Andy Kimber v The Information Commissioner & Anor
[2023] UKFTT 675 (GRC)
David Howard obo Lee Howard v The Information Commissioner
9 October 2023
[2023] UKFTT 828 (GRC)
First-tier Tribunal
Someone asked for information from the HCPC, but the HCPC didn't have to say if they had it because it might reveal someone else's personal information. A judge agreed, saying there were other ways to get the information needed.
Key Facts
- •David Howard appealed a Decision Notice by the Information Commissioner (Commissioner), which upheld the Health and Care Professions Council's (HCPC) refusal to confirm or deny holding requested information under the Freedom of Information Act 2000 (FOIA).
- •The request sought information relating to a complaint against an HCPC registrant, potentially including personal data of the registrant and others.
- •HCPC relied on FOIA section 40(5B)(a)(i), which allows non-confirmation/denial if doing so would breach data protection principles.
- •The appeal challenged the late reliance on section 40(5B)(a)(i), the lack of anonymization, the fairness of the investigation, and the disregard of public interest.
Legal Principles
FOIA grants a right of access to information held by public authorities, subject to exemptions and exclusions.
FOIA section 1(1)
Section 40(5B)(a)(i) FOIA allows non-confirmation/denial if confirming would contravene data protection principles.
FOIA section 40(5B)(a)(i)
The Legitimate Interests Test (from South Lanarkshire Council v Scottish Information Commissioner) determines lawful processing under Article 6(1)(f) UK GDPR.
South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55
A public authority can rely on new exemptions/exclusions even on appeal, even if not raised earlier (Birkett v DEFRA).
Birkett v Department for the Environment, Food and Rural Affairs (DEFRA) [2011] EWCA Civ 1606
FOIA disclosure is to the public at large, not just the requester.
Case Law Precedent
Outcomes
Appeal dismissed.
The Tribunal found that section 40(5B)(a)(i) of FOIA was engaged because disclosing whether the information was held could breach the data protection principles by revealing the personal data of a third party. The Legitimate Interests Test showed the request wasn't necessary to meet the appellant's legitimate interests, as other avenues existed. The public interest in protecting privacy outweighed the public interest in disclosure.