Expenses and Exemptions: Looking at the case of George Greenwood v Information Commissioner (2020)

23 April 2020

The recent case of George Greenwood v Information Commissioner (2020) (“Greenwood”) gives useful guidance on the Information Tribunal’s approach when applying one of the s.40(2) exemptions in the Freedom of Information Act 2000 (the “FOIA”). When relying on this exemption, public authorities sometimes face the thorny issue of balancing the privacy considerations of third party personal data against principles that militate in favour of disclosing the information. The judgment makes clear that, when considering this balance, the scales are weighed quite significantly towards the privacy rights of third party data subjects.

The applicant in Greenwood is a data journalist. He requested information from the Department for Exiting the European Union:

  1. Details of the total amount in expenses claimed by special advisers.
  2. A breakdown, by each special adviser, of the amount claimed, the date and the reason for the claim.

The Department provided the first category of information but withheld the second category of information. The applicant complained to the Information Commissioner, which led to the Department providing a redacted spreadsheet of the second category of information. The Department stated it did not need to provide an unredacted version – this would have shown the names, employee numbers and contact details of the advisers and their supervisors, amongst other information. The information that was disclosed showed nine expenses claims, mostly for taxi fares, all under £40.

The Information Commissioner gave a Decision Notice finding that the Department was entitled to withhold the relevant information under s.40(2)(3A) FOIA. This provision says that public authorities can withhold the personal data of people (other than the requestor) where disclosing the information would breach the data protection principles under the GDPR. The applicant appealed the Decision Notice.  

The Information Tribunal’s starting point was to consider whether disclosing the disputed information would breach the principle that personal data should be processed lawfully, fairly and transparently in relation to the data subject (Article 5(1)(a) GDPR). The possible lawful basis for the Department to disclose the spreadsheet here would be that this was necessary for the purposes of legitimate interests pursued by a third party (Article 6(1)(f) GDPR) – the applicant journalist argued there was public interest in disclosing the unredacted spreadsheet.

The Commissioner agreed there was a clear public interest in scrutinising and making transparent the finances of politically appointed figures. However, even where a third party has a legitimate interest in processing information, this can be overridden by the data subjects’ rights and freedoms (also Article 6(1)(f) GDPR). Further, as outlined by Lord Hope in Common Services Agency, “there is no presumption in favour of the release of personal data under the general obligation that [FOIA] lays down”.

The Tribunal therefore considered the legitimate interest in disclosing the information against the rights and freedoms of the data subjects. It found that the latter consideration deserved significant weight: UK law under the Data Protection Act, and case law like Common Services Agency, gives primacy to individuals’ data privacy rights. When therefore considering privacy rights, ‘one does not start with the scales evenly balanced’ (at [56]). The Tribunal weighed these rights against the public interest of disclosing the unredacted spreadsheet. It found that given the small amounts in issue, there being no suggestion of misuse of public funds, and the fact that the nature of each expense was already disclosed, this public interest was little. The appeal was dismissed.

Public authorities face an unenviable job when they respond to FOIA requests involving personal data. Where the personal data is the requester’s, the FOIA request must be reprocessed as a subject access request. Where the personal data belongs to a third party’s (i.e. someone other than the requestor), s.40(2) FOIA requires the public authority to do a complex balancing exercise involving the privacy rights of the third party and the principles of the GDPR. Greenwood shows that, in such case, the balancing scales weigh significantly towards the privacy rights of third party data subjects. This should provide useful guidance to public authorities who will want to avoid a data breach action from third parties.

The Tribunal in Greenwood also refused to make generic findings about the public interest of disclosing information. It criticised the applicant’s approach on this as ‘misconceived’ (at [52]): the applicant argued that the crux of the case was whether there was a sufficiently strong public interest to justify disclosure of the identity of special advisers who claim expenses. He drew an analogy with civil servants and highlighted the high-profile nature of special advisers. The Tribunal refused to make generic findings about this (at [58]), and stressed the jurisdiction of the First Tier Tribunal only to make specific findings on the facts before it. Applicants seeking to make similar arguments before this tribunal, based on broad public interest, should take note.

About the author

Nick De Mulder is an Associate in our Public Law team.  Nick has assisted on a high-value Human Rights Act claim and on claims for judicial review of immigration authorities, a government agency and local authorities. He has assisted a charity and companies on GDPR and Data Protection Act compliance and on responding to Subject Access Requests. He has also assisted a defendant, and various witnesses, in preparing for and attending criminal trials.

Nick is building a practice in Public Law, Business and Human Rights and Information Law



Share insightLinkedIn Twitter Facebook Email to a friend Print

Email this page to a friend

We welcome views and opinions about the issues raised in this blog. Should you require specific advice in relation to personal circumstances, please use the form on the contact page.

Leave a comment

You may also be interested in:

Skip to content Home About Us Insights Services Contact Accessibility