The Constitution, Democracy and Rights Commission: what’s to come?
Nick De Mulder
The applicant in Greenwood is a data journalist. He requested information from the Department for Exiting the European Union:
The Department provided the first category of information but withheld the second category of information. The applicant complained to the Information Commissioner, which led to the Department providing a redacted spreadsheet of the second category of information. The Department stated it did not need to provide an unredacted version – this would have shown the names, employee numbers and contact details of the advisers and their supervisors, amongst other information. The information that was disclosed showed nine expenses claims, mostly for taxi fares, all under £40.
The Information Commissioner gave a Decision Notice finding that the Department was entitled to withhold the relevant information under s.40(2)(3A) FOIA. This provision says that public authorities can withhold the personal data of people (other than the requestor) where disclosing the information would breach the data protection principles under the GDPR. The applicant appealed the Decision Notice.
The Information Tribunal’s starting point was to consider whether disclosing the disputed information would breach the principle that personal data should be processed lawfully, fairly and transparently in relation to the data subject (Article 5(1)(a) GDPR). The possible lawful basis for the Department to disclose the spreadsheet here would be that this was necessary for the purposes of legitimate interests pursued by a third party (Article 6(1)(f) GDPR) – the applicant journalist argued there was public interest in disclosing the unredacted spreadsheet.
The Commissioner agreed there was a clear public interest in scrutinising and making transparent the finances of politically appointed figures. However, even where a third party has a legitimate interest in processing information, this can be overridden by the data subjects’ rights and freedoms (also Article 6(1)(f) GDPR). Further, as outlined by Lord Hope in Common Services Agency, “there is no presumption in favour of the release of personal data under the general obligation that [FOIA] lays down”.
The Tribunal therefore considered the legitimate interest in disclosing the information against the rights and freedoms of the data subjects. It found that the latter consideration deserved significant weight: UK law under the Data Protection Act, and case law like Common Services Agency, gives primacy to individuals’ data privacy rights. When therefore considering privacy rights, ‘one does not start with the scales evenly balanced’ (at ). The Tribunal weighed these rights against the public interest of disclosing the unredacted spreadsheet. It found that given the small amounts in issue, there being no suggestion of misuse of public funds, and the fact that the nature of each expense was already disclosed, this public interest was little. The appeal was dismissed.
Public authorities face an unenviable job when they respond to FOIA requests involving personal data. Where the personal data is the requester’s, the FOIA request must be reprocessed as a subject access request. Where the personal data belongs to a third party’s (i.e. someone other than the requestor), s.40(2) FOIA requires the public authority to do a complex balancing exercise involving the privacy rights of the third party and the principles of the GDPR. Greenwood shows that, in such case, the balancing scales weigh significantly towards the privacy rights of third party data subjects. This should provide useful guidance to public authorities who will want to avoid a data breach action from third parties.
The Tribunal in Greenwood also refused to make generic findings about the public interest of disclosing information. It criticised the applicant’s approach on this as ‘misconceived’ (at ): the applicant argued that the crux of the case was whether there was a sufficiently strong public interest to justify disclosure of the identity of special advisers who claim expenses. He drew an analogy with civil servants and highlighted the high-profile nature of special advisers. The Tribunal refused to make generic findings about this (at ), and stressed the jurisdiction of the First Tier Tribunal only to make specific findings on the facts before it. Applicants seeking to make similar arguments before this tribunal, based on broad public interest, should take note.
Nick De Mulder is an Associate in our Public Law team. Nick has assisted on a high-value Human Rights Act claim and on claims for judicial review of immigration authorities, a government agency and local authorities. He has assisted a charity and companies on GDPR and Data Protection Act compliance and on responding to Subject Access Requests. He has also assisted a defendant, and various witnesses, in preparing for and attending criminal trials.
Skip to content Home About Us Insights Services Contact Accessibility