Kanter-Webber v Information Commissioner [2025] UKFTT 262 (GRC) (26 February 2026)

Background to Appeal

1. This Appeal dated 16 October 2024 and made by Rabbi Gabriel Kanter-Webber (the "Appellant") arises following a request for information (the "Request") made by the Appellant to the Charity Commission ("CC") on 27 November 2023 in the following terms:

"Please can you provide me with the following information in an electronic format:

1. The names of past and present trustees of the Campaign Against Antisemitism [CAA] (charity

1163790), along with their dates of service.

2. A copy of any applications made by the charity, or its trustees, for regulation 40 exemption from the need to publish the names of its trustees."

2. CC responded on 11 December 2023 to confirm that s40(2) and s41(1) of FOIA applied to the remainder of the information held by CC and therefore CC were not able to provide the Appellant with all of the requested information.

3. On the same date, the Appellant requested an internal review of CC's handling of the request on the basis that there is always public interest in charity trustees being identified and charity trustees must expect their identities to be known to the public. Moreover, the Appellant claimed that there is a strong public interest in transparency as to the process by which the charity became exempt from publishing the identities of the trustees.

4. On 7 March 2024, CC responded having undertaken the requested internal review. CC upheld their previous response that the exemptions provided at s40(2) and s41(1) FOIA applied, and therefore the requested information held by CC would not be disclosed.

5. The Appellant complained to the Information Commissioner on 29 April 2024 and invited the IC to issue a decision notice requiring the CC to disclose the requested information.

Reasons for Commissioner's Decision

6. In a Decision Notice ("DN") dated 2 August 2024, the Information Commissioner ("IC") held that:

"The Commissioner's decision is that the requested information is exempt under section 40(2) and section 41(1). The Commissioner does not require further steps."

7. In summary, The Commissioner's reasons for the Decision were that the requested information contains personal data which is exempt by virtue of s 40(2) FOIA.

8. The IC determined that although there was a legitimate interest being pursued by the Appellant in that he is concerned that senior members of CC have political affiliations which are not compatible with its charity status and the appropriateness of a financial arrangement between this charity and another and the salary of the charity's Chief Executive.

9. However, the Commissioner does not consider that the disclosure of the requested names is necessary to meet this legitimate interest. This is because the CC does not need to confirm the names of current or past trustees as the Appellant asserts, and the IC accepts, that there is information about individuals' affiliation with the charity in the public domain. However, the IC considers that there is no information that confirms past or present trustees in the public domain. Accordingly, if the Appellant has used the information about individuals already in the public domain to make or substantiate the allegations against the charity, they can be brought to the CC directly via their complaints process.

10. The IC accepts that there is a legitimate interest in transparency and accountability, in relation to the charity and the CC, but does not accept that the legitimate interest outweighs the rights and freedoms of the individuals whose data is being requested, particularly given that CC has granted a dispensation from publicly naming the trustees and disclosure of the information would be beyond the expectations of the individuals and would cause them distress.

11. The IC recognises that the charity has attracted controversy, and that CC has real concerns in relation to trustees' safety should the information be disclosed.

12. The IC decided there was no lawful basis for disclosure under Article 6 UK GDPR.

13. The IC considered that the application by the charity to the CC for dispensation from publishing the names of its trustees is not trivial nor in the public domain and accordingly, has the necessary quality of confidence. The IC was satisfied that the information was imparted in circumstances of an obligation of confidence.

14. The Commissioner considers there would be damage to both the CC and the data subject(s) to whom the application relates, were the information to be disclosed and that were the CC to breach this confidence and disclose the requested information, it's likely that the Charity would be able to bring against it an actionable breach of confidence.

15. The IC determined that the public interest lies in preserving the confidentiality, given the alternative methods that are available to the complainant to pursue their concerns, and the information that the Charity Commission has already placed in the public domain. The IC decided that if the complainant believes the trustee dispensation has been granted erroneously, they can raise a complaint with the CC. Furthermore, the Charity Commission has explained its trustee dispensation process on its website which goes some way to meeting the public interest in the requested information.

Appeal and Responses

16. The appeal relates to the application of the Freedom of Information Act 2000.

17. The Appellant originally appealed the Decision Notice on the following grounds:

(a) The CC took too long to respond to the Appellant's request for an internal review;

(b) The exemptions were wrongly applied by the IC in that:

(i) The charity's chief executive's name and address is already in the public domain. If there were to be harm suffered by release of trustees' names, one would expect the chief executive to have suffered harm.

(ii) Most other Jewish charities disclose names of trustees without any harm being suffered. There is no evidence to show that there is a unique or higher risk to CAA than other Jewish charities.

(iii) There is a public interest in identifying trustees as CAA is extremely active and controversial

(i) It fails to regard the decision of Parliament that a complaints process is insufficient and that the register of charities and trustees must be available to the public, at least in the vast majority of cases and

(ii) It fails to recognise that some causes of complaint against a charity may only become known if trustees' names are published and their misconduct can then be affiliated to a specific charity.

(iii)

(d) The public interest argument also defeats the application of s41 FOIA

The IC responded to the appeal to state that the Decision Notice was correct and that the appeal should be dismissed. Despite any previous decisions and general assertions regarding the publication of trustees' names, the IC contends that the question for the Tribunal is whether the names of the trustees on the facts of this case should be disclosed to the public. The IC maintains that the disclosure of the necessary information is not necessary to meet the legitimate interests in this case.

19. Moreover, the IC says it was correct to conclude that disclosure would contravene the Data Protection principle set out in Article 5(1)(a) of the UK General Data Protection Regulations (UKGDPR) and that the condition under Article 6(1)(f) UKGDRP is not met. Accordingly, the s40(2) exemption was engaged.

20. In response to the Appellant's arguments in relation to s41 FOIA, the Commissioner maintains that he was correct to conclude in his DN that the public interest in disclosure does not outweigh the public interest in maintaining confidentiality given that a complaint can be raised with the Charity Commission should someone believe that the trustee dispensation had been granted when it should not have been and given the information on the Charity Commission's website concerning the trustee dispensation process

Documents

21. The Tribunal was provided with an 80-page bundle and a closed bundle of documents which included the withheld material.

Applicable Law

22. The relevant provisions of FOIA are as follows:

1 General right of access to information held by public authorities.

(1) Any person making a request for information to a public authority is entitled—

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

40 Personal information.

(2) Any information to which a request for information relates is also exempt information if -

(a) it constitutes personal data which does not fall within subsection (1), and

(b) [the first, second or third] condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a) would contravene any of the data protection principles,

41 Information provided in confidence.

(1) Information is exempt information if—

(a) it was obtained by the public authority from any other person (including another public authority), and

(b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.

58 Determination of appeals.

(1) If on an appeal under section 57 the Tribunal considers—

(a) that the notice against which the appeal is brought is not in accordance with the law, or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based

23. The relevant provisions of the Data Protection Act 2018 are:

3 Terms relating to the processing of personal data

(1) .....

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a) an identifier such as a name, an identification number, location data or an online identifier,

24. The relevant provisions of the UK General Data Protection Regulations are:

Article 5 Principles relating to processing of personal data

1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency')

Article 6 Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Discussion and Conclusions

25. In accordance with section 58 FOIA, the issue for the Tribunal to decide upon is whether the IC's Decision Notice was in accordance with the law and whether the IC was correct in finding that the Charity Commission was entitled to rely on section 40(2) FOIA

26. Under section 58(2) FOIA, the Tribunal is able to review any finding of fact upon which the Decision Notice was based, consider all of the evidence before it and reach its own decision.

27. The Tribunal has considered two bundles of documents, and the relevant law and will consider each stage of the appeal below.

Part 1 of the Request - the request for names of Trustees

28. The IC considered that the information requested in relation to the names of the trustees of CAA was exempt information under s40(2) FOIA in that the requested information contained personal data.

Does the exemption under section 40(2) FOIA apply?

29. Under s40(2) FOIA, information is exempt from disclosure if it contains personal data and when one of the conditions listed in s40(3A), (3B) or 40(4A) is satisfied.

Does the withheld information contain personal data?

30. There is no alternative but to answer 'yes' to this question. As set out earlier in this decision, s3(2) DPA 2018 defines personal data as "any information relating to an identified or identifiable living individual". It is unquestionably the case that a person's name is an identifying feature and clearly identifies a person.

Is one of the conditions listed in s40(3A), (3B) or 40(4A) satisfied?

31. The condition under Section 40(3A)(a) is that the disclosure of the withheld information to a member of the public would contravene any of the data protection principles.

32. The relevant Data Protection Principle in this case can be found in Article 5(1)(a) UK GDPR which provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.

33. Article 6 (1) UK GDPR provides that processing shall only be lawful if one of the conditions listed in the Article applies.

34. Article 6(1)(f) is the condition most applicable in this case and provides that processing of personal data shall only be lawful if the processing is necessary for the purposes of the legitimate interests pursued by the Applicant except where such interests are overridden by the interests or fundamental rights of the data subjects (i.e. the charity's trustees) which require protection of personal data.

35. In South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55; [2013] 1 WLR 2421 Lady Hale DP observed (at paragraph 18) that the proper interpretation and application of condition 6 required three discrete questions to be answered:

(a) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? ("Legitimate interests test")

(b) Is the processing involved necessary for the purposes of those interests? ("Necessity test")

(c) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? ("Balancing test")

Is the Appellant pursuing a legitimate interest or interests?

36. The Tribunal and indeed the IC accept that the Appellant has a legitimate interest in the withheld information and in knowing the names of the trustees of CAA.

37. The Tribunal accepts that there is a legitimate interest in holding any charity and its trustees to account in terms of transparency and in understanding the processes of the CC in handling regulatory complaints.

Is the processing involved necessary for the purposes of those interests?

38. The Tribunal does not accept that the processing and disclosure of the withheld information is necessary to meet the Appellant's legitimate interests.

39. If, as the Appellant avers, the purpose of the disclosure of the withheld information is to understand the transparency of the process, then the Appellant may find this information on the CC website, and within the CC's published policies, guidance and annual report.

40. It is not necessary to have the names of CAA trustees to understand the process and in any event, the CC's website makes it clear that personal data is not required to make a complaint. If, as is clearly the case, the Appellant is dissatisfied with this position and the dispensation granted by the CC, then he is permitted to make use of the CC complaints procedure.

41. The Tribunal considers that the current request under FOIA is unnecessary to achieve the Appellant's desired outcome. There is nothing to be gained in making the FOIA request as, even if the Appellant were to obtain the withheld information (which he will not, given the dispensation granted by the CC), his next steps would be to make a complaint to the CC.

42. The Appellant is able to make such complaint to the CC at this stage and will be no further along in the process by having made the FOIA request which forms the basis of this appeal.

43. The Tribunal does not consider that the "Necessity test" has been met and accordingly, it is unnecessary to consider the "Balancing test". Accordingly, processing of the withheld information in relation to the names of the trustees of CAA is not lawful as there is no gateway to make it so.

Part 2 of the Request - request for disclosure of any applications made by the CAA to CC for exemption to publishing the names of its trustees

44. The IC considers that the information requested in this part of the request is exempt under s.41(1) FOIA in that disclosure would constitute a breach of confidence.

45. s.41(1) FOIA is an absolute exemption, its application is not subject to the public interest balancing test.

46. The action of CAA in sending the application for exemption to the CC is clearly information imparted in confidence particularly since the very nature of the application is to keep the contained information confidential.

47. The withheld information has been considered by the Tribunal and does have the necessary quality of confidence in that it is not already in the public domain and is not trivial. In the Tribunal's view, disclosure of the withheld information is likely to cause harm to the CAA and its trustees.

48. Accordingly, the Tribunal considers that the information requested in Part 2 of the Appellant's request is exempt by virtue of s41(1) FOIA. However, although the Tribunal is satisfied that s41(1) FOIA applies in this case, the Tribunal does not agree that its application is appropriate for the reasons given at paragraph 35 of the DN. The Tribunal has set out its reasons at paragraph 49 of its closed decision.

49. Having considered all of the circumstances, the Tribunal finds that the Information Commissioner's decision was correct in law and dismisses the appeal.

Signed Judge Mornington Date: 18 February 2025

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	First-tier Tribunal (General Regulatory Chamber)
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Kanter-Webber v Information Commissioner [2025] UKFTT 262 (GRC) (26 February 2026) URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/262.html Cite as: [2025] UKFTT 262 (GRC)

First-tier Tribunal (General Regulatory Chamber)

40 Personal information.

3 Terms relating to the processing of personal data