Category Archives: Information Commissioner

Is information held by external solicitors “held” for the purposes of FOIA?

[reposted from my LinkedIn account]

Where an external solicitor’s firm holds information in relation to advice given by the solicitor on instructions by a public authority client, is the information held by the solicitor “on behalf of” the public authority, for the purposes of section 3(2)(b) of the Freedom of Information Act 2000?

While the matter is live, the answer is probably “yes”, but what if the public authority client has long since destroyed its own records, but the solicitor’s firm has retained its records for its own regulatory or risk purposes? Here, the answer is probably “no”.

And that is the situation which came before the Information Tribunal recently. The requester was seeking information from Sheffield City Council about a development scheme from 2007/2008. The Council had said that it would have destroyed its own records, and said that to determine whether the information was held would necessitate the inspection of 28 box files held by law firm Herbert Smith Freehills, who had been instructed by the Council at the relevant time. To even determine whether the information was held or not would exceed the costs limits in section 12 of FOIA. The ICO, in the decision notice being appealed, had agreed.

As I was reading the first few paragraphs of the Tribunal judgment, I said to myself “hang on – is this info being held by HSF on behalf of the Council, or is it being held for HSF’s purposes?” I was limbering up my fingers to write a post criticising everyone for not spotting this, so I was then pleased to see that the Tribunal, of its own volition, identified it as an issue and sought submissions from the ICO and the Council on it.

After some back and fro (it is not entirely clear from the judgment who said what in their submissions, and there was a side issue as to whether in fact the Environmental Information Regulations applied) the evidence was pretty clear that the Council had had no intention to retain the information, nor to entrust it to HSF. Accordingly, the information was not “held” for the purposes of FOIA.

I’m not sure I understand why the Tribunal did not substitute a different decision notice to reflect this (it simply dismissed the requester’s appeal), but ultimately nothing really turns on that.

What one can take from this is that solicitors and their clients (especially public authority clients) should, jointly and separately, make clear in agreements and policies what the status is of information retained by solicitors after an instruction has ceased, and how requests for such information should be dealt with.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under access to information, Environmental Information Regulations, Freedom of Information, Information Commissioner, Information Tribunal, judgments

Exceptionally unlikely: ICO and judicial review

[reposted from my LinkedIn account]

Where Parliament has entrusted a specialist body with bringing prosecutions, such as the Serious Fraud Office, or the Information Commissioner’s Office (ICO), it is “only in highly exceptional circumstances” that a court will disturb a decision made by that body (see Lord Bingham in R(Corner House and others) v Director of the Serious Fraud Office [2008] UKHL 60)).

Such was the situation faced by the claimant in an unsuccessful recent application for judicial review of two decisions of the ICO.

The claimant, at the time of the events in question, was a member of the Labour Party and of the Party’s “LGBT+Labour” group, She had been concerned about an apparent disclosure of the identity and trans status of 120 members of a “Trans Forum” of the group, of which she was also a member, and of what she felt was a failure by the LGBT+Labour group to inform members of the Forum of what had happened.

She reported this to the ICO as potential offences under sections 170 and 173 of the Data Protection Act 2018 (it’s not entirely clear what specific offences would have been committed), and she asked whether she was “able to discuss matters relating to potential data breaches with the individuals involved”. The ICO ultimately declined to prosecute, and also informed her that disclosing information to the individuals could in itself “potentially be a section 170 offence”.

The application for judicial review was i) in respect of the “warning” about a potential prosecution in the event she disclosed information to those data subjects, and her subsequent rejected request for a commitment that she would not be prosecuted, and ii) in respect of the decision not to prosecute LGBT+Labour.

Neither application for permission succeeded. In the first case, there was no decision capable of being challenged: it was an uncontroversial statement by the ICO about a hypothetical and fact-sensitive future situation, and in any event she was out of time in bringing the application. In the second case, there were no “highly exceptional circumstances” that would enable the court “to consider there was a realistic prospect of showing that the ICO had acted outside the wide range of its discretion when deciding not to prosecute”.

One often sees suggestions that the ICO should be JRd over its failure to take action (often in a civil context). This case illustrates the deference that the courts will give to its status and expertise both as regulator and prosecutor. Outside the most exceptional of cases, such challenges are highly unlikely to succeed.

Peto v Information Commissioner [2025] EWHC 146 (Admin)

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under crime, Data Protection, Data Protection Act 2018, Information Commissioner, judgments, judicial review

FOIA costs decision against applicant for failing to withdraw contempt application

A freedom of information requester is facing costs in what seems to have been a bit of a shambles before the First Tier Tribunal (FTT). I think this is rather concerning, albeit slightly convoluted, and, frankly, the whole thing is not assisted by a judgment that is strewn with errors and lacks coherence. In what follows I’ve had to piece together some of the information missing, or unclear, from the judgment.

It appears that the requester (AHB) had made a Freedom of Information Act 2000 (FOIA) request to the Royal Mint on 19 June (not July, as the FTT judgment says) 2021 for information about its “Garbled Coin Policy” in relation to repatriated UK currency. On 16 July 2021 The Royal Mint replied with what appears to have been a short narrative response. AHB complained to the Information Commissioner (ICO) on 28 September 2021, and ten months later the ICO held (very peremptorily, and rather oddly, I would say) that the Royal Mint held no information in relation to the original request.

AHB then appealed to the FTT and in a judgment of 3 October 2023 (the “2023 judgment”) the FTT held that the ICO had either or both erred in law, or in the exercise of his discretion, because the Royal Mint held further information in relation to the request. It issued a judgment constituting a substitute decision notice (SDN), under which the Royal Mint was ordered to issue a fresh decision within 35 days of the date on which the SDN was promulgated. The judgment specifically says “Failure to comply with this decision may result in the Tribunal making written certification of this fact pursuant to section 61 of the Freedom of Information Act 2000 and may be dealt with as a contempt of court”. The Royal Mint had chosen not to join itself to those proceedings and neither AHB nor the ICO had applied for it to be joined.

It is not at all clear, from the judgment, what happened next, but it appears that the SDN, with its Order that the Royal Mint issue a fresh response, was not served on the Royal Mint itself (presumably this error arose from its not having been a party, although it was aware of the proceedings). Then, on 9 December 2023, having received no fresh response, and no doubt taking his cue from the SDN, AHB made an application to the FTT under section 61(4) of FOIA for the Royal Mint to be certified to the Upper Tribunal for contempt of court.

It appears that the FTT finally served the SDN on the Royal Mint on 22 December 2023 (the judgment at several points has this as the obviously impossible “22 December 2024”).

One assumes, at this point, that, although the SDN was not served on the Royal Mint until the time of 35 days from 3 October 2023 had already passed, the Order in the SDN still had effect. That being the case, it appears to have been incumbent on the Royal Mint’s lawyers to make an urgent application, for instance for compliance with the Order to be waived, for relief from sanctions and for a new date for compliance to be set. Instead, they did not take action until 3 January 2024, when they wrote to the FTT suggesting that a response would be provided within a further 35 days. However, this was just correspondence – no actual application was made.

Eventually, a response was issued by the Royal Mint in relation to the SDN, on 5 February 2024, more than two-and-a-half years after AHB made his request.

AHB’s application for a contempt certification was still live though, and here I pause to observe that, on the information available, I am not surprised he took no action to withdraw it. He had been vindicated by the FTT’s SDN of 3 October 2023, and he was unaware that the SDN had erroneously not been served on the Royal Mint (in fact, it is not at all clear at what point he did become aware of this). In any case, as no application was made by the Royal Mint for further time, the Order in the SDN must still have been in effect. In fact the judgment alludes to this when it notes that AHB was “indicating” in his contempt application that the final Royal Mint response “was provided 125 days after the Substituted Decision Notice was issued and 90 days later than directed”.

In any event, the FTT declined to certify the failure to comply on time as contempt, because

whilst the Tribunal does consider that the Respondent could have acted more diligently on becoming aware of the Substituted Decision Notice, by applying for an extension of time and requesting permission to extend the time set out in the SDN, the Tribunal does not consider that [the Royal Mint’s lawyer] wilfully avoided complying with the order. The Tribunal accepts that he was simply not aware of the appropriate course of action to take in circumstances where a Court or Tribunal imposed a deadline that had already been missed. In any event, the approach taken is not sufficiently serious to warrant certification to the Upper Tribunal for contempt and the application is refused. [emphasis added]

I will pause here to say that it’s unusual, to say the least, for a court to accept a submission that a solicitor was not aware of what to do when in receipt of an order of a court. Most judges would be quite intolerant of such an argument.

But the story does not end there. In submissions dated 17 July 2024 the Royal Mint then “indicated an intention to pursue an application for the costs ‘of and associated with’ the [contempt] application”. Under rule 10 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 the FTT may make an order in respect of costs but only if it considers that a party has acted unreasonably in bringing, defending or conducting the proceedings.

And, remarkably, the FTT acceded to the costs application, on the grounds that AHB did not withdraw his application for the FTT to certify the Royal Mint’s (undoubted) failure to comply with the 3 October 2023 Order, after he had finally received the fresh response of 5 February 2024. The FTT also took into account AHB’s reference to pursuing a “campaign” to encourage greater transparency.

But does this mean AHB has “acted unreasonably in…conducting the proceedings”? I’m far from convinced (in fact, I’m not convinced). The FTT says

The Tribunal does not consider that it is reasonable (or that any other reasonable person would consider it reasonable) for an application for a party to be certified to the Upper Tribunal for contempt of court to be used as part of a campaign to encourage greater transparency…The Tribunal considers that the obligation to deal with cases fairly, justly, and proportionately in circumstances where the Applicant accepts that he was in appropriately [sic] pursuing a “campaign” for other purposes and where the chances of success in relation to the Tribunal actually certifying the contempt may be limited may justify the making of a costs order against the Applicant.

Well, if I’m to be considered a reasonable person, then I do not think it unreasonable for a person to decide not to withdraw such an application where they have waited more than two-and-half years for an answer from a public authority to a simple FOIA request, and where the public authority has failed to comply with an Order, because its lawyer chose not to acquaint himself with procedural rules. Unreasonableness imposes a very high threshold, and this is shown by the fact that costs awards are extraordinarily rare in FOIA cases in the FTT (from my research I have only found two, in the twenty-odd years FOIA has been in effect, and one of those was overturned on appeal). AHB may have been tenacious, perhaps overly so, and he may have ancillary reasons for (some of) his conduct, but – again – that does not connote unreasonableness.

Costs have not yet been awarded, as the FTT has adjourned for submissions on AHB’s means, and a breakdown of the Royal Mint’s costs.

I should end by saying there may be other material not in the public domain which provides a gloss on AHB’s conduct of the proceedings, but one can (and must) only go on what is in the public domain.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under access to information, contempt, costs, FOIA, Freedom of Information, Information Commissioner, Information Tribunal, judgments

I don’t think that word means what you think it means

[reposted from LinkedIn]

I think there’s a plain error of law in this Information Tribunal judgment (O’Hanlon & Anor v Information Commissioner & Anor [2024] UKFTT 1061 (GRC)).

Section 36(2)(b) of the Freedom of Information Act 2000 (FOIA) says that information is exempt if, in the reasonable opinion of a qualified person, disclosure would, or would be likely to, inhibit the free and frank provision of advice, or the free and frank exchange of views for the purposes of deliberation, or would otherwise prejudice (or would be likely to do so) the effective conduct of public affairs.

I’ve written elsewhere about the flawed concept of who a “qualified person” is, but, at least in relation to govt departments, it’s straightforward: it’s a minister (s36(5)(a)).

In June 2022, Lord True, Minister of State in the Cabinet Office, in the context of a then-live FOIA request, gave a s36 “reasonable opinion”, as a qualified person, that internal department email addresses were exempt, and – crucially – that his opinion was to apply “going forward” in relation to any similar requests. Subsequently, the Cabinet Office applied his opinion to a new request which was received after he had given it.

The ICO said this was not permitted: “the provisions of s36 only become relevant once a request for information has been made…a Qualified Person’s opinion must therefore necessarily post-date the request for the information, and must be an opinion relating to the specific request”.

Not so, said the Tribunal: s36(6)(b) allows an “authorisation” to be “general”, and, therefore “a general authorisation must include be [sic] forward looking to other requests”.

But that is not what “authorisation” means in s36: the word only occurs, prior to s36(6)(b), in s36(5), and it refers to the authorisation of persons as qualified persons to give a reasonable opinion. In other words, the qualified person gives an opinion – not an “authorisation”. The reference in s36(6)(b) to an authorisation being permitted to be “general” is followed by “or limited to specific classes of case” – i.e. a person may be authorised in general to give a reasonable opinion, or authorised (perhaps they have a specialism) only in certain cases).

It does not mean that they are “authorised” to give a prospective qualified opinion that classes of information will always be exempt (subject to a public interest test).

The Tribunal’s reading of s36(6)(b) heavily informed its judgment, and it’s certainly questionable whether, but for this error, it would have decided in favour of giving this “prospective effect” to some s36 qualified opinions.

One hopes the ICO will appeal – because there will otherwise be a risk that public authorities will start classifying, of their own accord, certain classes of information as “always exempt”.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under access to information, FOIA, Freedom of Information, Information Commissioner, Information Tribunal, judgments

ICO Annual Reports 1985 to date

I’ve had to retrieve a lot of these from the National Archives Web Archive.

The sixteenth report looks like it was co-published with the Australian Commissioner.

All reports are published under the Open Government Licence by which the licensor grants a worldwide, royalty-free, perpetual, non-exclusive licence to use the information, subject to conditions.

1 Comment

Filed under Data Protection, Freedom of Information, Information Commissioner

Late (very late) reliance on exemptions, redux

[reposted from LinkedIn]

A Freedom of Information exemption may be relied upon “late” by a public authority (e.g. it can be claimed, after an initial refusal on other grounds, during an investigation by the Information Commissioner, or in the course of proceedings before the First-tier Tribunal). The jurisprudence on this is clear (Birkett v The Department for the Environment, Food and Rural Affairs [2011] EWCA Civ 1606, All Party Parliamentary Group on Extraordinary Rendition v Information Commissioner & Ministry of Defence [2011] UKUT 153 (AAC), Information Commissioner v Malnick and the Advisory Committee on Business
Appointments [2018] UKUT 72 (AAC)
, McInerney v Information Commissioner and the Department for Education [2015] UKUT 0047 (AAC)).

But can a public authority, having received a preliminary decision from the FTT that an exemption is not engaged, and after the FTT has invited further submissions on the other exemptions said to be engaged, adduce new grounds for the rejection of the first exemption? Perhaps surprisingly, the FTT has answered “yes”.

In Finch v IC & HMT EA/2023/0303, the FTT had rejected HMT’s reliance on the section 12 costs exemption, in a preliminary decision of 12 January. HMT had argued that its IT supplier would charge more than £600 to retrieve the requested information from storage, and so the s12 exemption was engaged. However, the FTT held that no evidence was provided as to this, and so rejected the argument. As the ICO’s decision under appeal had only considered the s12 issue, the other exemptions said by HMT to be engaged (s40(2), s41, s43(2)) required further submissions from the parties, and so the FTT directed that these be provided and heard at a subsequent hearing.

HMT then submitted that it wished to rely on s12 on different grounds because a “new factual matrix” needed to be considered – in fact it did have access to repository of information, but the searches would take c.46.5 hours (and so exceed the s12 costs limits).

The FTT determined (Birkett, Malnick and – oddly – Browning v Information Commissioner [2013] UKUT 236 considered) that the broad case management powers under rule 5 of the Tribunal Rules allowed it to set its own procedure and that, accordingly, it would permit this “pivoted” reliance on new s12 grounds.

Those new grounds then prevailed, the s12 exemption applied (as would have, if necessary, the s40, 41, and 43 grounds) and the appeal failed.

Even though the ICO did not appear at the hearing, they did make submissions suggesting they opposed the late reliance. It will be interesting to see if they seek to appeal, as the idea that public authorities can as a general rule shift their grounds for relying on an exemption after it has been – in a preliminary decision – rejected, is not a particularly attractive one.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under access to information, Environmental Information Regulations, FOIA, Freedom of Information, Information Commissioner, Information Tribunal, judgments

Yes, Ok, I can be vexatious

[reposted from LinkedIn]

Until a few days ago, I had never, in almost twenty years of making FOI requests, had one refused on the section 14(1) grounds that it was vexatious. But this one broke that streak.

A request can be vexatious for a number of reasons, most of which go to the motives or behaviour of the requester (see the leading case of IC v Dransfield [2012] UKUT 440 (AAC)), but the law has also developed to encompass requests which, by nature of the work which would be required to assess and redact exempt information, are simply too onerous to respond to (see Cabinet Office v Information Commissioner and Ashton [2018] UKUT 208 (AAC)).

As I try to have, and show, no bad motive or behaviour, and as I try very hard not to make requests that are too broad, I’d managed to avoid such a refusal until now.

I asked for the full dataset of Tribunal cases which the Information Commissioner has been involved in. In a previous disclosure an extract from this dataset had been provided to someone. I didn’t know that that full dataset had potentially exempt fields in it. Having had this explained to me I don’t doubt that these fields would be exempt, and I don’t doubt the onerousness of the work which would be required to redact it all. So on the face of it, the refusal is fine, and I’ve submitted a follow up request for narrowed-down information.

But I think this was a good example of how the public authority could have dealt with this differently. They knew that I’d seen the previous extract, and should reasonably have surmised from that that I only wanted those fields, but across the whole dataset. An email or phone call to clarify this would have resolved the issue straight away (and I wouldn’t be writing this now). The case officer does acknowledge this (“we apologise that we did not contact you sooner to advise that we would be unable to respond to this request and advise on how it could be revised”), and I’m not going to whinge (unless this is a whinge (it probably is, isn’t it?)) – everyone is busy, and I’ve certainly handled requests as a practitioner where I’ve realised I could done things differently and better earlier in the process.

But it’s a good example of how a small gap in understanding between requester and public authority can lead to more (and unnecessary) work for both.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

1 Comment

Filed under access to information, Freedom of Information, Information Commissioner, vexatiousness

Dismissed FE teacher’s data protection, MOPI, HRA claims fail

[reposted from LinkedIn]

Claims in misuse of private information, data protection and for breach of the Human Rights Act, by a dismissed further education teacher against Tameside College and three employees are struck out/subject to summary judgment for the defendant.

The claimant was initially suspended after evidence came to light that he had been dismissed from previous roles. The College’s investigation involved the sending of reference requests to two previous employers, and was also informed by disclosures of Facebook and WhatsApp messages which revealed the teacher had, contrary to instruction, communicated with students on social media whilst suspended, and “sent a threatening message to a WhatsApp Group chat comprising members of staff”.

The deputy master found that in relation to the misuse of private information claims, although the claimant had a reasonable expectation of privacy in the social media messages, “those expectations were greatly outweighed by the need to investigate those messages for the purposes of the disciplinary process”. These were subject to summary judgment for the defendant.

The data protection and human rights claims against individual employees were bound to fail, as they were neither data controllers nor public authorities.

As to the data protection claim against the college, a previous determination by the ICO that the sending of the reference requests was not fair and transparent, because it was contrary to the claimant’s expectations, was wrong: it was “plain that it ought to have been well within the Claimant’s reasonable expectation that, in order to investigate whether he had failed to disclose the fact of his dismissal from those two institutions, each would be contacted and asked about it.”

The college’s processing was lawful under Article 6(1)(b) and (c) of the UK GDPR: “The processing was necessary for the purposes of the contract of employment between the [college] and the Claimant and for the performance of the [college’s] obligations to its other staff, and to safeguard and promote the welfare of its students.” The various safeguarding legal duties and obligations on the college established a clear legal basis for the processing.

Similarly, the human rights claims against the college, which included complaints of unlawful monitoring and surveillance, were bound to fail: “There is no real prospect of establishing a breach of Article 8 for the same reasons that there is no real prospect of establishing misuse of private information. The alleged breaches of Articles 10 and 11 appear to relate to the College’s instructions to the Claimant not to communicate with other staff except with permission. The instruction was plainly a reasonable one made for a legitimate purpose.”

Accordingly, the data protection and Human Rights Act claims were struck out.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under Data Protection, employment, Further education, human rights, Information Commissioner, judgments, LinkedIn Post, misuse of private information

ICO and functus officio

[reposted from LinkedIn]

Can the Information Commissioner’s Office (ICO) withdraw or amend a decision notice it has issued under section 50 of the Freedom of Information Act 2000? And, if not, why not?

This FOI disclosure by the ICO states the orthodox (and surely correct) position that, once a section 50 decision has been made, “the Commissioner has discharged his duties under section 50…We can only act in accordance with our powers under the legislation. There is no provision in the FOIA that allows the Commissioner to amend or cancel a DN once it has been issued.”

But the letter goes on to say “…it [is not] accurate to say there is a law that prohibits us from amending a DN”. This is, to the contrary, surely incorrect: there may be no express statutory provision, but common law doctrine of “functus officio” applies.

Functus officio applies where “a judicial, ministerial or administrative actor has performed a function in circumstances where there is no power to revoke or modify it” (R (Commissioner of Police of the Metropolis) v Independent Police Complaints Commission [2015] EWCA Civ 1248, [2016] PTSR 891).

Although there may be exceptions where the decision has been obtained by fraud or it is based on a fundamental mistake of fact (R (Sambotin) v Brent London Borough Council [2018] EWCA Civ 1826, [2019] PTSR 371), the doctrine is most certainly “a law that prohibits” the ICO from amending a decision notice.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

Leave a comment

Filed under common law, Freedom of Information, Information Commissioner, Uncategorized

ICO, Clearview AI and Tribunal delays

[reposted from LinkedIn]

On 28 October the Information Commissioner’s Office (ICO) made the following statement in respect of the November 2023 judgment of the First Tier Tribunal upholding Clearview AI’s successful appeal of the ICO’s £7.5m fine, and posted it in an update to its original announcement about appealing:

The Commissioner has renewed his application for permission to appeal the First-tier Tribunal’s judgment to the Upper Tribunal, having now received notification that the FTT refused permission of the application filed in November 2023.

It is extraordinary that it has taken 11 months to get to this point.

So what does this mean?

If a party (here, the ICO) wishes to appeal a judgment by the First Tier Tribunal (FTT) to the next level Upper Tribunal (UT), they must first make an application to the FTT itself, which must decide “as soon as practicable” whether to grant permission to appeal its own judgment (rules 42 and 43 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009).

If the FTT refuses permission to appeal (as has happened here), the application may be “renewed” (i.e. made again) directly to the UT itself (rule 21(2) of the Tribunal Procedure (Upper Tribunal) Rules 2008).

So, here, after 11 months (“as soon as reasonably practicable”?) the ICO has just had its initial application refused, and is now going to make an applicant under rule 21(2) of the UT Rules.

The ICO’s wording in its statement is slightly odd though: it talks of “having now received notification” that the FTT “refused” (not, say, “has now refused”) the November 2023 application. The tense used half implies that the refusal happened at the time and they’ve only just been told. If so, something must have gone badly wrong at the Tribunal.

The views in this post (and indeed most posts on this blog) are my personal ones, and do not represent the views of any organisation I am involved with.

2 Comments

Filed under Data Protection, GDPR, Information Commissioner, Information Tribunal, judgments, Upper Tribunal