First-tier Tribunal

(General Regulatory Chamber)

Information Rights
Appeal Reference: EA/2022/0267
NCN: [2024] UKFTT 001005 (GRC)
Heard by CVP on 20 March 2024

Before

JUDGE ANTHONY SNELSON

TRIBUNAL MEMBER ANNE CHAFER
TRIBUNAL MEMBER PIETER DE WAAL

Between

JANNA LINDE
Appellant
and

THE INFORMATION COMMISSIONER

First Respondent
and

GOVERNING BODY OF THE UNIVERSITY OF EAST LONDON

Second Respondent

DECISION

On hearing the Appellant in person and Ms M Mitchison, General Counsel, on behalf

of the Second Respondent;
And on considering the written representations of the First Respondent and the other
documents tabled by the parties;

The Tribunal unanimously allows the appeal in part and substitutes a Decision Notice
in the following terms:

1
 (1) The Second Respondent was entitled to rely on FOIA, s40(2) (personal information)
in relation to the Appellant’s requests numbered 1 B4 and B7 but not otherwise.
(2) Accordingly, not later than 28 days after the date of promulgation of this Decision
Notice, the Second Respondent shall disclose to the Appellant the information sought
by her requests numbered A5 and B5.

REASONS

Introduction

1. Among many others, the Second Respondent (‘the University’) offers courses in
social work.

2. The Appellant, Ms Janna Linde, who describes herself as being of Eastern

European descent, has experience of working with the University’s social work
students as a ‘Practice Educator’ (‘PE’). First-year and final year students
undertake placements with Placement Providers (‘PPs’) lasting 70 and 100 days
respectively. During their placements they are each allocated to a PE, who may
be ‘on-site’ at the PP or ‘off-site’. PE’s may be assigned more than one student
at a time.

3. Ms Linde approached the University with a view to undertaking PE work in the

academic year beginning in October 2021, but no offer was forthcoming. It
appears that she suspected that discrimination based on her racial or national
origins was in play.

4. On 20 October 2021 Ms Linde sent a request to the University for certain

information pursuant to the Freedom of Information Act 2000 (‘FOIA’). As
already mentioned, the request was broken down into Part A (five elements)
and Part B (seven elements). Part A was concerned with selection of PPs and
Part B with selection of PEs.

5. The University responded on 24 November 2021, providing some of the

information requested but declining the remainder, citing FOIA, s40(2)
(personal information).

6. Following an internal review, the University notified Ms Linde on 30 December

2021 that it maintained its position.

7. On 4 January 2022 Ms Linde complained to the First Respondent (‘the

Commissioner’) about the way in which her request had been dealt with. An
investigation followed.

1The numbering of the original request was confusing. The Appellant began with Part A (which contained five elements) and then
moved on to Part 2 (which contained seven elements). She clearly overlooked her intention to call the second part Part B, which is
what we have done.

2
8. By a Decision Notice dated 14 September 2022 the Commissioner determined
that the University had properly applied FOIA s40(2) to the disputed
information.

9. By her undated Notice of Appeal Ms Linde challenged the Commissioner’s

decision on a number of grounds. Her central contention was that the
information requested did not constitute third party personal data.

10. An inordinate delay followed, apparently resulting from some insurmountable

difficulty in delivering the notice of appeal to the Commissioner.

11. By an exceedingly brief Response dated 8 April 2024 the Commissioner resisted
the appeal on the ground that it brought no new point or issue to the
proceedings.

12. By an Order of Judge Hazel Oliver dated 10 August 2024 the University was
joined as Second Respondent. The University resisted the appeal, although we
do not appear to have been shown a formal response.

13. The appeal came before us in the form of a final hearing, held by CVP. Ms Linde
attended, as did Ms Mitchison, the University’s General Counsel. The
Commissioner did not attend, preferring to rely on his written case.

The applicable law

The freedom of information legislation

14. FOIA, s1 includes:

(1) Any person making a request for information to a public authority is entitled–

(a) to be informed in writing by the public authority whether it holds information

of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.

‘Information’ means information recorded in any form (s84).

15. The general right under s1 is subject to a number of exemptions. By s40 it is

provided, so far as material, as follows:

(1) Any information to which a request for information relates is exempt

information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt
information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.

3
 (3A) The first condition is that the disclosure of the information to a member of
the public otherwise than under this Act—
(a) would contravene any of the data protection principles …

The language and concepts of the data protection legislation are translated into
the section (subsection (7)). The exemptions under s40 are unqualified under
FOIA and the familiar public interest balancing test has no application. Rather,
the reach of the exemptions is, in some circumstances, limited by the data
protection regime.

The data protection legislation

16. The data protection regime under the Data Protection Act 2018 (‘DPA 2018’) and
GDPR applies to this case.

17. DPA 2018, s3 includes:

(2) “Personal data” means any information relating to an identified or identifiable

living individual ...

(3) “Identifiable living individual” means a living individual who can be

identified, directly or indirectly, in particular by reference to —
(a) an identifier such as a name, an identification number, location data or an
online identifier …

(4) “Processing”, in relation to information, means an operation or set of

operations which is performed on information, or on sets of information, such as —
…
(d) disclosure by transmission, dissemination or otherwise making available …

(5) “Data subject” means the identified or identifiable living individual to whom
personal data relates.

18. GDPR, Article 5 sets out the data protection principles. It includes:

Personal data shall be:

1. processed lawfully, fairly and in a transparent manner in relation to the data

subject …

19. Article 6, so far as material, provides:

1. Processing shall be lawful only if and to the extent that at least one of the
following applies:

…
(f) processing is necessary for the purposes of the legitimate interests pursued by
the controller or by a third party, except where such interests are overridden
by the interests or fundamental rights and freedoms of the data subject which
require protection of personal data, in particular where the data subject is a
child.

4
 Point (f) of the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.

The Tribunal’s powers

20. The appeal is brought pursuant to the FOIA, s57. The Tribunal’s powers in
determining the appeal are delineated in s58 as follows:

(1) If on an appeal under section 57 the Tribunal consider –

(a) that the notice against which the appeal is brought is not in accordance with
the law; or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been
served by the Commissioner, and in any other case the tribunal shall dismiss the
appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.

Case-law

21. Unlike the general run of information rights cases, the starting-point for the
purposes of s40 is that, where they intersect, privacy rights hold pride of place
over information rights. In Common Services Agency v Scottish Information
Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation,
including the EU Directive on which the domestic data protection legislation is
founded. At para 7 he commented:

In my opinion there is no presumption in favour of release of personal data under

the general obligation that FOISA 2 lays out. The references which that Act makes to
provisions of [the Data Protection Act] 1998 must be understood in the light of the
legislative purpose of that Act, which was to implement Council Directive 95/46/EC.
The guiding principle is the protection of the fundamental rights and freedoms of
persons, and in particular their right to privacy with respect to the processing of
personal data …

22. It is well-established that case-law under the pre-2018 data protection regime
can safely be treated as a guide to interpreting the new law. Three principles are
noteworthy in the present context. First, ‘necessary’ means reasonably necessary
and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC
55. But in order for something to be ‘necessary’ there must be no other
reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second,
‘necessity’ is part of the proportionality test and requires the minimum
interference with the privacy rights of the data subject that will achieve the
legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office &

2 The proceedings were brought under the Freedom of Information (Scotland) Act 2000, but its material provisions do not differ
from those of FOIA.

5
 another [2012] EWHC 1943 (Admin), para 76. Third, in carrying out the balancing
exercise, it is important to take account of the fact that disclosure under freedom
of information legislation would be to the whole world and so, necessarily, free
of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council
[2015] UKUT 449 (AAC), para 23.

23. It is legitimate to consider at the outset the first part of (what is now) the Article
6 test (lawful processing), before addressing (if need be) the further elements of
the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para
20).

The Commissioner’s Guidance

24. In current Guidance on Requests for Personal Data about Public Authority
Employees3, the Commissioner states (p13):

The data protection exercise of balancing the rights and freedoms of the employees
against the legitimate interest in disclosure is different to the public interest test that
is required for the qualified exemptions listed in section 2(3) of FOIA.

In the FOI public interest test, there is an assumption in favour of disclosure because
you must disclose the information unless the public interest in maintaining the
exemption outweighs the public interest in disclosure.

In the case of section 40(2), the interaction with the DPA means the assumption is
reversed and a justification is needed for disclosure.

Analysis and conclusions

25. When the hearing began, the areas of contention were restricted to Requests A5
and B4, B5 and B7. However, following a useful exchange with the Tribunal, Ms
Mitchison, rightly in our view, withdrew her resistance to the appeal in so far as
it related to Requests A5 and B5. We agree with Ms Linde that there was no basis
for the Commissioner’s finding that disclosure of this information was liable to
result in any individual’s identity (or other personal data) being revealed.
Accordingly, without objection from Ms Mitchison, we allow the appeal in
relation to Requests A5 and B5, holding that the exemption under FOIA, s40(2)
is not engaged.

26. As to Requests B4 and B7, we see the matter quite differently. B4 asks for the
number of off-site PEs offering to take students in the year commencing October
2021 and the ethnicities of the students taken. B7 seeks the number of students
allocated per off-site PE and the ethnicities of the PEs. Ms Linde’s simple
argument that neither request asks for the identities of the individuals
concerned misses the point. It is common ground that the numbers are small. In
our judgment it is very clear that disclosure of this disputed information would

6
 enable the relevant students and PEs to be identified and would thus involve
disclosure of their personal data. Accordingly, s40(2)(a) is satisfied.

27. Turning to s40(2)(b), it was not in question that the applicable data protection
principle was that contained in GDPR, Article 5, para 1, read with Article 6, para
1(f). As we have noted, the duty of ‘lawful’ processing imports the requirement
of ‘necessity’. In our judgment, there is no question of the processing of the
personal data of third parties being ‘necessary’ in relation to the B4 and B7
Requests. We have two main reasons for our view. In the first place, Ms Linde
has (as she told us) already come into possession of all the information which
she has sought, some through material supplied pursuant to her request, some
through disclosure in Employment Tribunal (‘ET’) proceedings brought by her
against the University. In the circumstances, we are satisfied that her legitimate
interest in access to all information sought by her Requests for the purpose of
inquiring into and testing the University’s adherence to sound equality and
diversity practices4 has already been fully met notwithstanding the fact that she
is constrained as to the use which she is free to make of the ET disclosure
documents. The simple point is that the information has all been disclosed to
her, one way or another. Secondly and in any event, we are satisfied that it could
not possibly be said that any residual legitimate interest not yet satisfied could
only be met by processing the personal data of third parties (see the Halpin case
cited above). There is no need (meaning reasonable need) for any request in
pursuit of Ms Linde’s legitimate interest to trespass upon the privacy rights of
third parties. Rightly, she did not so argue.

28. The statutory bias favouring privacy rights over information rights makes this
a very clear case in relation to the B4 and B7 Requests. The processing of
personal data for which the Appellant contends would plainly be unlawful.
Accordingly, these requests are for information which is exempt and the
Commissioner was right to dismiss the complaint in respect of them.

Disposal

29. It follows that the appeal must be allowed to the extent stated, but otherwise
dismissed.

(Signed) Anthony Snelson

Judge of the First-tier Tribunal

Dated: 1 November 2024

Promulgated: 6 November 2024

4 Her interest and its legitimacy were not in doubt.