[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	First-tier Tribunal (General Regulatory Chamber)
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> AA v Information Commissioner [2025] UKFTT 312 (GRC) (13 March 2025) URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2025/312.html Cite as: [2025] UKFTT 312 (GRC)

[New search] [Printable PDF version] [Help]

First-tier Tribunal
(General Regulatory Chamber)
Information Rights

		Decided without a hearing On 18 February 2025
		Decision Given On: 13 March 2025

DECISION

On considering the written representations of the parties and other documents tabled, the Tribunal unanimously determines that the appeal is dismissed.

REASONS

Introduction

1. Brighter Futures for Children Ltd ('BFfC') is an independent, not-for-profit limited company which was set up by Reading Borough Council ('the Council') in 2018. It exists to deliver children's social care, early help and prevention and educational services on behalf of the Council.
2. The Appellant, AA^[1], was, at the time relevant to these proceedings, a resident of Reading.
3. This dispute is one of many unhappy consequences of the breakdown of the marriage between AA and his wife and the resulting sustained hostilities between them, largely concerning the two school-age children of the family. These circumstances have necessitated the intervention of, among other agencies, BFfC.
4. In August 2023 BFfC held a child protection conference, following which it is produced the report. The report was divided into two sections, one dealing with the part of the conference attended by AA and one by the part attended by his wife. The former section was shared with him; the latter was not.
5. On 31 August 2023 AA wrote to BFfC asking for a copy of the section of the report based on the part of the child protection meeting which his wife had attended. BFfC replied the same day stating that that section had been redacted because it had concerned the part of the meeting at which the former partner had participated. No provision of FOIA was cited.
6. On 7 September 2023, AA requested an internal review but BFfC took no action. Accordingly, on 29 October 2023 AA complained to the Commissioner who, on 24 November 2023, wrote to BFfC pointing out that its response of 31 August 2023 was not compliant with FOIA as it had cited no exemption, and asked it to carry out an internal review and provide AA with the outcome within 20 working days. BFfC failed to do so.
7. On 29 February 2024 AA complained again to the Commissioner and, on 22 March 2024, the Commissioner gave notice that the complaint had been accepted for investigation.
8. In the course of the investigation, the Council advised the Commissioner that BFfC was withholding the requested information under FOIA, s40(2) (personal information). Up to that moment, no legal justification for refusing the request had been offered.
9. By his Decision Notice ('DN') dated 29 July 2024, the Commissioner determined that most of the information requested was exempt under FOIA, s40(2) in that it contained the personal data of AA's wife and the children and the balance was exempt under s40(1) in that it contained his own personal data. No further steps were required but the Commissioner did comment critically on BFfC's breach of FOIA, s17 in failing to respond to the request within 20 working days and in failing to identify the exemption relied upon or explain such reliance. He also observed that best practice favoured operating an internal review procedure.
10. By a notice of appeal dated 6 August 2024, AA challenged the Commissioner's adjudication on a variety of grounds.
11. The appeal was resisted in a response dated 23 August 2024 on behalf of the Commissioner.
12. To that, AA responded with an exceedingly long reply of 22 September 2024.
13. The matter came before us for consideration on paper, the parties being content for it to be determined without a hearing. We were satisfied that it was just and in keeping with the overriding objective^[2] to proceed in that manner.

The applicable law

The freedom of information legislation

14. FOIA, s1 includes:

(1) Any person making a request for information to a public authority is entitled–

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

'Information' means information recorded in any form (s84).

15. The general right under s1 is subject to a number of exemptions. By s40 it is provided, so far as material, as follows:

(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if—

(a) it constitutes personal data which does not fall within subsection (1), and

(b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a) would contravene any of the data protection principles …

The language and concepts of the data protection legislation are translated into the section (subsection (7)). The exemptions under s40 are unqualified under FOIA and the familiar public interest balancing test has no application. Rather, the reach of the exemptions is, in some circumstances, limited by the data protection regime.

The data protection legislation

16. The data protection regime under the Data Protection Act 2018 ('DPA 2018') and GDPR applies to this case.
17. DPA 2018, s3 includes:

(2) "Personal data" means any information relating to an identified or identifiable living individual ...

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to —

(a) an identifier such as a name, an identification number, location data or an online identifier …

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as —

…

(d) disclosure by transmission, dissemination or otherwise making available …

(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.

18. GDPR, Article 5 sets out the data protection principles. It includes:

Personal data shall be:

1. processed lawfully, fairly and in a transparent manner in relation to the data subject …

19. Article 6, so far as material, provides:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

The Tribunal's powers

20. The appeal is brought pursuant to the FOIA, s57. The Tribunal's powers in determining the appeal are delineated in s58 as follows:

(1) If on an appeal under section 57 the Tribunal consider –

(a) that the notice against which the appeal is brought is not in accordance with the law; or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

Case-law

21. Unlike the general run of information rights cases, the starting-point for the purposes of s40 is that, where they intersect, privacy rights hold pride of place over information rights. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded. At para 7 he commented:

In my opinion there is no presumption in favour of release of personal data under the general obligation that FOISA^[3] lays out. The references which that Act makes to provisions of [the Data Protection Act] 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data …

22. It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, 'necessary' means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be 'necessary' there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, 'necessity' is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing exercise, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.
23. It is legitimate to consider at the outset the first part of (what is now) the Article 6 test (lawful processing), before addressing (if need be) the further elements of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20).

The Commissioner's Guidance

24. In current Guidance on Requests for Personal Data about Public Authority Employees^[4], the Commissioner states (p13):

The data protection exercise of balancing the rights and freedoms of the employees against the legitimate interest in disclosure is different to the public interest test that is required for the qualified exemptions listed in section 2(3) of FOIA.

In the FOI public interest test, there is an assumption in favour of disclosure because you must disclose the information unless the public interest in maintaining the exemption outweighs the public interest in disclosure.

In the case of section 40(2), the interaction with the DPA means the assumption is reversed and a justification is needed for disclosure.

Analysis

25. In view this is an exceedingly clear case. We can well understand why the Commissioner argued that the appeal ought to have been struck out and not permitted to reach a final hearing. That said, despite our emphatic view of the legal merits of AA's appeal, we wish to stress that we entirely accept the sincerity of his feelings about the painful story which underlies the case and the fact that we reject the appeal should not be seen as implying any view whatsoever about the moral merits of many of the things about which he complains. To the contrary, we have very much in mind the fact that internal processes have already significantly vindicated some of his complaints.
26. The first question is whether the information sought amounts to personal data. The answer is yes. It relates to AA, his wife, his children and the other participants in the conference, all identifiable, living individuals.
27. In so far as the information relates to AA, it is absolutely exempt under FOIA, s40(1)(a), being personal data of which he is the data subject.
28. In so far as the information relates to the other relevant individuals, it is the personal data of those individuals, and so exempt under FOIA, s40(2) if any of the three 'conditions' referred to in that subsection applies.
29. The only relevant condition is that disclosure would contravene any of the data protection principles (subsection (3A)(a)). The relevant data protection principles here are those provided for under GDPR, Article 5, para 1 and Article 6, para 1(f).
30. The threshold question here is whether AA is pursuing a 'legitimate interest'. In company with the Commissioner, we readily accept that he is.
31. The duty of 'lawful' processing next imports the requirement of 'necessity'. In our judgment, there is no question of the processing of the personal data of third parties, and in particular the children and AA's wife, being 'necessary' in this case. We have a number of reasons. In the first place, there is obviously no value in, let alone necessity for, disclosure of personal data belonging to those who attended the conference in a professional capacity. As the Commissioner observed (DN, para 33), AA is already aware of who attended and details concerning attendees cannot assist on the matters in which he is understandably interested, namely the things said during the part of the conference from which he was absent.
32. Second, it cannot be said that the processing contended for is the only reasonable means by which the legitimate interests can be pursued (see the Halpin case cited above). Apart from anything else, the interests have been, and (we understand) still are being, pursued through litigation in the Family Court.
33. The third reason why the 'necessity' argument fails is that it is impossible to argue that the disclosure sought here would amount to the minimum interference with data subjects' privacy rights needed to secure the legitimate interests which AA pursues. The fact that he has other resources available to him (not only the Family Court) argues compellingly against the view that disclosure would be a proportionate measure in keeping with the principle in the R v Minister for the Cabinet Office case (see above).
34. A fourth reason why AA falls a long way short on the issue of 'necessity' (which may also be seen as simply a subsidiary point on proportionality) is that disclosure pursuant to FOIA is to the whole world. It is plainly not 'necessary' to disclose the material sought to the whole world and it would be disproportionate and wrong in principle to do so. The sensitivity of the subject matter speaks for itself. Disclosure of such material by other means (for example pursuant to litigation under the control of a court) would not be to the whole world and any recipient would be under a duty of confidence in holding and using it.
35. Fifth, the analysis becomes all the more clear given the explicit reference in GDPR, Article 6, 1(f) to the 'interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child'. The legislation means what it says: even where 'necessity' is made out by reference to the legitimate interests of the controller, the data subject's rights and freedoms may override it, and particularly where children are involved. We are satisfied that even if (contrary to our view) 'necessity' was established, it would be overridden here, if only by reason of the fact that the information in dispute related to children.

Conclusion

36. The statutory bias favouring privacy rights over information rights makes this a very clear case. The processing of personal data for which the AA contends would plainly be unlawful. Accordingly, the request is for information which is exempt and the Commissioner was right to dismiss the complaint.
37. It follows that the appeal must be dismissed.
38. We add two final observations. First, we draw attention to the Commissioner's remark (DN, para 45) that, in so far as the request was for information of which AA was the data subject, it would be open to BFfC to consider providing a response under the data protection legislation.
39. Second, we place on record that we entirely share the Commissioner's critical view of the way in which BFfC responded (or failed to respond) to AA's proper attempts exercise his rights under FOIA. If it lacked the necessary skills or resources to fulfil its obligations directly, it should have called without delay upon the assistance of the Council. Moreover, in light of the experience of this case, we would hope that the Council has taken all necessary steps to ensure that BFfC is fully equipped to meet its obligations in the future.

(Signed) Anthony Snelson

Judge of the First-tier Tribunal

Dated: 6 March 2025

Note 1   Pursuant to an anonymisation order made on 18 February 2025    [Back]

Note 2    See the First-tier Tribunal (General Regulatory Chamber) Rules 2009 (as amended), rule 2.    [Back]

Note 3   The proceedings were brought under the Freedom of Information (Scotland) Act 2000, but its material provisions do not differ from those of FOIA.     [Back]

Note 4       [Back]