Tribunal Upholds Decision to Withhold Information in Appeal Against Information Commissioner, Highlighting FOIA and DPA Exemptions Balancing Privacy and Public Interest

Citation: [2024] UKFTT 76 (GRC)
Judgment on

Introduction

In the matter of UA v The Information Commissioner, the First-tier Tribunal (General Regulatory Chamber) heard an appeal against the Decision Notice issued by the Information Commissioner. The central question of the appeal revolved around the rightful application of exemptions under the Freedom of Information Act 2000 (FOIA) and the Data Protection Act 2018 (DPA) pertaining to a request made to the Chief Constable of Durham Constabulary (the Authority). The case emphasizes the interplay between rights to information, individual privacy, and the public interest in the context of information requests.

Key Facts

The appellant, UA, requested information about an individual who made a supposedly malicious call to the Constabulary, seeking confirmation that the caller was not a family member. The Authority’s refusal to disclose this information resulted in an appeal to challenge the Decision Notice that upheld the Authority’s right to withhold the requested information based on Section 40(2) of FOIA (personal data exemption) for the first part of the request, and Section 31(3) of FOIA (law enforcement exemption) for the second part of the request.

Several legal principles framed the Tribunal’s analysis in this case:

  1. Personal Data and Legitimate Interests Test: The Tribunal applied concepts from the DPA and the General Data Protection Regulation (EU) 2016/679 (UK GDPR), ultimately utilizing the Legitimate Interests Test to ascertain if the appellant’s interests justified the processing of the personal data involved in the First Part of the Request.

  2. Section 40(2) FOIA (Personal Data): The Tribunal affirmed that the information requested amounted to personal data to be protected under FOIA and evaluated whether its disclosure was necessary, lawful, and balanced against the data subject’s rights.

  3. Section 31(3) FOIA (Law Enforcement): The Tribunal examined whether confirming or denying the information requested would likely prejudice the Constabulary’s law enforcement capabilities.

  4. Public Interest Test: The Tribunal applied the public interest test regarding both exemptions to ascertain whether the public interest in withholding information outweighed the interest in disclosing it.

  5. Necessity Principle: Within the analysis, the Tribunal assessed whether the Authority’s refusal was the least restrictive means of achieving the legitimate aim, reflecting the concept of proportionality.

  6. Necktie Test Procedure: The Tribunal considered the theoretical implications of a response, contemplating whether it would reveal information that could lead to the identification of an individual.

Outcomes

The Tribunal dismissed the appeal, concurring with the Information Commissioner’s Decision Notice on several grounds:

  • First Part of the Request: The Tribunal held that revealing the caller’s identity would contravene data protection principles considering the individual’s legitimate expectation of privacy and that alternative, less intrusive, means were available to the appellant.

  • Second Part of the Request: It was decided that confirming or denying whether the caller was a family member could prejudice the Constabulary’s law enforcement function, as it might deter individuals from reporting incidents.

Furthermore, the Tribunal noted that the Authority’s initial refusal notice failed to meet the requirements of section 17(1) of FOIA, as it did not specify the exemptions being relied upon at the time of the refusal.

Conclusion

The case illustrates the nuanced balance between transparency, the right to privacy, and public interest within the framework of FOIA and the DPA. The Tribunal’s systematic application of exemption criteria and consideration of the necessity and proportionality of withholding information serve as a guiding judgment on the interrelation of these factors. This case demonstrates the complexities public authorities face when processing FOIA requests that involve personal data and law enforcement considerations, providing valuable precedents for future cases with similar issues.