23 on the application of the “motivated intruder” test: “The approach assumes that the ‘motivated intruder’ is reasonably competent, has access to resources such as the internet, libraries, and all public documents, and would employ investigative techniques such as making enquiries of people who may have additional knowledge of the identity of the data subject or advertising for anyone with information to come forward. The ‘motivated intruder’ is not assumed to have any specialist knowledge such as computer hacking skills, or to have access to specialist equipment or to resort to criminality such as burglary, to gain access to data that is kept securely.” 15. The guidance also addresses the risk of re-identification where one individual or group of individuals already knows a great deal about another individual, such as a family member, colleague or doctor, and says at page 26:

GIA/2444/2017 4 “The starting point for assessing re-identification risk should be recorded information and established fact. It is easier to establish that particular recorded information is available, than to establish that an individual – or group of individuals - has the knowledge necessary to allow re-identification. However, there is no doubt that non-recorded personal knowledge, in combination with anonymised data, can lead to identification. It can be harder though to substantiate or argue convincingly. There must be a plausible and reasonable basis for non- recorded personal knowledge to be considered to present a significant re- identification risk.” (my emphasis)

16. The guidance also distinguishes between identification and an educated guess: “[Identification] implies a degree of certainty that information is about one person and not another. Identification involves more than making an educated guess that information is about someone; the guess could be wrong. The possibility of making an educated guess about an individual’s identity may present a privacy risk but not a data protection one because no personal data has been disclosed to the guesser. Even where a guess based on anonymised data turns out to be correct, this does not mean that a disclosure of personal data has taken place.”

The First-tier Tribunal’s decision

17. The first issue before [NAME_3] under section 40(2) was whether the small data constituted personal data for the purposes of section 1(1) of DPA. [NAME_3] had very limited submissions from the Information Commissioner or the [NAME_2] in support of their positions that it did. The [NAME_2]’s case was set out in its review decision letter. It explained that, although the full data had been published from April 2012, it did not consider it appropriate to release the small data for the period in question: “I note your reference to small data not being suppressed prior to 2013/14; the Department's position on suppression of small data has changed, as you will see from more recent releases, and it is not considered appropriate to release the information in question unsuppressed, regardless of what was released previously and under different circumstances. The Department considers, therefore, that s.40(2) of FOIA applies in respect of this, since release of small data could allow for individuals to be identified, thus disclosing their personal data. Section 40(2) of the FOIA provides that personal data relating to other persons is exempt information if disclosure would breach the Data Protection Act 1998 (DPA). We consider that disclosure of this information is likely to breach the first data protection principle in Schedule 1 to the DPA, which relates to the fair and lawful processing of personal data. Therefore, we have concluded that this information is exempt from disclosure under section 40(2) read in conjunction with section 40(3)(a)(i) of the FOIA.” 18. As I have said, in her decision the Commissioner did not address whether the information was exempt under section 40(2). However, in considering whether the information was exempt under section 22, the Commissioner had addressed the [NAME_2]’s explanation as to what it intended to do to prepare the information for publication. The Decision Notice included the following: “27. In addition to this [NAME_2] has explained that it is necessary to supress small data in order to comply with section 40(2) of the FOIA. Its position in respect of personal data suppression is that those fields within the requested data which contain fewer

GIA/2444/2017 5 than 5 responses, and those that contain more than 5 responses, but numbers less than 5 can be discovered through simple calculation of other figures need to be supressed.

28. It states that this approach is in accordance with the Commissioner’s Anonymisation: managing data protection risk code of practice, which advises for low numbers; that questions with less than 10 responses that have given an answer that identifies something factual should be supressed. 29. [NAME_2] has therefore argued that it would not be reasonable to release the information before it is due to be published as it is important to ensure that small data is supressed so as not to unlawfully disclose any personal data. It has stated that the individuals in question are private individuals and have no reasonable expectation that information about them in relation to homelessness would be disclosed to the world at large… 31. …it is clear that some suppression needs to occur in order to comply with the Anonymisation: managing data protection risk code of practice. Therefore the Commissioner finds that it does seem reasonable in the circumstances to delay publication until the programme of formatting and suppression is undertaken.” 19. The Information Commissioner’s written submissions to [NAME_3] concentrated on section 22 and said only this regarding section 40(2): “The Commissioner did not make any finding on section 40(2) FOIA, however, in the interests of completeness, the Commissioner considers that it is entirely appropriate for the [NAME_2] to seek to ensure that any data are released in anonymous form.” 20. In its reasons, [NAME_3] set out the definition of personal data in section 1(1) DPA and then said: “18. It is sometimes possible to anonymise a document such that it would not be possible to identify a living individual from the document and ‘other information which is in the possession of, or is likely to come in to the possession of, the data controller. If so, considerations under section 40(2) fall away because there is no longer personal data to consider.” 21. The relevant parts of its reasons dealing with the application of section 40(2) are as follows: “30. The Appellant’s submissions include: a) Whilst the database may contain personal information, the specific information that has been asked for does not. b) The tables published on the [NAME_2] website prior to the year 2013 to 2014 contains information that has not been suppressed. The decision to continue to publish this information, after it has been pointed out to the Department that it contains non-suppressed information, is based on a disclosure risk review, that shows that there is little disclosure risk from unsuppressed values in older spreadsheets. c) “… the data for the year 2012 to 2013 is currently published without low numbers suppressed online (https://www.gov.uk/government/statistical- datasets/live-tables-on-homelessness). The [NAME_2] appears to have made the, I believe reasonable, decision that data that is more than four years old is highly unlikely to be identifiable and therefore can be released unsuppressed. Given this, there is a reasonable expectation that this data about

GIA/2444/2017 6 homelessness would be published. It seems likely the age of the data is the key factor here. The data is a snapshot in time of applicants, all of whom are likely to be in very different circumstances in the current period. The information I have requested is even older than what has already been published.” d) “There is a risk of self-identification with this data, although with the passing of time people may be less clear on which quarter their case was counted in so this risk may be lower. However, it is highly unlikely that damage or distress would be caused by self-identification, especially given the passage of time and the change in circumstances for the individual. The individuals whose cases are counted in the data would recognise that only someone who already knew about their homelessness application and details about its outcome would be able to identify them, and therefore no additional information is revealed. Given the passage of time it would be impossible for a third party to identify individuals from this data, without knowing very specific details about their circumstances at that point in time, for example the outcome of their application. Changes in age, household make-up, and location would all make it even more difficult to link people to past data… I do not believe Section 40(2) applies to this information so no time is needed to suppress low numbers.” 31. The Commissioner’s position set out in its Response is as follows: “The Commissioner did not make any finding on section 40(2) FOIA, that it is entirely appropriate for the [NAME_2] to seek to ensure that any data [is] released in an anonymous form.” 32. The Commissioner notes, in its Decision Notice, the [NAME_2]’s ‘heavy’ reliance on time taken to suppress ‘low numbers data in order to comply with section 40(2)’, but again this does not address the point of whether and why suppression is needed.

33. The Commissioner’s position is somewhat vague. Presented with a paucity of reasoning, we have looked through the full [NAME_5] to find any position from the Respondent and [NAME_2] on the matter. We found the following: a) It is clear from the internal review that [NAME_2] relies on section 40(2). According to this review, it seems to have initially factored in the need to suppress data for section 40 purposes when considering calculations of costs under section 12. Whilst it treats the need to anonymise data as a sine qua non, it fails to explain in any detail the reasons why… b) In response to questions raised by the Commissioner during her investigation, the [NAME_2] expands on its reasoning as follows: “The Department is applying section 40(2) in respect of those fields within the requested spreadsheets which contain fewer than 5 responses; in addition, the Department is applying section 40(2) in respect of some fields within the requested spreadsheets which contain more than 5 responses but which would enable numbers less than 5 to be discovered by calculation from other figures. Until such time as the Department has been able to carry out the necessary anonymisation, this information constitutes the personal data of respondents as the risk of identification is reasonably likely through the use of data matching or similar techniques. This approach to anonymisation is in line with that taken by the Office of National Statistics, and also with the Information Commissioner's Anonymisation Code of Practice, which states:

GIA/2444/2017 7 “Low Numbers - Once the number of overall responses to a particular question drops to a low level, the question may become identifiable. For that reason all questions with less than 200 overall responses have been suppressed. In addition, where there are multiple responses to a question, it is possible that a response given by only a minority of respondents is also identifiable. For this reason, where less than 10 responses have been given to an answer that identifies something factual, all variables relating to that question have been suppressed. It should be noted that attitudinal questions are not bound by this rule, in addition to responses of 'Don't know', 'Refused', 'Other or similar.” .. the Department considers that it is sufficient to suppress those fields with fewer than 5 responses, and that it is not necessary to go to the extent above under these circumstances.” “… None of the withheld information is also sensitive personal data.” “… The data subjects are private individuals and could have no reasonable expectation that their data would be disclosed in this manner; to do so would not be "fair" and would breach the first data protection principle. None of the individuals concerned have been consulted regarding disclosure of their personal data. Even if it were possible to do so, this would be unreasonably time consuming and would arguably engage section 14(1) of FOIA, since each requested spreadsheet contains approximately 100,000 cells of data.” 34. An extract of the type of information the Appellant is requesting is found on page 27 of the [NAME_5]. As identified by the Appellant, the data is a snapshot in time (from some time ago). We do not consider that there would be any reasonable likelihood that disclosure of equivalent information to that found on page 27 would result in personal data of an identifiable individual being disclosed, even where the figures are between 1 and 5.

Accordingly, we prefer the Appellant’s reasoning on this issue. We have not been presented with any compelling reason to doubt that the requested material is not already sufficiently anonymous, and there seems to be a remarkable lack of analysis on the point. For our part, we cannot ourselves envisage any such reason. 35. [NAME_2] refers to taking an approach in line with the Office for National Statistics and the Information Commissioner's Anonymisation Code of Practice (‘CoP’), but does not provide anything to support this. It quotes a paragraph from the CoP, but does not do so in a way that makes a coherent argument as to the relevance of the quote or why anonymisation is needed. The paragraph quoted appears to be a bullet point showing one of a list of rules by which variables were suppressed within Case Study 10, where the CoP presents eleven case studies within its Annex 2 of anonymisation. The case study seems particularly complex and it is unclear why it would be considered comparable or relevant to reference in this case. We note that elsewhere in the CoP, Appendix 2 of the Code of Practice refers to anonymisation techniques where it states that “Some cell values (eg small ones such as 1-5) in statistical data can present a greater risk of reidentication. Depending on the circumstances, small numbers can either be suppressed, or the values manipulated (as in Barnardisation).” However, it is not clear why in this case an individual would be identifiable from the data requested (together with any other data available). Whilst suppression or barnadisation of data may be relevant in some cases, for instance concerning

GIA/2444/2017 8 sophisticated systems for collecting medical data, we think this case is very different. 36. Accordingly, we find that section 40 was not properly relied upon.”

The grounds of appeal

22. [NAME_4] on behalf of the Information Commissioner advanced three grounds of appeal. Ground 1 is that in concluding that the small numbers information did not constitute personal data [NAME_3] failed to apply the correct legal test, made a number of errors of analysis in its reasoning and failed to give adequate reasons. Ground 2 is that [NAME_3] failed to consider the disputed information or the content of electronic files which had been sent to [NAME_3]. Ground 3 is that [NAME_3] failed to adjourn to seek further submissions from the Commissioner and/or the [NAME_2]. I address each of these grounds in turn. Ground 1: Decision that the small numbers information was not personal data. 23. [NAME_4] submitted that, in deciding that the small numbers information did not constitute personal data, [NAME_3] had made two principal errors. First, he said that [NAME_3] failed to apply the correct legal test, that is the test of the “motivated intruder”, and so failed to ask the correct questions or give adequate reasons.

24. Second, he submitted that [NAME_3]’s statement that “we have not been presented with any compelling reason to doubt that the requested material is not already anonymous” and that the [NAME_2] had not made “a coherent argument as to …why anonymisation is needed” shows that it started from the presumption that, because the data did not contain obvious identifiers (for example, names), it should be assumed that it was already anonymous unless “compelling reason” was shown otherwise. [NAME_4] submitted that this was the wrong approach. Instead of asking whether individuals were identifiable under limb (a) or (b) of the definition in section 1(1) of DPA, it asked whether “anonymisation was needed”. That was not relevant to whether the information was personal data, but would be a potential consequence if it was personal data. In addition, he said that [NAME_3] wrongly applied a “burden of proof” analysis to its role. Finally, he said that [NAME_3] wrongly presumed that, if an individual cannot be identified from the data alone, there must be a compelling reason to think that other information would be available to identify the data subject and so it applied an additional burden to satisfy limb b of the definition.

25. In response [NAME_1] submitted that, read as a whole, [NAME_3]’s reasoning demonstrates that its decision was lawful. She said that [NAME_3] applied the correct legal test. [NAME_3] summarised and accepted her submissions, and these had in substance addressed the correct test. [NAME_3] did not start from the presumption that the disputed information was anonymous and that a compelling reason was required to displace the presumption. It considered a sample of the

GIA/2444/2017 9 unredacted published information for 2012/13 and decided that that information was sufficiently anonymous for it to be published unredacted. It considered that there was no compelling reason why the disputed information, which was equivalent to that in the [NAME_5], would not also be sufficiently anonymous. She said that that assumption is born out when one considers the disputed information.

26. I preface my consideration of this ground by reminding myself that a certain degree of restraint is to be exercised by an appellate court or tribunal in its examination of a tribunal’s reasons, as explained by me in Oxford Phoenix Innovation Limited v Information Commissioner and MHRA [2018] UKUT 192 (AAC) at paragraphs 50-55. The Upper Tribunal should not subject the reasons of [NAME_3] to narrow textual analysis. The question it should ask is “whether the Tribunal has done enough to show that it has applied the correct legal test and in broad terms explained its decision”: UCAS v Information Commissioner and Lord Lucas [2014] UKUT 557 (AAC) at [59].

27. I have set out the relevant parts of [NAME_3]’s decision in this case. Having reminded itself of the statutory definition of personal data, the tribunal set out at paragraph 18 the particular issue which arose in this case, which was whether the data was in a sufficiently anonymous form that it would not be possible to identify a living individual from not only the data in question but also other information “which is in the possession of, or likely to come into the possession of, the data controller”. 28. [NAME_3]’s reasons also make it clear that it was aware that the test it had to apply was the risk, on publication of the data, of a member of the public identifying any individual on the basis of that data along with data other than that which is in the possession of the data controller. Thus at paragraph 30(d) [NAME_3] set out the Appellant’s submission that “it would be impossible for a third party to identify individuals from this data, without knowing very specific details about their circumstance at that point in time, for example the outcome of their application.” This shows that [NAME_3] was considering the risk of identification on the basis of the data and other information in the hands of a third party. The [NAME_2]’s reasoning which [NAME_3] cited at paragraph 33(b) addressed the likelihood of identification from the data along with other information (“data matching or similar techniques”). Paragraph 34 makes it clear that [NAME_3] was considering whether there was a “reasonable likelihood” that disclosure of the information would result in disclosure of personal data of an identifiable individual, and the penultimate sentence of paragraph 35 shows that [NAME_3] was aware that the question must be considered by reference to the data “together with any other data available”. Asking whether there is a “reasonable likelihood” of identification may not in all cases be the same as asking whether a person can be identified taking account of “all means reasonably likely to be used” but in this case it is clear that [NAME_3] was addressing substantively the correct question: what are the chances of an individual being identified? That was in substance the correct focus, particularly given the way in which Cranston J expressed the decision in Department of Health: that identification was “extremely remote” (paragraph 55), and the

GIA/2444/2017 10 approach in the Commissioner’s Code of Guidance that “the risk of identification must be greater than remote and reasonably likely” (page 16). 29. [NAME_4] submitted that [NAME_3] failed to address the test of the “likely and reasonable means” that third parties would or might use to identify individuals. He submitted that [NAME_3] should have subjected the material to closer scrutiny and considered what information might be in the public domain and a number of possible ways by which individuals could be identified. He gave an example by reference to the sample of the published data at page 27 of [NAME_3] [NAME_5]. This was data relating to households placed in bed and breakfast accommodation pending inquiries or pursuant to the full housing duty in June 2012. The data showed that in one local authority area there was only one such household and there were three dependent children in that household. [NAME_4] said that if a member of the public (say a friend or employer of the homeless applicant) knew that that person and their three children had been in temporary accommodation at that time, they would be able to infer that this was the household to which the data related and that the accommodation had been provided pursuant to the authority’s statutory duty to them under the Housing Act 1996. [NAME_4] did not say that [NAME_3] would have been bound to conclude that such identification was reasonably likely, but he said that it might have done so and should have conducted the assessment.

30. I am satisfied that [NAME_3] did subject the materials to appropriate scrutiny. [NAME_3] did not mention, in terms, the “motivated intruder” but, by considering and adopting the Appellant’s submissions, I am satisfied that it considered what a person would need to know in order to identify an individual. They would need to know about an individual’s homelessness application and details about its outcome. Given the passage of time, “very specific details about their circumstances at that point in time” would be required. Other relevant details were identified: “age, household make-up, and location”.

31. Neither the [NAME_2] nor the Information Commissioner had advanced any possible basis on which individuals could be identified from the data. The [NAME_2] simply asserted it to be the case. In the circumstances, unless [NAME_3] was required to seek further evidence or submissions from those bodies (and, as explained under Ground 3, I have decided it was not), the materials simply did not call for any further consideration as to the possibilities of identification nor any further elucidation of the relevant test. The statement at paragraph 35 that “it is not clear why in this case an individual would be identifiable” has to be read in the context of the decision as a whole which clearly makes the necessary findings. The particular phraseology may be unsatisfactory, but the substance of the reasoning is adequate. The submissions made by [NAME_4] as to how identification might take place, summarised at paragraph 29 above, are an impermissible attempt reargue the case and make good the gaps in the Commissioner’s case to [NAME_3]. I address the substantive merits of the identification issue further under Ground 2.

GIA/2444/2017 11 32. While it could have expressed itself more clearly, [NAME_3]’s comment at paragraph 33(a) that the [NAME_2] had failed to explain “the need to anonymise data” does not indicate that it approached its task incorrectly. The [NAME_2] had relied on the ICO Code on anonymisation to show that the small data was not sufficiently anonymous. At the end of paragraph 33(a) [NAME_3] referred to the [NAME_2]’s review decision in which the [NAME_2] had discussed the need to redact the small data in order to comply with section 40(2). The Commissioner’s submissions to [NAME_3] had supported the suppression of small data in order to “ensure that any data are released in anonymous form”. It is hardly surprising that [NAME_3] used the same terminology.

33. The need for anonymisation of the data and the risk of identification are two sides of the same coin. In Common Services Agency, where the order proposed by Lord Hope was that the matter be remitted to the Commissioner “so that he can…determine whether the information can be sufficiently anonymised for it not to be personal data”. Cranston J explained in the Department of Health case that what lay behind that order was that the data would not be personal data if anonymisation could preclude identification of the relevant individuals by the public” (paragraph 52). At paragraph 55 he said that the tribunal had been entitled to conclude that “it was extremely remote that the public to whom the statistical data was disclosed would be able to identify individuals from it. In other words: the requested statistics were fully anonymised.” 34. [NAME_3]’s comment at paragraph 33(a) is readily understood in the light of this.

35. I also reject [NAME_4]’ submission that the comment about not having “been presented with any compelling reason to doubt..” (paragraph 34) shows that [NAME_3] reversed the burden of proof or erected an additional hurdle for satisfying limb (b) of section 1(1). The first of these comments was in the context of [NAME_3]’s consideration of page 27 of [NAME_3] [NAME_5] which was an extract from a published spreadsheet for the period April to June 2012. There had been no suggestion that the disputed information was not equivalent to that on page 27. [NAME_3] found that there was no reasonable likelihood of identification of an individual as a result of disclosure of equivalent information, and the reasons for that conclusion were given in the preceding paragraphs. The comment that there was no “compelling reason” to doubt the conclusion does not indicate that [NAME_3] placed the burden of proof on the [NAME_2] or Commissioner. [NAME_3] had considered and rejected the possible means of identification which had been put to it (by the Appellant) and on its own consideration of page 27, and there was nothing else put before the tribunal which led to a different conclusion. Taken in isolation it is not clear what [NAME_3] meant by the use of the word “compelling” but, read in the context of the decision as a whole including the subsequent statement in that paragraph that the tribunal could not “envisage any such reason”, [NAME_3] was making clear that it had turned its mind to whether there was a basis on which it could be said that an individual could be identified but had found none. In the light of the view that it took of the Appellant’s submissions it

GIA/2444/2017 12 was not inappropriate for [NAME_3] to look for an explanation for, or evidence to support, the claimed need for anonymisation.

36. The same point applies to [NAME_3]’s comment at paragraph 35 that the [NAME_2] had not made a “coherent argument … why anonymisation is needed.” [NAME_3] had already found that there was not a risk of identification and in this passage it was simply observing that there was nothing persuasive in the DLCG case to the contrary. As the rest of the paragraph shows, [NAME_3] considered for itself whether the guidance referred to meant that identification was possible and found that it was not. 37. [NAME_4] also said that [NAME_3]’s treatment of the Commissioner’s Code at paragraph 35 of its reasons was irrational. I agree with him that the means by which information is collected is irrelevant to the question whether it contains personal data. However, I do not agree that this comment renders the decision irrational. [NAME_3] was saying no more than that everything depends on the circumstances of the case and that the example relied on by the [NAME_2] was not comparable to the present case. [NAME_3]’s conclusion is understandable on reading Case Study 10 which concerned datasets with very large numbers of variables, including large amounts of very detailed information.

38. In any event, even if the comment in paragraph 35 is, taken alone, irrational or inadequately explained, that is not such as to undermine [NAME_3]’s reasons in the previous paragraphs which, as I have found, are sufficient to justify [NAME_3]’s conclusion. 39. [NAME_4] sought to persuade me that, on examination of the detailed spreadsheets, it is clear that there is at least a significant possibility of identification of individuals from the small numbers. There are three answers to this. First, in the absence of an error of law by the tribunal, it is not open to this tribunal to redetermine the appeal. Second, [NAME_3] was not asked to look at the spreadsheets. Third, and in any event, I reject [NAME_4]’ submission that there was any significant (ie more than remote) possibility of identification. I deal with points 2 and 3 in greater detail under Ground 2.

40.

Accordingly, I dismiss this ground of appeal.

Ground 2

41. As I have said, [NAME_3] considered the risk of identification of an individual by reference to a sample of information taken from the published P1E data for the quarter April-June 2012 (at pages 27 and 28 of the [NAME_5]). [NAME_4] submitted that [NAME_3] erred in law in failing to consider the disputed information, or the complete P1Es for the requested periods with the small data suppressed, or the electronic files comprising the detailed spreadsheets from which pages 27 and 28 were derived. He submitted that it was under a duty to do so, the duty arising as a result of the fact that [NAME_3] exercises a full merits review of the

GIA/2444/2017 13 Commissioner’s decision (see IC v Malnick and ACOBA [2018] UKUT 72 (AAC) at [44]-[46]), and that it has at least in part an investigatory role.

42. In the present case the Information Commissioner wrote to [NAME_3] prior to the hearing regarding the contents of the bundles, as follows: “The Tribunal will note that four spreadsheets which were attached to an email from the Appellant to the public authority on 21 December 2015 (page 26 of the [NAME_5]) are not included in their entirety in the [NAME_5]. The Commissioner did not consider it necessary for hard copies of the spreadsheets to be in the [NAME_5] but was content to include extracts. The Appellant said that she agreed with this proposal and provided sample extracts which are at pages 27 and 28 of the [NAME_5]. In the interests of completeness, however, the Commissioner provides electronic versions of the spreadsheets under cover of this email in case the Tribunal wishes to see the whole spreadsheets.” 43. The spreadsheets referred to comprised the complete P1E data to which the pages 27-28 extract related.

44. The clear implication of this letter was that the Commissioner agreed that pages 27 and 28 were both relevant and sufficient for [NAME_3]’s purposes. In this regard, the Commissioner must have had in mind the possibility of [NAME_3] considering section 40 as that must have been the principal relevance of pages 27 and 28 and, in any event, it would have been obvious that [NAME_3] would do so if it rejected the Commissioner’s case as to section 22 of FOIA. The Commissioner sent links to the electronic files “for completeness” but there was nothing in the correspondence to suggest that it was thought necessary for [NAME_3] to view those files in order to determine the appeal. Nor were the spreadsheets comprising the disputed information provided, redacted or unredacted. 45. [NAME_3] was entitled to rely on the Commissioner’s view as to what materials it should consider. The Commissioner is the public authority with responsibility for ensuring the lawful application of FOIA. She is responsible for providing relevant documents to the tribunal and has vast experience of doing so. Where, as here, the Commissioner agreed what documentary material should be placed before [NAME_3] and did not suggest that other material should be considered, [NAME_3] was entitled to proceed accordingly. In such a situation, unless something transpires to suggest that [NAME_3] should look beyond that which has been placed before it, [NAME_3] cannot be criticised for limiting its consideration to those materials. In this case [NAME_3] clearly and not unreasonably thought that the extract at page 27 was equivalent to the disputed information (see paragraph 34). It cannot be criticised for not viewing the electronic files.

46. It was not material that pages 27 and 28 did not relate to the years with which the request was concerned. The assessment of the risk of identification had to be made by reference to the type of information contained in the files. [NAME_3] was aware that it was not looking at the information for the actual years in question, but was looking at “equivalent information”.

GIA/2444/2017 14 47. The above is sufficient to dismiss this ground of appeal but, for completeness, and because I was asked to do so by [NAME_4], I considered the electronic files and heard the parties’ submissions on them. The data in those files is more extensive and includes a wider range of household characteristics than appeared on the samples on pages 27 and 28, but viewing these files would not have materially altered [NAME_3]’s conclusion. There would have been the same problems of linking known information about individuals to that provided in the data, where that data concerned periods of four and more years ago. The data contained in the files provided no indication of the location of households (save for the local authority area) nor the outcome of cases (for example, whether a household was accommodated, and the type of accommodation in which they were accommodated). Even in the area with the fewest homeless households, it is highly unlikely that a household could be identified on the basis of information that four years earlier in a particular local authority area there had been one household with one dependent child to whom a housing duty had been accepted. The information said nothing about whether the household had in fact been accommodated or when. Thus, even if a member of the public knew of a household with one child living in that local authority area and who had lost their home, they could not know that that was the household to which the data referred unless they also knew whether there had been an application for assistance as homeless, the outcome of that application and the quarter in which a duty had been accepted. 48. [NAME_4] illustrated what he said was the risk of identification by cross- referencing the small data in two sections of the spreadsheets. Page 508 provides data about applicant households in respect of which it was decided that they were eligible, unintentionally homeless and in priority need, in the quarter April to June 2012. It is broken down by local authority and ethnic group. [NAME_6] had only one such household, identified as white British. Page 564-565 shows data for households by numbers of dependent children and other details about members of the household such as pregnancy, young people in care, disability, drug or alcohol dependency, and other personal circumstances, and reasons for homelessness. The data shows that for [NAME_6] there was one household with one child which was homeless because parents were no longer willing or able to provide accommodation. So putting all that information together, one finds that during that quarter [NAME_6] accepted a housing duty to one household with one child and that that household was homeless because the parents were no longer willing or able to provide accommodation. From that, it can be inferred that the household had been living with parents prior to becoming homeless. Page 566 tells you that the household was placed in temporary accommodation. Pages 585 onwards provide a variety of data about households which were being accommodated by an authority at the end of that quarter. This includes the type of accommodation provided and the duty pursuant to which it was provided. The figure for [NAME_6] is 0. Thus, one can infer that the one household to which [NAME_6] had accepted a duty and placed in temporary accommodation during the quarter was no longer accommodated by the authority at the end of the quarter. Other than that inference, the earlier data cannot be read across to that on pages 585

GIA/2444/2017 15 onwards because the households referred to in the former were not necessarily the households accommodated at the end of the quarter to which the latter material referred.

49. I was also provided with the spreadsheets comprising the disputed information, but with the small numbers redacted. It is apparent that those spreadsheets are the same or very similar to the above, although they relate to different years, and do not raise any additional possibilities for identification of individuals.

50. In my judgment, the chance of a member of the public being able to identify the household and its members from the data is so remote as to be negligible. Assuming a friend or colleague of an adult in the household knew that that adult and their one child had been required to leave their parent’s accommodation and had been in temporary accommodation for a short period, they would not know that the data in the spreadsheet referred to them. In particular, the data does not state where a household is accommodated nor where they had previously been accommodated. An authority will not necessarily provide accommodation within its own geographical area. Thus a household may have been accommodated in the geographical area of [NAME_6] by a different local authority. The household referred to on the spreadsheet may have been accommodated elsewhere. I do not see how a person could be identified by a third party from the information in the spreadsheet. They could, at best, make no more than an educated guess and even that seems highly unlikely. In addition, even if the necessary connections could be made in principle, the chances of doing so are reduced even further by the fact that a person would need to have a record of or be able to recall this information in sufficient detail four years later.

51. Similar observations apply to [NAME_4]’ example referred to at paragraph 29 above, which is derived from the page 27 extract of the spreadsheet at page 585.

52. Moreover, it is quite fantastical to suppose that, several years later, there would be anyone sufficiently motivated to try to identify an individual to which the data related. The information in the spreadsheets is not such as is likely to attract those with investigative skills, such as a journalist, to attempt to identify individuals. [NAME_4] has not suggested any reason why revealing the identity of an individual to whom the data relates would be of interest to any member of the public. Even if, which is unlikely, there may be some interest in those who were accommodated at or close to the time, I can see no basis for thinking that it would be of interest to anyone several years later.

53. Therefore I dismiss this ground of appeal.

Ground 3

54. [NAME_3] noted that the Commissioner’s position regarding section 40(2) was “somewhat vague”. It said it had been “presented with a paucity of reasoning”, and pointed to a “remarkable lack of analysis”. [NAME_3] considered whether to adjourn the proceedings and decided not to do so, explaining its decision as follows:

GIA/2444/2017 16 “37. This Tribunal is known as ‘inquisitorial’ in nature, and we may ask questions to ascertain facts and positions we consider of relevance.

Accordingly, we have considered whether to seek fuller reasoning from the Commissioner in relation to Issue 3. We have also considered whether to join the [NAME_2] to determine if it could advance a fuller reasoning of its reliance on section 40. Both would have necessitated adjourning the hearing.

38. Having regard to the overriding objective in rule 2 of The Tribunal Procedure (First-Tier Tribunal) (General Regulatory Chamber) Rules 2009 S.I. 2009 No. 1976 (L. 20) (‘the rules’), we consider that an adjournment would be disproportionate, cause substantial delay and wasted costs of the Appellant, Commissioner and Tribunal, and be procedurally unfair to the Appellant. Factors considered in reaching this conclusion are: a) Rule 2 provides: ‘2.- (1) The overriding objective of these Rules is to enable the Tribunal to deal with cases fairly and justly. (2) Dealing with a case fairly and justly includes - (a) dealing with the case in ways which are proportionate to the importance of the case, the complexity of the issues, the anticipated costs and the resources of the parties; (b) avoiding unnecessary formality and seeking flexibility in the proceedings; (c) ensuring, so far as practicable, that the parties are able to participate fully in the proceedings; (d) using any special expertise of the Tribunal effectively; and (e) (e) avoiding delay, so far as compatible with proper consideration of the issues… (4) Parties must— (a) help the Tribunal to further the overriding objective; and (b) co-operate with the Tribunal generally. b) Where parties have opted for a hearing to be determined on the papers, we consider it an implicit duty and extremely important that they provide the Tribunal with their complete submissions to enable the Tribunal to resolve the matter fully on the day of the hearing, particularly where the party is legally represented or very experienced. Likewise, a public authority wishing to have its arguments before the Tribunal would need to have applied to be joined and provide such arguments prior to the hearing. For the administration of justice to be effective and efficient, adjournments are appropriate only in exceptional circumstances. c) There has been no suggestion that the Commissioner intended for the Court to call on it for further representations on this issue, and it did not express this. In any event, to intend otherwise would not have been considerate to the Appellant or Court (due to the delays and costs necessitated). In our view, it would also have (a) breached rule 2(4); and (b) been potentially unfair to the Appellant where she had prepared fully in advance of the hearing, and we would be essentially inviting the public authority to have a second go. d) As public bodies with access to legal representation, it is their responsibility to decide how best to present their case. They would have known that section 40(2) would be an issue were we to have found against them on Issues 1 and 2, particularly where the Appellant fully alerted her to the issues in good time for the

GIA/2444/2017 17 hearing. Therefore we conclude that the Commissioner has chosen not to address this matter in commensurate detail. e) Likewise, it seems implicit in rule 2(4) that if a public authority has any intention to be joined to an appeal, it should apply to do so promptly. [NAME_2] was aware of the appeal and had an opportunity to apply to be joined. It would also have been aware of the consequences of a Tribunal finding against the Commissioner. We can see from the [NAME_5], that it had also presented its case to the Commissioner, and we have considered these arguments. f) This case does present matters of relative importance as it concerns the statistics on homelessness. We consider unnecessary delay is not appropriate where we are satisfied that we have given proper consideration of the facts and the law. g) We cannot find or foresee any appropriate reason for the requested information to fall within section 40 as we have no reason to consider it not to already be made anonymous.” 55. “Issue 3” referred to by [NAME_3] in this passage concerned section 40(2). [NAME_4] submitted that, in the light of [NAME_3]’s view as to the inadequacy of the submissions, once it decided that the information was not exempt under section 22 it should have adjourned the proceedings in order to seek further representations from the Commissioner and the [NAME_2] on the application of section 40(2). He submitted that [NAME_3]’s reasons for deciding not to adjourn were legally flawed because, contrary to [NAME_3]’s statement at paragraph 38, it cannot be procedurally unfair to a party to adjourn. He said “procedural unfairness” is a term which is well-understood by lawyers and it does not include adjournment of proceedings.

56. Adjournment gives rise to delay, and delay can constitute procedural unfairness. Whether it does so in any particular case will depend upon a variety of matters including the reason for, length and consequences of the delay. Moreover, rule 2(2) of the Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 provides that dealing with a case fairly and justly includes “avoiding delay, so far as compatible with proper consideration of the issues” (emphasis added). 57. [NAME_3] in the present case reminded itself of rule 2(2) and also rule 2(4) which requires parties to help the Tribunal to further the overriding objective and co- operate with the Tribunal generally. The reasons given by [NAME_3] for proceeding without an adjournment included the effective and efficient administration of justice, delay and cost. [NAME_3] took into account that the Commissioner and the [NAME_2] both had access to legal representation, that there had been no indication that they had anything further to say on section 40(2) despite the Appellant having set out her case clearly, that the Commissioner had not sought an adjournment, that the [NAME_2] had not sought to be joined to the proceedings but had presented its case to the Commissioner, and that [NAME_3] had been able to take that case into account. At paragraph (f) [NAME_3] explained that it considered that the delay caused by an adjournment was unnecessary because it had been able to give proper consideration to the case. The analysis was entirely consistent with the requirements of rule 2 and not legally flawed.

GIA/2444/2017 18 58. [NAME_3] was entitled to take the view that it had been able to determine the appeal properly. Having commented on the paucity of analysis, [NAME_3] “looked through the full [NAME_5] to find any position from the Respondent and the [NAME_2] on the matter” (paragraph 33). In doing so, [NAME_3] exercised its inquisitorial role. Moreover, [NAME_3] then went on to explain what it found in the [NAME_5]. It identified and scrutinised the [NAME_2]’s explanation for relying on section 40(2). But it did not stop there. [NAME_3] carried out its own examination of the sample material. [NAME_3] reached a clear and unequivocal conclusion at paragraph 36. At paragraph 38(f) it said that it had been able to consider the issues properly without the need for further evidence or submissions.

59. As [NAME_4] accepted, it would have been obvious that, if [NAME_3] was against the Commissioner on section 22, it would go on to consider section 40. There was no basis on which the Commissioner could properly have assumed that [NAME_3] would adjourn if it needed to consider section 40, and the Commissioner had not sought a case management direction from the tribunal to that effect. [NAME_3] was entitled to take into account that the Commissioner had given no indication that she had anything else to say. It was relevant to whether there was any point in adjourning.

60. The fact that [NAME_3]’s decision might engage the Article 8 rights of data subjects adds nothing to this analysis. The Article 8 does not override the above considerations. In any event, [NAME_3]’s view that it had been able to determine the appeal on the material and its conclusion on the substantive issue meant that there was no additional human rights dimension to the question of adjournment.

61. For the above reasons, this ground of appeal is also dismissed.

Signed on the original K. Markus QC on 12 July 2018

Judge of the Upper Tribunal