Tribunal Upholds Section 40 FOIA Exemptions in Shamir Ahmed Ali v The Information Commissioner Case

Introduction

The case of Shamir Ahmed Ali v The Information Commissioner involves an appeal by Mr. Ali against a decision notice issued by the Information Commissioner, which supported Birmingham City University’s (BCU) refusal to disclose certain information requested under the Freedom of Information Act 2000 (FOIA). The tribunal considered whether the requested information was exempt under sections 40(1) and 40(2) of FOIA and if BCU had any obligation to provide information from before a specified date.

Key Facts

Mr. Ali requested information from BCU regarding the number of staff suspended since 2010 and who subsequently returned, including reasons for their suspensions and the disciplinary processes involved. BCU provided data from 1st January 2019 onward, claiming that information prior to this date was not “readily available in a recorded form” and refused further details citing section 40(2) of FOIA.

Mr. Ali then requested an internal review and later complained to the Information Commissioner, alleging that BCU hadn’t answered his questions and accusing both the university and the Commissioner of bias based on his characteristics. The Information Commissioner supported BCU’s application of the exemptions, resulting in Mr. Ali’s appeal to the tribunal.

Legal Principals

The central legal principles in this case pertain to the application of section 40 FOIA, which deals with personal data, and whether certain information falls outside the Act’s disclosure requirements.

Section 40(2) FOIA

This section exempts personal data from disclosure if it contravenes the data protection principles, particularly principle (a) of the GDPR, which mandates that data should be processed lawfully, fairly, and transparently. The tribunal considered whether the disclosure was necessary and lawful by applying a threefold test: determining if there was a legitimate interest, necessity, and if the interest of disclosing overrode individuals’ rights. Notably, the concept of the “motivated intruder” as established in Magherafelt District Council and Miller cases was considered while assessing identifiability.

Section 40(1) FOIA

This section exempts information if it constitutes the requester’s personal data. The tribunal acknowledged that Mr. Ali’s request about disciplinary action against himself falls under this exemption, and he should use the Data Protection Act 2018 to make a subject access request.

Section 12 FOIA

The Decision Notice did not address the refusal to provide pre-2019 information, potentially implicated by section 12 FOIA, which concerns cost limits on compliance. The tribunal highlighted this failure, suggesting that BCU’s response did not adequately clarify if the exemption was based on unrecorded information or cost limits of compliance.

Outcomes

The tribunal upholds the Information Commissioner’s decision in part, agreeing that exemptions at section 40(1) and 40(2) FOIA were correctly applied for data from 1 January 2019 onwards. Mr. Ali’s appeal was, however, allowed in part regarding information from 2010 to 2018. The tribunal found an error of law in the Decision Notice’s absence of a decision on this matter. BCU is instructed to either issue a new response or apply a refusal notice under s17 FOIA for the earlier period.

Conclusion

In summary, this case reaffirms the legal framework surrounding section 40 FOIA exemptions related to personal data and the obligations of public authorities to disclose information. The tribunal’s analysis elucidated the current legal standards regarding the identification of individuals from released data, the legitimate interest in disclosure versus individual rights under the GDPR, and the proper application of cost limits under FOIA. While the appeal succeeded in part, the tribunal’s findings predominantly supported the exempting of sensitive personal information from FOIA disclosures without undermining the requester’s rights to some extent of information.