Upper Tribunal Upholds University's Decision on FOIA Cost Estimation

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 1 IN THE UPPER TRIBUNAL Appeal No. GIA/724/2016 ADMINISTRATIVE APPEALS CHAMBER

Before: Upper Tribunal Judge K [NAME] QC

The DECISION of the Upper Tribunal is to dismiss the appeal.

The decision of the First-tier Tribunal (General Regulatory Chamber) dated 28 December 2015 did not involve an error on a point of law. The appeal is therefore dismissed.

This decision is given under section 11 of the Tribunals, Courts and Enforcement Act 2007.

REASONS FOR

DECISION Introduction 1. Section 12 Freedom of Information Act 2000 (FOIA) excuses an authority from complying with a request for information where it estimates that that the cost of complying with it would exceed the statutory limit. The principal question in this appeal is whether, in estimating those costs, the authority must exclude costs which it would not have been necessary for it to incur if it had complied with legal obligations relating to the holding of information. I have decided that it is not required to exclude such costs.

Background 2. [NAME] (“[NAME]”) is a charity which campaigns in relation to animal experimentation. 3. [COMPANY] (“the University”) is licensed to carry out experiments on animals. The licences are issued by the Secretary of State for the Home Department under the Animals (Scientific Procedures) Act 1986 (“ASPA”), which regulates the use of animals for experiments and testing. For present purposes it is sufficient to explain that ASPA requires three different types of licence to be in place before animal experimentation is permitted: a personal licence for each person who carries out animal experiments, a project licence for the programme of work that involves animal experiments, and an establishment licence for the undertaking which engages in animal experiments. The Deputy Vice-Chancellor of the University holds an establishment licence authorising the University to engage in animal experiments.

4. ASPA imposes record-keeping obligations on licence holders. The precise obligations changed in 2013, following the introduction of a new EU Directive, but for present purposes it is sufficient to note that both regimes require an establishment licence holder to keep records of a number of matters including the number and species of animals used in regulated procedures and the projects in which they are used.

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 2 5. On 11 September 2014 [NAME] made the following request for information from the University: “Would you please let us have, under section 1(1)(b) of the Freedom of Information Act 2000, the following information pertaining to animal experiments under the Animals (Scientific Procedures) Act 1986 [“ASPA”] at your establishment: the number of animals used in scientific experiments in 2013, by (i) species, and (ii) purpose of research?” 6. On 2 October 2014 the University notified [NAME] that it did not need to comply with the request because the cost of complying with it would exceed the appropriate limit under section 12 of the Freedom of Information Act (“FOIA”). The University did not keep a central record of its licences and the information contained within them. The information was held by around 60 individual licence holders in various roles across the University. The time it would take to collate the information would cost more than the statutory limit. 7. [NAME] complained to the [NAME]. [NAME] did not disagree with the estimate of the cost involved, but said that the University was required by ASPA to hold the information itself and that it was not open to the University to rely on section 12 FOIA in respect of costs incurred in collating that information. In a decision dated 1 July 2015, the Commissioner upheld the University’s decision. He (as he then was) said that he could decide as a matter of fact whether the University was correct to apply section 12 but not whether the information should already have been collated under different legislation. He was satisfied that the way in which the University held the information meant that it would cost more than the appropriate amount in section 12 to comply with the request and so it could rely on that section.

8. The First-tier Tribunal (“FTT”) dismissed [NAME]’s appeal. It decided that section 12 does not require the cost of complying with a request to be reduced by the cost of complying with a pre-existing legal obligation, that the Commissioner was correct to hold that he could not assess whether the University had complied with ASPA and that, in any event, the University was not in breach of its obligations under ASPA.

Freedom of Information Act 2000 9. Section 1(1) FOIA provides: “(1) Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.” 10. The general right is subject to a number of exceptions or exclusions including in section 12 which provides: “(1) Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit. …

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 3 (3) In subsections (1) and (2) “the appropriate limit” means such amount as may be prescribed, and different amounts may be prescribed in relation to different cases. … (5) The Secretary of State may by regulations make provision for the purposes of this section as to the costs to be estimated and as to the manner in which they are to be estimated.” 11. The Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (“the Fees Regulations”) are made under section 12(5). Regulation 3(3) provides that, the appropriate limit for a public authority such as the University is £450. Regulation 4 provides: “(1) This regulation has effect in any case in which a public authority proposes to estimate whether the cost of complying with a relevant request would exceed the appropriate limit. (2) A relevant request is any request to the extent that it is a request– … …(b) [for] information to which section 1(1) of the 2000 Act would, apart from the appropriate limit, to any extent apply. (3) In a case in which this regulation has effect, a public authority may, for the purpose of its estimate, take account only of the costs it reasonably expects to incur in relation to the request in– (a) determining whether it holds the information, (b) locating the information, or a document which may contain the information, (c) retrieving the information, or a document which may contain the information, and (d) extracting the information from a document containing it. (4) To the extent to which any of the costs which a public authority takes into account are attributable to the time which persons undertaking any of the activities mentioned in paragraph (3) on behalf of the authority are expected to spend on those activities, those costs are to be estimated at a rate of £25 per person per hour.” 12. The combined effect of regulation 3(3) and regulation 4(4) is that the appropriate limit in the case of the University equated to 18 hours’ work.

13. I also mention section 13 FOIA, which allows a public authority to charge for communicating information that it would not otherwise be required to communicate because the cost would exceed the appropriate limit under section 12.

The issues 14. The issues in the appeal to this tribunal were defined by Upper Tribunal Judge Turnbull when giving permission to appeal as follows: “(1) Whether on the true construction of s.12 of FOIA and related legislation it is necessary or permissible for the [NAME], in determining whether the s.12 costs limit would be exceeded, to exclude costs of complying with the request which it would not have been necessary for the public authority to incur if it had complied with its statutory or other obligations as to the manner of holding information;

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 4 (2) If so, whether the jurisdiction of the [NAME] under s.12 extends to determining (albeit only for the purposes of FOIA) the extent of the public authorities obligations arising under other legislation, and in particular to determining the questions of construction which may arise under the ASPA legislation in the present case; (3) If the answer to (1) and (2) is ‘yes’, whether on the true construction of the ASPA legislation and in all the circumstances the University of Bristol had failed in material respects to comply with the ASPA legislation.” 15. [NAME] was represented at the hearing before me by [NAME], solicitor and legal consultant for [NAME]. The [NAME] was represented by [NAME], counsel. The University did not participate in the appeal. The representatives for [NAME] and the [NAME] had also provided written submissions in advance of the hearing. I am grateful to the representatives for both their written and oral submissions.

16. It was not in dispute that: a) the University did not keep a central repository of its licences and the information contained in them; b) the information was kept by individual project and personal licence holders of which there were around 60 at the time of the request and would have been more in 2013; c) it would take at least 30 minutes to extract the information from each individual licence holder so that the total time taken to comply with the request would substantially exceed 18 hours.

Discussion Issue 1 17. [NAME]’s submissions are in summary as follows. The ground of appeal is about unlawful rather than poor record-keeping. While the requester has to take his chances with the latter, it is inconceivable that Parliament intended he should do so with the former. Section 12 and the Fees Regulations strike a balance between the right to information and avoiding an undue burden on public authorities. The operation of section 12 is limited in two respects: first, only the costs of the physical aspects of dealing with a request but not thinking time are taken into account; second, the physical aspects of dealing with the request must be properly attributable to complying with the request. The “cost of complying with the request” means the cost “properly attributable to dealing with the request” and not the time spent in complying with a separate legal obligation. This is the natural meaning of section 12(1) in context. Alternatively, this is what Parliament must have intended and the FTT should have resolved any ambiguity in the legislation by choosing the construction that accords with the statutory purpose including, if necessary, by reading words into the section. If the Commissioner’s and FTT’s approach is the correct one, the consequence would be that the public authority would be entitled under section 13 FOIA to charge a requester for the cost of its compliance with other legal obligations.. [NAME] submits that “It is inconceivable that Parliament would have wished to strike the balance between transparency and administrative convenience in a way which enabled public authorities to take advantage of their breach of a separate legal obligation, to the detriment of the requester and the public interest in transparency”.

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 5 18. The Commissioner submits that it is irrelevant to section 12 whether the public authority has complied with other legislation. The section stands on its own terms and requires a factual estimate of the cost of compliance. That is what section 12 says and it is consistent with the purpose which is to protect the public authority’s resources. [NAME]’s approach would involve the public authority in making complex decisions and calculations which are inimical to the practical utility and purpose of section 12, and involves rewriting section 12 impermissibly. There is no absurdity in the ordinary meaning of the legislation and it is not permissible to read words in.

19. I start my analysis with the words of the legislation. The cost which is taken into account is the public authority’s estimate of the cost of complying with the request. Section 12(5) empowers the Minister for the Cabinet Office to make provision by regulation as to the “costs to be estimated and as to the manner in which they are to be estimated”. As Keith J said at [28] of Chief Constable of [NAME] v [NAME] [2011] 1 WLR 1387, that provision “in effect enabled the [Minister] to provide that only part of the cost of complying with a request for information can be taken into account by a public authority when estimating whether the appropriate limit will be exceeded”. That is what was done by regulation 4(3) of the 2004 Regulations, which provides that only the costs of undertaking certain specified activities can be taken into account. The Minister had not exercised his power to limit the costs in any other respect. The legislation requires the authority to decide what the tasks in regulation 4(3) involve, calculate how long those tasks will take and then attribute a cost in accordance with regulation 4(4). There is nothing in the words of the legislation to warrant adding a further limitation so as to exclude the cost of compliance with other legal obligations. I am reinforced in this by the fact that, where rights under FOIA are qualified by reference to other legislation, the Act makes express provision; see sections 39, 40 and 44. Had Parliament or the Minister intended that the costs should be limited in the way [NAME] contends, it would have been easy to say so in the legislation.

20. Moreover, section 12 and the Fees Regulations require an authority to estimate the costs which it reasonably expects to incur, not to determine the actual costs of compliance. I agree with [NAME] that this suggests a straightforward, practical assessment of the real-world situation. This has been the consistent approach of the Information Tribunal and First-tier Tribunal. See for instance [NAME] v [NAME] EA/2006/003-2007/0007 at paragraphs 47-49 and [NAME] v IC and Cardiff and Vale NHS Trust EA/2008/0042 at paragraph 28. In [NAME] v [NAME] EA/2008/0050, the Tribunal said: “9. Section 12 does not require the public authority to make a precise calculation of the costs of complying with a request. Only an estimate is required. That estimate, however, must be a reasonable one and may only be based on the activities covered by Regulation 4(3)…

10. What amounts to a reasonable estimate can only be considered on a case by case basis. We recognise this aspect may be an important consideration for requestors seeking to exercise their information rights under FOIA. It is not sufficient for a public authority simply to assert the appropriate limit has been exceeded. As was made clear in [NAME] (EA/2007/0004) an estimate has to be “sensible, realistic and supported by cogent evidence”…

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 6 11. The Complainant argues that the MOD should not be permitted to rely upon section 12 unless it has demonstrated that it contemplated all reasonable methods for extracting data from the database in question. He says that, in particular, it had an obligation to consider certain alternative methods which he had brought to its attention.

12. Section 12 provides that the public authority may rely on its costs estimate to refuse a request but does not expressly make that reliance conditional on the quality or nature of the estimate. One must look in the Regulations for any guidance as to how the estimate should be made. In that connection Regulation 4(3) provides that the public authority may only take account of the costs it reasonably expects to incur in carrying out certain specific tasks. It says no more about any steps that the public authority should take in evaluating possible methods of extracting data. However, the word “estimate” itself provides some guidance. It points to something more than a guess or an arbitrarily selected figure. It requires a process to be undertaken, which will involve an investigation followed by an exercise of assessment and calculation. The investigation will need to cover matters such as the amount of information covered by the request, its location, and the hourly cost of those who will have the task of extracting it (in this case a rate imposed by the Regulations). The second stage will involve making an informed and intelligent assessment of how many hours the relevant staff members are likely to take to extract the information. Clearly the whole exercise must be undertaken in good faith and, as the Regulation provides, involve an element of reasonableness.” 21. Upper Tribunal Judge Wikeley said in Commissioner of Police for the Metropolis v Information Commissioner and Mackenzie [2014] UKUT 479 (AAC): “33. …a public authority’s time and cost estimate must be “reasonable”, in the sense of being “sensible, realistic and supported by cogent evidence”: [NAME] v [NAME] Regulatory Agency, EA/2007/0004, at [12] and see also [NAME] v [NAME], EA/2008/0050 at [10], as approved by the Upper Tribunal in [NAME] v [NAME] of Defence [2011] 2 Info LR 75 at paragraph 27.” 22. Although the Upper Tribunal in [NAME] and in [NAME] expressly approved only paragraph 10 of the tribunal’s decision in [NAME], the reasoning in those cases is wholly consistent with the Information Tribunal’s fuller analysis at paragraph 12 and I agree with that analysis. It accurately reflects the terms of the legislation itself, which I have explained above. 23. [NAME]’s approach involves the authority, the Commissioner and the Tribunal doing something quite different from that exercise. It involves speculation as to what the cost of compliance would be if things had been done differently by the authority. In [NAME] Judge Wikeley considered a similar submission where the information requested was held by a substantial number of different units and individual officers. Judge Wikeley said as follows: “36. [NAME] makes a number of points by way of challenge to the public authority’s cost estimate. I do not find them persuasive for the following reasons.

37. First, he argues that (as he put it in his request for an internal review) “I believe it unlikely that there would not be some aggregated record of surveillance within areas and/or at wider level which could be assessed simply.” However, as the Commissioner noted in his decision notice (at [19]-[20]), FOIA is not a means of reviewing a public authority’s record-keeping and in some way testing it against best

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 7 practice. In this case the Metropolitan Police has explained how information relevant to the request was collated and stored. The fact that [NAME] thinks there are obviously better ways of undertaking that task which can be assumed to be in place is neither here nor there. … 42. The moral of this case is perhaps this. The question of whether a request falls foul of the cost limit in section 12 is likely to be a function of two factors. The first is the breadth of the request itself, a matter over which the requestor has a considerable degree of control. By definition a carefully focussed FOIA request is less likely to be caught by the cost limit. The second factor concerns the record-keeping practices of the public authority, a matter over which the individual requestor obviously has no control. It may be more difficult to avoid the impact of the section 12 cap when making a request to a relatively decentralised public authority. However, the fact is that FOIA is about the citizen’s right to information, subject to certain safeguards, checks and balances. It is not a statute that prescribes any particular organisational structure or record-keeping practice in public authorities.” 24. [NAME] does not quarrel with this but he submits that there is a distinction to be drawn between the cost consequences of inefficient record-keeping with which Judge Wikeley was concerned and those of breach of a legal obligation. He says that to construe the legislation so as to allow an authority to factor the latter into its cost estimate would be absurd as it would enable public authorities to take advantage of their breach of a legal obligation. He says that the mischief of the legislation is “to avoid public authorities having to spend an unreasonable amount of time locating, retrieving etc requested information where it is otherwise compliant with its legal duties in relation to that information.” 25. I reject this submission. Although the context of the challenge in [NAME] was allegedly poor record-keeping, the rationale of Judge Wikeley’s conclusion applies equally to allegedly unlawful record-keeping. It is based on the practical nature of the exercise involved as he described at paragraph 37 and as explained in [NAME] to which he referred there. The essential point made by Judge Wikeley is that the requester has to take the public authority’s record-keeping practices as they are, even if they are defective. That holds true whether the defect is poor administration or breach of a legal obligation.

26. In the context of section 12, there is no relevant distinction to be made between the quality of record-keeping and unlawful record-keeping. Indeed, there is considerable overlap between the two. The importance of proper record-keeping is reflected in section 46 FOIA which requires the Secretary of State to issue a code of practice providing guidance to relevant authorities in connection with keeping, management and destruction of their records. The current version of the Code emphasises the importance of good records management including that it “supports compliance with other legislation which requires records and information to be kept, controlled and accessible.” The Foreword to the Code at paragraph (vi) specifically identifies that poor records and information management creates a risk of non-compliance with legal obligations and staff time wasted searching for records. It identifies a number of other serious and harmful consequences of poor record-keeping: poor decisions or levels of service, financial or legal loss, unauthorised access to confidential information, damage to public trust, are just a few of these. The Foreword also states:

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 8 “(viii) Authorities should note that if they fail to comply with the Code, they may also fail to comply with legislation relating to the creation, management, disposal, use and re-use of records and information, for example the Public Records Act 1958, the Data Protection Act 1998, and the Re-use of Public Sector Information Regulations 2005, and they may consequently be in breach of their statutory obligations.” 27. In many cases compliance with good practice and with legal obligations are two sides of the same coin. The practical consequences of poor practice may be just as serious as, or even more serious than, breach of legal obligations. It is no more absurd to allow an authority to take into account costs which could be avoided by compliance with separate legal obligations than it is to allow it to take into account costs which could be avoided by better practice.

28. Parliament has chosen to address good record-keeping practice by making provision for a Code under section 46 and empowering the [NAME] to promote conformity with the Code by means of recommendations under section 48. As set out above, in some cases this will in practice incorporate compliance with legal obligations under other legislation. There is no basis for concluding that Parliament also intended that there should be a separate assessment of compliance with such obligations where section 12 FOIA is in play.

29. On the contrary, [NAME]’s approach runs contrary to the fundamental purpose of section 12, to protect a public authority’s resources ([NAME] v [NAME] and Department of Education [2015] UKUT 0047 (AAC) at [41]). There are numerous statutory record-keeping obligations on public authorities, with statutory means for inspection and enforcement of those obligations. ASPA creates one such regime and the dispute in the present case as to whether the University is compliant with its obligations under ASPA provides a clear illustration of the technical and complex legal issues that may arise. Yet, if [NAME] is correct, a public authority would need to address these difficult questions. If the authority decided that it was in breach of a relevant legal obligation it would then need to decide how its records would be maintained lawfully and estimate the cost of complying with the request on the hypothetical basis that it was keeping the records lawfully. This could pose considerable difficulties and may even be impossible. There could be different ways of keeping records lawfully. For instance, in the present case, even if [NAME] is correct that the University may not rely on the records of the individual project holders, does that mean that it must hold the records in one central location? If the University had, say, five animal units, would be it be lawful for the information to be held across the units? In this hypothetical exercise the authority could not know what form its record-keeping would take nor what state the records would be in.

30. It is apparent that, rather than protecting the authority’s resources, reliance on section 12 would generate difficult, complex and at times unanswerable questions, carrying greatly increased risk of dispute and further expense. It is a far cry from the sensible, realistic and evidence-based exercise which section 12 calls for. 31. [NAME] asserts that such an analysis would seldom be necessary because the position would be clear in most cases. He points to the fact that the present case is the only known case in which the issue has arisen. However, the possibility cannot be excluded that, if the Upper Tribunal were to support [NAME]’s

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 9 construction of section 12, more requesters would raise such issues and, in any event, public authorities which are subject to record-keeping obligations relevant to a request (and there are many such statutory obligations) would be bound to address the issue, involving consideration of the questions which I have identified in all but the simplest of cases. This is not a “flood-gates” point; it reinforces my view as to the legislative intention.

32. In the light of these conclusions I can deal very briefly with [NAME]’ other submissions. He submits that, if he is wrong as to the natural or possible meaning of section 12, words should be read into section 12 by inserting “but not the cost of complying with a separate legal obligation” after “cost of complying with the request”. He says that it can be presumed that this is what Parliament meant and is required in order to avoid an absurd result.

33. I have shown why [NAME] is wrong as to the meaning of the legislation. The legislation as drafted does not lead to absurdity. On the contrary the construction for which [NAME] contends, with the consequences which I have outlined at paragraph 29 above, would lead to unwarranted complexity contrary to the purpose of section 12, and in some cases could render section 12 unworkable. 34. [NAME]’ submission based on section 13 does not advance his case. He acknowledges that section 13 is “the flip side of the same coin as section 12”. I agree, and the section 13 argument stands or falls with the section 12 case. It may be that in some cases section 13 charges could include costs which may have been incurred if the authority had complied with other legal obligations, but I have explained that that is not a computation that is called for by FOIA. I am not satisfied that the position under section 13 gives rise to an anomaly but, if it does, there is no justification for departing from the language of the legislation. In Stock v Fran Jones (Tipton Ltd) [1978] 1 WLR 231, Lord Simon of Glaisdale said at 237: “a court would only be justified in departing from the plain words of the statute were it satisfied that: (1) there is clear and gross balance of anomaly; (2) Parliament, the legislative promoters and the draftsman could not have envisaged such anomaly, could not have been prepared to accept it in the interest of a supervening legislative objective; (3) the anomaly can be obviated without detriment to such legislative objective; (4) the language of the statute is susceptible of the modification required to obviate the anomaly.” 35. None of the conditions is met in this case. Issue 2 36. The issue on jurisdiction is supplementary to Issue 1. Because I have found against [NAME] on Issue 1, Issue 2 does not arise for determination and I do not decide it. However, for what it is worth, I am inclined to agree with the position of both parties that, if [NAME] had been correct on Issue 1, the Commissioner and Tribunal would be required to take into account the compliance issue when it arises in assessing the applicability of section 12. This is because the compliance issue would affect the quantum of costs that could be taken into account in deciding whether section 12 applies, which both the Commissioner and the Tribunal would need to determine under section 50(1) and section 58(1) respectively. Issue 3 37. This is irrelevant, given my conclusion on Issue 1.

[NAME] v [NAME] [2017] UKUT 0318 (AAC) GIA/724/2016 10

Signed on the original [NAME] on 31 July 2017

Judge of the Upper Tribunal