[2023] UKUT 130 (AAC)

I emphasise these three categories of request as only one of them (the third) arises on this appeal to the Upper Tribunal. This is because Mr Pereira confirmed to the First-tier Tribunal that he was no longer seeking the name of the debt adviser/authorised intermediary, but just the organisation for which that person worked, which he had subsequently been provided with. Further, Mr Pereira succeeded in his appeal to the First-tier Tribunal about being disclosed further information by the Insolvency Service in respect of his request for general information about how a DRO is awarded.

It had become apparent during the Information Commissioner’s investigation of Mr Pereira’s complaint against the Insolvency Service’s responses to his requests that the public authority held written guidance for staff in the small number of cases where objections or complaints are received against DROs. The Insolvency Service had not disclosed this guidance to Mr Pereira under FOIA as it had not been used in the case of the third party’s DRO and therefore was considered to be irrelevant to Mr Pereira’s requests. The Information Commissioner effectively endorsed the Insolvency Service’s approach on this point by holding that the request for such guidance did not come within the scope of any of Mr Pereira’s requests. The First-tier Tribunal allowed Mr Pereira’s appeal on this point as it did not consider Mr Pereira’s requests were limited to information relating to the particular third party DRO of which Mr Pereira was particularly aggrieved. The First-tier Tribunal therefore substituted a decision notice in the following terms.

“The [Insolvency Service] is required to take the following steps to ensure compliance with the legislation:-

Reconsider [Mr Pereira’s] requests afresh on the basis that the scope of the requests includes all information (such as guidance to staff) which covers the steps carried out to ensure that claims have got merit including the steps to be taken in relation to contested DROs, not limited to the information used in relation to the specific DRO with which [Mr Pereira] has been involved.

The [Insolvency Service] must take these steps within 35 calendar days of the date of this decision, and inform [Mr Pereira] of the outcome from taking those steps within the same time period.”

I have dealt with this point in some detail because Mr Pereira considers the Insolvency Service has failed to carry out the above steps ordered by the First-tier Tribunal and he (wrongly) thought this alleged failing would fall for consideration on this appeal. I advised Mr Pereira that this was not the case as all I was concerned with was his challenge to part of the First-tier Tribunal’s decision that did not find in his favour. That is the part of the decision that concerned the specific details of the third party’s DRO. Challenging a failure of a party to carry out the steps it had been ordered to carry out gives rise to separate proceedings under section 61(3) and (4) of FOIA and rule 7A of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2008. It is for Mr Pereira to investigate the basis of his making an application under that route.

Reverting then to the issue on this appeal, the First-tier Tribunal dealt with it as follows:

“39.

The other ‘live’ issue in this case is whether disclosure of information relating to the specific DRO application with which the Appellant is involved, is covered by s40(2) FOIA and exempted from disclosure.

40.

Applying the legal framework above, it is our view that the information sought is clearly the personal information of the third party applicant, and it is additional to the information currently available about the third party online.

41.

We accept the Commissioner’s analysis in the decision notice that the Appellant has a legitimate interest in the disclosure of the information, to enable him to discover how the third party was able to successfully apply for a DRO in the circumstances of the case. Given the availability of some information online, the process which led to the revocation of the DRO, and the availability of the Ombudsman to investigate the procedures of the Insolvency Service this must lessen the Appellant’s legitimate interest in disclosure. We are also less sure than the Commissioner that disclosure would be necessary to fulfil this legitimate interest, but on balance we accept that there may be undisclosed information which it would still be necessary for the Appellant to have access to.

42.

Therefore, to complete our analysis, it is necessary to balance these legitimate interests in disclosure to the Appellant against the data subject’s interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure.

43.

We agree with the Commissioner’s view that the named third party would have no expectation that the Insolvency Service would disclose details of his DRO application to the ‘world at large’ (as disclosure under FOIA cannot be restricted). We have viewed the withheld information, and its disclosure would clearly interfere with the privacy rights of the named third party and be likely to cause him harm and/or distress. We note the Appellant’s allegation that the third party has been dishonest in his application, but it seems to us that, even if that is so, that does not remove the third party’s reasonable expectation that the information will not be disclosed.

44.

Therefore, we accept that Appellant has a limited legitimate interest in accessing this information, but in our view this is insufficient to outweigh the third party’s fundamental rights and freedoms relating to their private life, even if the information provided during the application process was not all true.”

The First-tier Tribunal’s reference in paragraph 40 to the “legal framework is a reference to the following earlier paragraphs in its decision.

“12.

Under section 1(1)(a) FOIA, a public authority is obliged to tell an applicant whether or not it holds the information requested. The ‘scope’ of the request itself is something to be interpreted by the public authority and the Commissioner, and now by the Tribunal.

13.

There are also issues in this case which relation to the disclosure of information which is potentially ‘personal’ in nature. Section 40 (2) FOIA reads as follows:-

(2)

Any information to which a request for information relates is also exempt information if—

(a)

it constitutes personal data which does not fall within subsection (1) (personal information of the applicant], and

(b)

the first, second or third condition below is satisfied.

14.

Section 3(2) of the Data Protection Act 2018 (DPA 2018) defines personal data as ‘any information relating to an identified or identifiable living individual’.

15.

The relevant condition (as referred to in s40(2)(b) FOIA) in this case is found in s40(3A)(a):-

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles.

16.

Under s40(7) FOIA the relevant data protection principles in this case are to be found, first, in Article 5(1) of the General Data Protection Regulation (GDPR). Materially, Article 5(1)(a) reads:-

Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).

17.

Further, and relevantly for this case by Article 6(1) GDPR:-

Processing shall be lawful only if and to the extent that at least one of the following applies:

(a)

the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(f)

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…

18.

In relation to the tests to be applied at this last stage the principles are set out in Goldsmith International Business School v IC and the Home Office [2014] UKUT 0563 (AAC) and explained as follows:-

33.

In making his submissions Mr Knight referred me to four authorities, being (in date order) decisions of the Information Tribunal, the Divisional Court, the Supreme Court and the Upper Tribunal respectively. These were: (1) Corporate Officer of the House of Commons v Information Commissioner and Others (EA/2007/0060-0063, 0122-0123 and 10131) (abbreviated here to “Corporate Officer (Information Tribunal)”); (2) Corporate Officer of the House of Commons v Information Commissioner and Others [2008] EWHC 1084 (Admin) (“Corporate Officer (Divisional Court)”); (3) South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 (“South Lanarkshire”); and finally (4) Farrand v Information Commissioner [2014] UKUT 310 (AAC) (“Farrand”). The last, of course, was decided after the Tribunal had given its decision on the present appeal.

34.

Mr Knight helpfully set out eight principles or, as I prefer to call them, eight propositions, derived from this case law. I set them out below, including references to the relevant passages in the various decisions as authority for these propositions as (a) I endorse them; (b) they assist in resolving the present appeal; and (c) this taxonomy may well prove a useful roadmap for the Commissioner and other First-tier Tribunals when seeking to chart a path through the thicket of issues thrown up by Condition 6(1) of Schedule 2 in other cases…

35.

Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three questions to be asked:

“(i)

Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii)

Is the processing involved necessary for the purposes of those interests?

(iii)

Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”

Authority: South Lanarkshire at [18].

36.

Proposition 2: The test of “necessity” under stage (ii) must be met before the balancing test under stage (iii) is applied.

Authority: Corporate Officer (Information Tribunal) at [58], South Lanarkshire at [18] and Farrand at [29].

37.

Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity.

Authority: Corporate Officer (Divisional Court) at [43] and Farrand at [26]- [27].

38.

Proposition 4: Accordingly the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality, although this may not add much to the ordinary English meaning of the term.

Authority: Corporate Officer (Divisional Court) at [43], South Lanarkshire at [27] and Farrand at [26].

39.

Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.

Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South Lanarkshire at [27].

40.

Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part test.

Authority: South Lanarkshire at [27].

41.

Proposition 7: Where Article 8 privacy rights are in issue, the question posed under Proposition 1 can only be resolved after considering the excessive interference question posted by stage (iii).

Authority: Corporate Officer (Information Tribunal) at [60]-[61] and South Lanarkshire at [25].

42.

Proposition 8: The Supreme Court in South Lanarkshire did not purport to suggest a test which is any different to that adopted by the Information Tribunal in Corporate Officer (Information Tribunal).

Authority: South Lanarkshire at [19]-[20] and Farrand at [26].”