Reference: FS50802258
Freedom of Information Act 2000 (FOIA)
Decision notice
Date: 6 June 2019
Public Authority: Information Commissioner’s Office
Address: Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Note: This decision notice concerns a complaint made against the
Information Commissioner (‘the Commissioner’). The
Commissioner is both the regulator of the FOIA and a public
authority subject to the FOIA. She is therefore under a duty as
regulator to make a formal determination of a complaint made
against her as a public authority. It should be noted, however,
that the complainant has a right of appeal against the
Commissioner’s decision, details of which are given at the end of
this notice. In this notice the term ‘ICO’ is used to denote the
ICO dealing with the request, and the term ‘Commissioner’
denotes the ICO dealing with the complaint.
Decision (including any steps ordered)
- The complainant has requested information associated with the
Information Commissioner’s categorisation of applications for a decision
under section 50(1) of the FOIA from Mr Alan Dransfield as frivolous or
vexatious under section 50(2)(c). The ICO confirmed it does not hold
some of the information requested. It has refused to disclose the
information it does hold under section 40(2) of the FOIA as it considers
this to be the personal data of a third person. - The Commissioner’s decision is as follows:
On the balance of probabilities, the ICO does not hold information
falling within the scope of part (ii) of the request and has complied
with section 1(1)(a) of the FOIA in respect of this part.
• The recorded information falling within the scope of parts (i) and
(iii) of the request to which the ICO has applied section 40(2) is
the personal data of a third person and is exempt from release
under this exemption. - The Commissioner does not require the ICO to take any remedial steps.
Request and response - On 22 August 2018, the complainant wrote to the ICO and requested
information in the following terms:
“…If true, this would be a blanket ban on accessing the Commissioner
and the Tribunal system. I therefore ask for (i) the email
correspondence between Mr Dransfield and the Commissioner
concerning the effective ban imposed on Mr Dransfield (including any
warnings that were made) (ii) any minutes or internal correspondence
discussing the basis for implementing this decision and (iii) the
contents of s.50 complaints that were rejected under s.50(2)(c). The
reason I ask is that I am genuinely interested in how the ICO would
reach such a decision, given the extreme implications of it.
Given the voluminous material that Mr Dransfield publishes on social
media, and the fact that he is well known as the complainant in the
lead case in the Upper Tribunal concerning vexatiousness, it is highly
doubtful that s.40 would apply to any of the information requested.” - On 17 September 2018 the ICO responded. It confirmed it holds
information within the scope of parts (i) and (iii) of the request and that
it does not hold information within the scope of part (ii). - The ICO withheld the information it holds under section 40(2) of the
FOIA because it is personal data and disclosure would breach one of the
data protection principles; namely the principle under Article 5(1)(a) of
the General Data Protection Regulation (GDPR). The ICO provided some
general information with regard to the subject of the request ie its
application of section 50(2)(c) in a particular case and generally. - The ICO provided a review on 15 October 2018. It upheld its original
position.
Scope of the case - The complainant contacted the Commissioner on 14 November 2018 to
complain about the way his request for information had been handled. - The Commissioner’s investigation has focussed on whether the ICO
holds information falling within the scope of part (ii) of the complainant’s
request and whether it can rely on section 40(2) to withhold information
it does hold that falls within the scope of parts (i) and (iii) of the
request.
Reasons for decision
Background - Under section 50(1) of the FOIA any person may apply to the
Commissioner for a decision whether, in any specified respect, a request
for information he or she has made to a public authority has been dealt
with appropriately. - Section 50(2)(c) says that the Commissioner shall make a decision
unless it appears to her that the application for a decision is frivolous or
vexatious. - The Commissioner relied on section 50(2)(c) with regard to applications
submitted to her by Mr Dransfield, referred to in the request.
Section 1 – general right of access to information held by public
authorities - Under section 1(1) of the FOIA anyone who requests information from a
public authority is entitled (a) to be told if the authority holds the
information and (b) to have the information communicated to him or her
if it is held and is not exempt information. - The complainant considers that the ICO holds information falling within
the scope of part (ii) of his request, which was for “any minutes or
internal correspondence discussing the basis for implementing this
decision”. - In its submission to the Commissioner, the ICO has explained that any
documents created in the handling of its casework are held on its
electronic casework management system (CMEH). In order to answer
this part of his request the ICO says it performed searches of CMEH, and
specifically reviewed all the documents and records held on the cases
raised by Mr Dransfield that were subject to its application of section
50(2)(c) in this instance. The ICO says it also undertook consultations
with the author of the section 50(2)(c) letter and the case officer and
other department group managers who may have been involved in the
handling of these cases. The ICO requested that they conduct searches
for any information in scope of the request not held on CMEH. This
would include their official email accounts and any other locations that
they store information, such as Sharepoint. - The ICO has confirmed that searches located no information that fell in
scope of the request and no information falling in scope of the request
was returned by any of the individuals involved in handling these
complaints. - The ICO also confirmed that further searches had been conducted at
internal review stage by the reviewer, the Principal Adviser in its FOI
Complaints and Appeals department, including a review of the material
held on the request file and a meeting with the Head of FOI Complaints
and Appeals. The review was satisfied that no information falling in
scope of part (ii) of the request is held. - The Commissioner considers that the ICO undertook thorough and
appropriate searches for any information it might hold that falls within
the scope of part (ii) of the request. She is satisfied, on the balance of
probabilities, that the ICO does not hold any information relevant to this
part.
Section 40 – personal data - Section 40(2) of the FOIA says that information is exempt from
disclosure if it is the personal data of third persons, ie someone other
than the applicant, and a condition under either section 40(3A), 40(3B)
or 40(4A) is also satisfied. - The first step for the Commissioner is to determine whether the withheld
information constitutes personal data as defined by the Data Protection
Act 2018 (‘DPA’).
Is the information the personal data of a third person? - Section 3(2) of the DPA defines personal data as: ‘any information
relating to an identified or identifiable living individual’. - The two main elements of personal data are that the information must
relate to a living person and that the person must be identifiable. - An identifiable living individual is one who can be identified, directly or
indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social identity of the individual. - Information will relate to a person if it is about them, linked to them,
has biographical significance for them, is used to inform decisions
affecting them or has them as its main focus. - The ICO has provided the Commissioner with a copy of the information
it is withholding under section 40(2). With regard to part (i) of the
request the information comprises:
• correspondence from the ICO to Mr Dransfield
• internal correspondence; and
• correspondence from Mr Dransfield to the ICO, the Commissioner
and the First Tier Tribunal (Information Rights). - With regard to part (iii) of the request the information comprises
correspondence between Mr Dransfield, other public authorities and the
ICO associated with FOI complaints that he submitted to the ICO under
section 50 of the FOIA. - The Commissioner is satisfied that all this information is Mr Dransfield’s
personal data for the reasons given at paragraphs 23 and 24. As the
ICO has noted in its submission to her, the requested information refers
specifically to Mr Dransfield by name and relates to correspondence
between him and the ICO, and the contents of his section 50 complaints
to the ICO under the FOIA. - The fact that information constitutes the personal data of identifiable
living individuals does not automatically exclude it from disclosure under
the FOIA. The second element of the test is to determine whether any of
the conditions under sections 40(3A), 40(3B) or 40(4A) have been met.
Is a condition under section 40(3A) satisfied? - The condition under section 40(3A)(a) of the FOIA is that disclosure
would contravene any of the data protection principles. The ICO
considers that disclosure would contravene principle (a) under Article
5(1) of the GDPR. - Article 5(1)(a) of the GDPR states that: “Personal data shall be
processed lawfully, fairly and in a transparent manner in relation to the
data subject”. - In the case of a FOIA request, personal data is processed when it is
disclosed in response to the request. This means that the information
can only be disclosed if to do so would be lawful, fair and transparent. - In order to be lawful, one of the lawful bases listed in Article 6(1) of the
GDPR must apply to the processing. It must also be generally lawful. - The lawful basis most applicable is GDPR basis 6(1)(f) which states:
“…processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party except where such
interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data,
in particular where the data subject is a child”. - In considering the application of Article 6(1)(f) in the context of a
request for information under the FOIA it is necessary to consider the
following three-part test:
i) Legitimate interest test: Whether a legitimate interest is being
pursued in the request for information
ii) Necessity test: Whether disclosure of the information is
necessary to meet the legitimate interest in question
iii) Balancing test: Whether the above interests override the
legitimate interest(s) or fundamental rights and freedoms of the
data subject. - The Commissioner considers that the test of ‘necessity’ under stage (ii)
must be met before the balancing test under stage (iii) is applied.
Is a legitimate interest being pursued? - In considering any legitimate interest(s) in disclosing the requested
information under the FOIA, the Commissioner recognises that such
interest(s) can include broad general principles of accountability and
transparency for their own sakes, as well as case-specific interests. - Further, a wide range of interests may be legitimate interests. They can
be the requester’s own interests or the interests of third parties, and
commercial interests as well as wider societal benefits. They may be
compelling or trivial, but trivial interests may be more easily overridden
in the balancing test. - The information in this case has been summarised above. In his request,
the complainant has expressed his interest in the information – and the
ICO’s reliance on section 50(2) of the FOIA in a particular case – as a
genuine interest “… in how the ICO would reach such a decision, given
the extreme implications of it.” As such, although appearing to be a
private interest of the complainant’s, the Commissioner considers the interests is legitimate. Is disclosure necessary to meet the legitimate interests? - ‘Necessary’ means more than desirable but less than indispensable or
absolute necessity. Accordingly, the test is one of reasonable necessity
and involves consideration of alternative measures which may make
disclosure of the requested information unnecessary. Disclosure under
the FOIA must therefore be the least intrusive means of achieving the
legitimate aim in question. - In its submission to the Commissioner, the ICO has confirmed that it
does not consider that disclosure is necessary in this case. It considers
that disclosing the third party’s correspondence with the ICO and the
contents of his section 50 complaints would be overly intrusive and
unnecessary to fulfil the legitimate interest in disclosure. - The ICO has noted that the test is one of ‘reasonable necessity’ which
involves considering alternative measures; disclosure would not be
necessary if the legitimate aim could be achieved by something else.
The ICO notes that in its response to the complainant it provided an
explanation as to the circumstances of the specific case associated with
Mr Dransfield. It considers it is difficult to see why providing this
explanation, along with the more general guidance the ICO publishes in
respect of the FOIA, would be insufficient to meet the legitimate interest
in respect of the requested information. - The ICO considers that disclosing the actual correspondence with Mr
Dransfield would add little of value to the explanation provided and
would be unnecessarily intrusive into the third party’s private life. In
particular, it notes that the information requested relates to
correspondence and complaints raised with the ICO as a private
individual. The ICO considers that the individual in question would have
communicated with the ICO with an expectation of confidence and he
would not expect their correspondence to be disclosed in response to a
request made under the FOIA. - To a large degree the Commissioner considers that the complainant’s
interests have been satisfied through the general information the ICO
provided in response to his request. In correspondence to the
Commissioner, however, the complainant has argued that “The
derogation from open justice always requires very strong justification,
as the authorities make clear.” The ICO has also acknowledged that
there is a wider interest in the circumstances that could lead to
individuals being prevented from accessing the ICO’s services [through
section 50(2)(c)], and in being open and transparent about the reasons as to why this decision was taken. - In its submission the ICO has referred to its general published guidance
but the Commissioner has not been able to find any published guidance
on section 50(1) and 50(2) specifically. Because it is not certain that
the legitimate interests in this case have been fully satisfied by the
information the ICO provided in its response to the complainant, the
Commissioner considers that disclosing the specific information
requested would be necessary to meet the legitimate interests in this
case.
Balance between legitimate interests and the data subject’s interests or
fundamental rights and freedoms - In considering this balancing test, the Commissioner has taken into
account the following factors:
• the potential harm or distress that disclosure may cause
• whether the information is already in the public domain
• whether the information is already known to some individuals
• whether the individual expressed concern to the disclosure; and
• the reasonable expectations of the individual. - In the Commissioner’s view, a key issue is whether the individual
concerned has a reasonable expectation that his information will not be
disclosed. These expectations can be shaped by factors such as an
individual’s general expectation of privacy, whether the information
relates to an employee in their professional role or to them as
individuals, and the purpose for which they provided their personal data. - In its submission to the Commissioner the ICO has said that even if it
was to accept that disclosure is necessary to meet a legitimate interest,
it considers this would be outweighed by the third party’s rights and
freedoms. As it has explained above, it says the information requested is
the personal data of the person who has raised complaints and
corresponded with the office ie Mr Dransfield. It considers the individual
in question would have raised complaints and correspondence with an
expectation of confidence and he would not have a reasonable
expectation that this information would be disclosed in response to a
request made under the FOIA. The ICO confirmed that it considers that
in the circumstances of this request there is no strong legitimate interest
that would override the prejudice to the rights and freedoms of the data
subject, Mr Dransfield. - Finally, with regard to the wording under Article 5(1)(a), the ICO says
that because it does not consider disclosing the information to be lawful,
it has not given particular consideration as to whether disclosure would
be fair or transparent. But the ICO has confirmed that for the reasons it has given and which are discussed above, it considers that disclosure
would be neither fair nor transparent. - In correspondence to the Commissioner, the complainant has drawn her
attention to the fact that “since the request was made”, Mr Dransfield
appears to have published “most of the information” requested in this
case. The Commissioner is aware that Mr Dransfield has his own weblog
on which FOIA matters and the Information Commissioner are written
about extensively. The complainant provided the Commissioner with a
link to the blog, on which the requested information is published. It is
not “most” of the requested information but one of letters that the ICO
sent to Mr Dransfield. It was published on the blog on 9 January 2019. - The complainant considers that Mr Dransfield has a philosophical belief
in the publication of such information to such an extent that it is
inappropriate and in breach of the principles of open justice for the ICO
to rely on section 40 to withhold the information. He also considers it
manifestly apparent that if the ICO had asked Mr Dransfield, he would
have consented to the information being released. - With regard to the matter of consent, in her published guidance on
section 40 the Commissioner notes that for this basis for disclosure to
be satisfied the individual must give their consent freely to the specific
disclosure, with the understanding that their personal data will be
disclosed to the requester under FOIA and therefore potentially to the
world at large. - She goes on to advise that given the practical difficulties of meeting this
condition, it is unlikely to be used in most circumstances and that when
a request is made under FOIA, legitimate interests is likely to be the
most relevant. - The Commissioner has not considered this matter further other than to
note that at the time of the request the ICO did not have Mr Dransfield’s
consent to disclose the requested information. - The Commissioner has considered the situation as it was at the time of
the request on 22 August 2018. At that point the element of the
requested information discussed above had not been published and the
Commissioner has not been made aware of any of the information that
was published at 22 August 2018. Nor has she been presented with any
evidence to suggest that the information was already known to other
individuals (ie other than Mr Dransfield). - The complainant’s arguments as to what Mr Dransfield’s position would
be in this case are conjecture. Taking account of all the circumstances,
and despite Mr Dransfield’s interactions with the ICO and the views and opinions that are published about the ICO on his blog, the Commissioner
is satisfied that he would nonetheless have the reasonable expectation
that his private correspondence with the ICO about complaints he
submitted to it would not be released to the wider world in response to
an FOIA request. As such, she considers that disclosure would be likely
to cause him a degree of distress. - Finally, the wider public interest in the ICO being open and transparent
about its operations has been met, in the Commissioner’s view, through
the ICO’s broad discussion of its application of section 50(2) in its
response to the complainant, which concerned both Mr Dransfield and
more generally. - Based on the above factors, the Commissioner has determined that
there is insufficient legitimate interest to outweigh the data subject’s
fundamental rights and freedoms. The Commissioner therefore
considers that there is no Article 6 basis for processing and so the
disclosure of the information would not be lawful. - Given the above conclusion that disclosure would be unlawful, the
Commissioner considers that she does not need to go on to separately
consider whether disclosure would be fair or transparent. - The Commissioner has therefore decided that the ICO was entitled to
withhold the information under section 40(2) of the FOIA by way of
section 40(3A)(a). This being the case it has not been necessary to
consider the remaining conditions under section 40(3A), 40(3B) or 40 (4a)
Right of appeal - Either party has the right to appeal against this decision notice to the
First-tier Tribunal (Information Rights). Information about the appeals
process may be obtained from:
First-tier Tribunal (Information Rights)
GRC & GRP Tribunals
PO Box 9300
LEICESTER
LE1 8DJ
Tel: 0300 1234504
Fax: 0870 739 5836
Email: grc@justice.gov.uk
Website: http://www.justice.gov.uk/tribunals/general-regulatory-
chamber - If you wish to appeal against a decision notice, you can obtain
information on how to appeal along with the relevant forms from the
Information Tribunal website. - Any Notice of Appeal should be served on the Tribunal within 28
(calendar) days of the date on which this decision notice is sent.
Signed
Pamela Clements
Group Manager
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Wirral In It Together 