FT/EA/2024/0195 - [2025] UKFTT 01263 (GRC)

FOIA provides that any person making a request for information to a public authority is entitled to be informed in writing if that information is held (section 1(1) (a)) and if that is the case to be provided with that information (section 1(1) (b)). These entitlements are subject to a number of exemptions which can be absolute or subject to the public interest balance in section 2(2)(b) FOIA namely that in:-

“... all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information”

The exemption in section 31(1)(g) FOIA, which is subject to the public interest balance, provides that:-

Section 31(2)(c) FOIA provides:-

Section 40 FOIA concerns personal information. Subsection 40(2) provides:

“(2)

Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles …

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the UK GDPR (general processing: right to object to processing).

(4A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018 …

Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) DPA), and so includes disclosure under FOIA.

The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation (“UK GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” (Article 6(1)(a)).

It also includes where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The UK GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.

The balancing of interests test under Article 6(1)(f) involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):

The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Section 41 FOIA concerns information provided in confidence. Under subsection (1) information is exempt from disclosure if it was obtained by the public authority from any other person and the disclosure of the information to the public (otherwise than under FOIA) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.

Under section 43(2) FOIA, information is exempt if its disclosure under FOIA would, or would be likely to, prejudice the commercial interests of any person (including the public authority holding it).

Section 44(1)(a) provides that information is exempt information if its disclosure is prohibited by or under any enactment. As it is an absolute exemption the public interest balance does not apply. The relevant statute in these appeals is the Utilities Act 2000 (“UA 2000”).