The ICO exists to empower you through information.

Learnings from ICO tribunal decisions

Share

The Commissioner’s decision notices can be appealed. Our approach to FOIA and the EIR is informed by case law, which develops through decisions of the courts and tribunals.

You can find decisions of the First-tier Tribunal (General Regulatory Chamber) and Upper Tribunal (Administrative Appeals Chamber) on the Find case law website.

The Upper Tribunal’s decisions become binding case law, even though sometimes a further appeal is allowed to the Court of Appeal. We’ve picked out some recent Tribunal decisions of note.

What can be included when estimating the cost of “extraction”?

Under section 12 of FOIA, a public authority can refuse a request if it would take too long to deal with it. This is known as the cost exceeding the appropriate limit. Only certain costs can be taken into account, including the cost of extracting the information.

But what does “extracting” mean? In appeal ref EA/2020/0008V (2020), the authority said it needed to extract the information from different computer systems, and would need to write a new query (program) to do this. The First-tier Tribunal agreed that extraction would include:

  • Determining and designing the methodology; 
  • Setting up the searches; and 
  • Carrying out checks that the data was being extracted correctly. 

However, they found that extraction would not include the time that the computer took to run the various processes. 

What does this decision mean for public authorities?  

This provides further clarity as to what public authorities can and cannot  include in estimating of the cost of compliance. This case is referred to in our updated guidance on section 12 FOIA. 

What if some personal data is already in the public domain?

In appeal reference GI/3037/201, the Upper Tribunal (“UT”) considered a request for a report about whistleblowing at a council. The council had withheld it under section 40(2) FOIA – personal information. 

The appellant disagreed, because some related information was already in the public domain.  
The UT noted there had been previous local media and social media interest in the matter. The information in the public domain was not the same as that in the report, and, in fact, revealed there was a motivated intruder in this case, who would likely seek to identify individuals. They found that, if the report were disclosed, the information in the public domain would be likely to:

  • lead to identification of the individuals in the report; and 
  • increase the distress caused to the individuals, since there would be renewed interest. 

They concluded that the council had correctly relied on section 40(2) FOIA.

What does this decision mean for public authorities?  

This case shows that related information being in the public domain can, in fact, make it less likely that personal data can be disclosed under FOIA. 

Legally privileged information: how does the in-built public interest in non-disclosure affect the public interest test?

In appeal ref. UKUT 60 (AAC) (2022), the Upper Tribunal reaffirmed the long-standing ruling in DBERR v O’Brien v IC [2009] EWHC 164 QB. In that ruling, the High Court decided that where information is legally privileged, “the in-built public interest in non-disclosure… carries significant weight which will always have to be considered in the balancing exercise”. This decision is referred to in our recently refreshed guidance on section 42 FOIA.

Tribunal Decision:

  • There’s a significant in-built public interest in favour of non-disclosure when information engages section 42 of FOIA (legal professional privilege). 
  • This in-built public interest is always a weighty factor. However, it doesn't mean that there's a presumption of non-disclosure.

What does the decision mean for public authorities?

  • Don’t presume that legally privileged information shouldn’t be disclosed;
  • Do recognise there’s a significant weight in favour of non-disclosure, because of the importance of client confidentiality

Can public authorities rely on the security bodies/ national security exemptions ‘in the alternative’?

In appeal ref. UKUT 248 (AAC) (2021), the Upper Tribunal considered whether the wording of section 17(1) FOIA prevented the FCDO from relying on section 23(1) and section 24(1) ‘in the alternative’. 

Section 23(1) is an absolute exemption, and applies to information supplied by (or relating to) certain specified security bodies. Section 24(1) is a qualified exemption which applies to information not covered by section 23(1), if it’s necessary in order to safeguard national security.

The Upper Tribunal found that the FCDO did not have to specify, to the requester, which of the two exemptions it was relying on. This allowed it to protect the interests of national security by masking whether the requested information related to one of the relevant security bodies.

This supported the approach set out in our guidance on how section 23 and 24 interact.

Tribunal Decision:

  • Section 23(1) and section 24(1) of FOIA can be relied on ‘in the alternative’. That is, an authority can state that it’s relying on one or other of the exemptions, without specifying which one. 
  • This is in spite of the wording of section 17(1), which requires the authority to specify the exemption it’s relying on, in its refusal notice.

What does the decision mean for public authorities?

  • You can refuse a request for information on the basis that you’re relying on one or other of section 23(1) FOIA or section 24(1) FOIA, without specifying which.

What information does the requester have a right of access to?

A public authority refused a request for spreadsheets relating to calculations in a Net Zero report.

Staff at the authority continued to work on the spreadsheets, without making a copy of the versions that existed at the date of the request. The Commissioner found that the authority should not have relied on a particular EIR exception, and ordered a fresh response. 

The authority appealed this decision (EA/2020/0231), meanwhile continuing to work on the spreadsheets. 

The First-tier Tribunal ordered disclosure of the versions of the spreadsheets that existed at the time of the request. The judges acknowledged that it would be difficult to recreate those versions, and to redact certain exempt information, but ordered disclosure nonetheless.

What does this decision mean for public authorities? 

  • The right of access attaches to information as held at the time of the request.
  • This can be challenging when information on a particular draft or working document has been requested. If you need to consider a ‘live’ document, it’s strongly recommended to make a copy as at the date of the request.
  • This will help you to handle the request and decide what information is in scope. It will also help if the Commissioner or Tribunal become involved later on.
  • Even when you don’t need to consider a ‘live’ document, keeping a note of what information is held at the point of the request will help you with your compliance.

Should you provide advice and assistance when relying on section 14(1) FOIA on grounds of oppressive burden?

Section 14(1) FOIA (vexatious requests) can be used to refuse a single burdensome request if the amount of time it would take you to collate and prepare material for disclosure would be grossly oppressive, although you should always consider section 12 first. 

But do you need to offer advice and assistance? The First-tier Tribunal in appeal reference EA/2022/0260 supported the approach in our guidance, noting that you should offer advice and assistance to the requester if you’re applying section 14(1) on grounds of oppressive burden.

What does this decision mean for public authorities? 

  • When you decide that a request should be refused because it would place a grossly oppressive burden on your resources, you should offer advice and assistance to the requester.
  • This applies where the burden is the sole ground for refusal. You should normally include advice on narrowing the scope of the request.

When should you assess the public interests in disclosing information?

In appeal reference [2022] UKUT 104 (AAC), known as Montague, the Upper Tribunal ruled that “the competing public interests have to be judged at the date of the public authority’s decision on the request… and prior to any internal review of that initial decision” (para 63).

What does the decision mean for public authorities?

  • If you’re relying on a qualified exemption, you must carry out the public interest test on matters as they stand at the date of your initial response, and not at the date of the internal review.
  • So if you’re reconsidering the request at internal review, any disclosures you’ve made since the initial response don’t affect the balance of the public interests in the disclosure of the remaining disputed information.
  • This is a binding Upper Tribunal decision.
  • Since this decision, First-tier Tribunals have also applied this rule to the timing for considering the prejudice test, as covered in our recently-updated guidance.
  • A second aspect of Montague, concerning aggregation of public interests, is currently under appeal to the Supreme Court. This doesn’t affect the binding decision on when to consider the balance of the public interests.

Is information held ‘with a view to its publication’ (section 22 FOIA)?

The public authority in appeal reference [2023] UKFTT 00822 (GRC) relied on section 22 FOIA because it had a publication scheme covering the type of information that had been requested. However, the First-tier Tribunal noted the authority had not decided, at the date of the request, whether to publish the requested information itself. Nor had the authority yet decided whether other exemptions might apply to the information.

What does the decision mean for public authorities?

  • To rely on section 22 FOIA, you must, at the date of the request, hold the requested information with the intention of publishing it.
  • Even though you don’t need to have a settled date in mind for publication, you must have a settled intention to publish. It’s not enough to be intending, at a future date, to consider whether to publish.

What do public authorities need to show when engaging regulation 12(5)(d) EIR (confidentiality of proceedings)?

In appeal reference [2024] UKFTT 00294 (GRC), the First-tier Tribunal considered whether regulation 12(5)(d) was engaged in respect of some information held by HMRC. It agreed the first two requirements of the exception were met. First, the requested information related to “proceedings”. Second, the proceedings were subject to a “confidentiality provided by law” – in this case, the Commissioners for Revenue and Customs Act 2005, which protects HMRC from having to disclose information held in connection with its functions.

As there’s no equivalent to section 44 FOIA in the EIR, when the information is environmental you can’t rely solely on a statutory bar to disclosure. To engage regulation 12(5)(d) you also need to show the extent to which disclosure “would adversely affect” the confidentiality of the relevant proceedings.

In this case, the Tribunal explained that “general assertions as to unintended consequences of disclosing information that would weaken trust, public confidence or risk” were not sufficient to engage the exception (para 105).

This decision provides a useful indication of what authorities should be able to demonstrate.

  • It’s not enough to say there would be an adverse effect on the conduct of business. The Tribunal emphasised the exception contains “a clear limitation… allowing information to be withheld only to the extent that its disclosure would adversely affect the confidentiality of proceedings”. HMRC was incorrect to apply the exception in a “blanket” fashion to all of the withheld information, in this case (para 100).
  • If the exception is engaged, remember it’s also necessary to carry out a public interest test.

See our detailed guidance on regulation 12(5)(d) here and our guidance on adverse effect here.

Can the representatives of persons who are deceased bring an action for breach of confidence?

In appeal reference [2024] UKFTT 17 (GRC), the First-tier Tribunal considered a request for the driving licence application of a person who was deceased. The DVLA had withheld it under section 41(1) FOIA (information provided in confidence).

The Tribunal agreed the exemption was engaged, because personal representatives would be able to take legal action for breaching the duty of confidence owed to the licence applicant, who had originally provided the information.

What does the decision mean for public authorities?

  • This affirms our existing position that the personal representatives or executors of deceased persons can potentially bring an action for breach of confidence.
  • Even if you’re not sure whether personal representatives or executors exist, you can consider section 41 because they would potentially be able to bring an action (para 15).