[2024] UKUT 245 (AAC)

The appellant’s case was that the data he requested would demonstrate and/or further inform his belief that there had been race discrimination in the School’s GCSE results. My concerns on granting permission to appeal on this ground were, as set out above, (a) that the Tribunal had arguably failed to understand (and thus take into account) how disclosure of the information he requested might have furthered the legitimate interest in exposing discrimination (or, at least, enabling analysis of whether or not there may have been discrimination); and/or (b) that the Tribunal had wrongly abrogated its duty to decide for itself whether the data would further that legitimate interest rather than accepting the school’s statistical analysis; and/or (c) that the Tribunal had failed to give adequate reasons for rejecting the appellant’s case in relation to this aspect of the appeal.

The Information Commissioner in his response to the appeal, however, submits that the Tribunal has not erred in law in its approach to this issue. The Commissioner submits that the language the Tribunal uses at [63] (“the Tribunal was satisfied…”) makes clear that it did not abrogate its decision-making function but assessed the evidence for itself, only ‘taking note’ of the School’s statistical analysis.

The Information Commissioner further submits that under the data protection statutory regime, it is primarily a matter for the data controller to make evaluative judgments and they enjoy a wide margin of appreciation when doing so, akin to that margin that may be allowed to public authorities in certain human rights contexts.

The Commissioner refers in support of that submission to DB v General Medical Council [2018] EWCA Civ 1497, [2019] 1 WLR 4044. That case concerned a subject access request made to the GMC by a patient who wished to bring a claim against his GP. The request was for report that the GMC had obtained about the GP for the purpose of fitness to practice proceedings. GMC agreed to disclose the report to the patient although it also contained the personal data of the GP because it considered that it would be “reasonable in all the circumstances” to comply with the request despite the lack of consent from the GP applying the test in what was then section 7(4)(b) of the Data Protection Act 1998 (the 1998 Act). The GP brought a Part 8 claim seeking to prevent the disclosure of the report. The judge at first instance found in favour of the GP. The Court of Appeal reversed that decision. Among other things, the Court of Appeal held that, when balancing the rights of data subjects in respect of personal data requested under s 7 of the 1998 Act, the data controller was the primary decision-maker. The majority of the Court of Appeal put it as follows at [86]:

86.

The legal context is that the relevant duties under section 7(1) and under section 7(4)–(6) are duties imposed on data controllers. In a mixed data case falling for consideration under section 7(4)(b) , a data controller will be obliged to disclose relevant information if it is reasonable in all the circumstances to do so. It is the data controller who is the primary decision-maker in assessing whether it is reasonable or not. The class of persons who qualify as data controllers under the DPA is a very wide one. They come in all shapes and sizes, across a very wide range in terms of resources available to them to deal with SARs which may be made to them. The legislation confers rights on the whole population. The potential number of SARs is huge. In this context, the legislature contemplated that individual data controllers should be afforded a wide margin of assessment in making the evaluative judgments required in balancing the privacy rights and other interests in issue under section 7(4) . The incommensurable and very varied nature of the interests of requesters, objectors and data controllers which might be taken into consideration in the balancing exercise under section 7(4)–(6) also indicates that individual data controllers have a wide margin of assessment under section 7(4)(b) . This corresponds to the wide margin of appreciation which a public authority enjoys when competing Convention rights under article 8 of the ECHR fall to be balanced against each other: see Evans v United Kingdom [2007] 1 FLR 1990 , para 77. The effect of all this is that, apart from the mandatory relevant considerations identified in section 7(6) , data controllers generally have a wide discretion as to which particular factors to treat as relevant to the balancing exercise: R (Corner House Research) v Director of the Serious Fraud Office (JUSTICE intervening) [2009] AC 756 , para 40, per Lord Bingham of Cornhill. They also have a wide discretion as to the weight to be given to each factor they treat as relevant. As Auld LJ stated in Durant v Financial Services Authority [2004] FSR 28 , para 60:

“Parliament cannot have intended that courts in applications under section 7(9) should be able routinely to ‘second-guess’ decisions of data controllers, who may be employees of bodies large or small, public or private or be self-employed. To so interpret the legislation would encourage litigation and appellate challenge by way of full rehearing on the merits and, in that manner, impose disproportionate burdens on them and their employers in their discharge of their many responsibilities under the Act …”

The Commissioner also submits that the authorities that I cited in the grant of permission from the sphere of employment discrimination law have “no bearing” on the Tribunal’s judgment in this case. The Commissioner submits that the context of an employment discrimination claim is different in that the regime under the Equality Act 2010 sets out what the Commissioner describes as a “formal comparative framework”, whereas in this case the Tribunal was concerned with the value of the specific information requested to the appellant in view of his accepted legitimate interest.

Having reflected further on this case in the light of both parties’ submissions, I accept the Commissioner’s submission that the Tribunal in this case has not erred in law in the respect identified in this ground of appeal.

The Tribunal in its decision has properly directed itself to the correct legal principles. At [63] it identified the legitimate interest of the School/appellant for the purposes of Article 6(1)(f) of the GDPR as being to “show how the School approached grading and, if it were the case as alleged, whether there was an anomaly correlating to ethnicity”. (The Tribunal referred to this legitimate interest as being the “public interest” as if it was dealing with the test in section 2 of FOIA, but I do not think that anything turns on that misuse of terminology which is a semantic point in this context.)

The Tribunal has then at [63] explained why it considers that it is not necessary for the pursuit of that legitimate interest for the information requested to be disclosed (by which it was referring for the reasons I have given only to Requests 1, 2 and 3 and not 4). In reaching that conclusion, it has relied heavily on the statistical data already published by the School and the School’s view that the ethnicity groups are too small to establish statistical significance. However, I am satisfied that when the decision is read in the generous way that the authorities require me to read it, it is clear that the Tribunal has applied its own mind to the correct legal issue. The factors it has relied on in reaching its conclusion were undoubtedly relevant factors. The weight that it gave those factors was a matter for it and cannot be overturned on appeal unless the Tribunal’s decision reaches the high threshold of perversity.

I further agree with the Information Commissioner’s submission that the Tribunal has not erred in law by failing to take account of the ways in which data such as that requested by the appellant might be relevant to proving discrimination in the context of a claim under the Equality Act 2010 (EA 2010). Whether or not the sort of data that the appellant has requested in this case would fall to be disclosed in proceedings if he were to bring a claim under the EA 2010 against the school would be a matter for the relevant tribunal or court to judge by reference to the particular pleaded case. Disclosure of information of this type would not be routine. More importantly, however, as the Information Commissioner submits, the Tribunal in this case under FOIA is faced with the different question of whether it is ‘necessary’ to the pursuit of the identified legitimate interest (which was not the making of a claim under the EA 2010) to disclose the information requested. The Tribunal’s reasons for finding it was not necessary in this particular case were in my judgment adequate and there was no need for it to go further of its own motion to explore the kind of points that I referred to when granting permission to appeal (especially as the appellant had not before the First-tier Tribunal formulated his case in those terms).

For these reasons, this ground of appeal fails.

It will be noted that I have reached my conclusion without reference to the Court of Appeal’s decision in DB, relied on by the Information Commissioner. That is because I am not satisfied that what the Court of Appeal said in that case at [86] about the approach to section 7(4)(b) of the 1998 Act can be read across to section 40(2) of FOIA. I have in mind that section 7(4)(b) of the 1998 Act requires the data controller to assess the balance to be struck between the competing interests of two (or more) data subjects whose personal data it holds. The data controller’s own personal interests will often not be engaged at all. The data controller is therefore likely in general to be in a good position fairly to assess and balance the competing interests at stake. The Court of Appeal’s reasons in DB appear to me to reflect that context.

The position is somewhat different under section 40(2) of FOIA and Article 6(1)(f) of the GDPR because there is not in principle parity between the interests at stake. The exercise will very often equate to the balancing act under section 2 of FOIA with which the Tribunal will be most familiar, i.e. a balance between the ‘private’ interests of the data subject and the ‘public’ interests of the requestor, which latter may run counter to the ’personal’ interest of the public authority itself. Thus in this case the appellant has made no secret of his belief that there has been discrimination and the School will have an interest in defending itself from that ‘charge’. I am not therefore satisfied that it would be right for a ‘margin of appreciation’-type approach to be taken under section 40(2) of FOIA. However, I am satisfied that the Tribunal in this case did not in fact apply a ’margin of appreciation’-type approach. It did not say it was doing so and the language of the decision does not suggest that it did. I have therefore been able to reach the conclusion that there was no error of law in this aspect of the Tribunal’s decision without making any determination as to whether the Commissioner’s submission in reliance on DB is correct in law or not.