Stephen John Gullick v The Information Commissioner
[2023] UKFTT 985 (GRC)
James Mooney v The Information Commissioner
18 June 2024
[2024] UKFTT 508 (GRC)
First-tier Tribunal
Someone requested information about a council investigation. The council and the Information Commissioner said some information couldn't be released because it was private information about other people. A court agreed, saying the information already released was enough and releasing the rest would break privacy laws.
Key Facts
- •James Mooney appealed a Decision Notice (DN) from the Information Commissioner upholding South Kesteven District Council's refusal of his FOIA request.
- •The request sought information relating to a Code of Conduct review panel hearing.
- •The Council withheld information under section 40(2) of FOIA (personal data of third parties).
- •The Commissioner found the Council correctly applied section 40(2) but breached sections 1 & 10 (timeliness).
- •Mooney argued a 'hierarchy of legal obligations' should override FOIA exemptions in favor of health and safety concerns.
Legal Principles
Section 40(2) of the Freedom of Information Act 2000 (FOIA): Information is exempt if it's personal data of someone other than the requester and a condition under section 40(3A) is satisfied.
FOIA
Article 5(1)(a) of the UK GDPR: Personal data shall be processed lawfully, fairly and in a transparent manner.
UK GDPR
Article 6(1)(f) of the UK GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless overridden by the data subject's interests or rights.
UK GDPR
Three-part test for Article 6(1)(f): Legitimate interest, necessity, and balancing test.
Commissioner's analysis
Sections 1 & 10 of FOIA: General right of access and time for compliance.
FOIA
Outcomes
The appeal was dismissed.
The Tribunal found the Commissioner's decision was correct in law. The appellant's argument for a hierarchy of legal obligations overriding FOIA was outside the Tribunal's jurisdiction. The withheld information was personal data of third parties, and disclosure was not necessary to meet the identified legitimate interests. The balancing test favored protecting the data subjects' rights.
Section 40(2) of FOIA applied.
The withheld information clearly contained personal data of identifiable individuals.
Disclosure was not necessary.
Sufficient information about the investigation and outcome was already in the public domain. The appellant's claimed legitimate interest did not relate to the withheld information.
The Council breached sections 1 & 10 of FOIA.
The Council exceeded the 20-working-day time limit for responding to the request.