- Bookmark
- Share
- CaseIQ
The Information Commissioner v Miller (Information rights - Freedom of information - absolute exemptions)
Factual and Procedural Background
The Department for Communities and Local Government (DCLG) collected quarterly homelessness statistics from local authorities in England via P1E forms. Data for 2012/2013 had been published unredacted, but earlier years' data was not published. The Appellant requested data for the financial years 2009/10, 2010/11, and 2011/12. The DCLG refused, initially citing section 12 of the Freedom of Information Act (FOIA), later relying on sections 22 (future publication exemption) and 40(2) (personal data exemption). The Information Commissioner upheld the section 22 reliance but did not consider section 40(2). The Appellant appealed to the First-tier Tribunal (FTT) which, on the papers, decided section 22 did not apply and found the "small data" (data regarding 5 or fewer individuals or households) was not personal data under section 1(1) of the Data Protection Act 1998 (DPA), thus not exempt. The Information Commissioner appealed this section 40(2) decision to the Upper Tribunal. The DCLG chose not to participate in the appeal. An oral hearing was held before Upper Tribunal Judge Markus QC.
Legal Issues Presented
- Whether the "small data" information constitutes personal data under section 1(1) of the Data Protection Act 1998 for the purposes of section 40(2) of FOIA.
- Whether the First-tier Tribunal erred in law by failing to consider the disputed information or the complete P1E data files in its assessment.
- Whether the FTT erred in not adjourning proceedings to seek further submissions from the Information Commissioner and/or the DCLG regarding the application of section 40(2).
Arguments of the Parties
Appellant's Arguments
- The FTT applied an incorrect legal test by not properly applying the "motivated intruder" test and failed to give adequate reasons.
- The FTT wrongly presumed the data to be anonymous unless a compelling reason was shown otherwise, conflating the need for anonymisation with the question of whether the data was personal data.
- The FTT applied an incorrect burden of proof and imposed an additional hurdle for satisfying limb (b) of the personal data definition.
- The FTT should have scrutinised the data more closely, including considering the detailed spreadsheets and the possibility of identification through data linkage.
- The FTT should have adjourned the proceedings to seek further submissions from the Commissioner and DCLG due to the paucity of reasoning on section 40(2).
Information Commissioner's Arguments
- The Commissioner did not make a finding on section 40(2) but considered it appropriate for DCLG to ensure data is released in anonymous form.
- The Commissioner agreed that sample extracts of data were sufficient for the FTT’s consideration and did not deem it necessary for the full spreadsheets to be included in the bundle.
DCLG's Arguments
- DCLG relied on section 40(2) exemption for fields with fewer than 5 responses or where such numbers could be deduced by calculation.
- DCLG asserted disclosure would likely breach the first data protection principle relating to fair and lawful processing.
- DCLG aligned its approach with the Office for National Statistics and the Information Commissioner's Anonymisation Code of Practice.
- DCLG did not participate in the appeal but had presented its case to the Commissioner during the investigation.
Table of Precedents Cited
| Precedent | Rule or Principle Cited For | Application by the Court |
|---|---|---|
| Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 | Clarified that whether data is personal depends on whether individuals can be identified by the public following disclosure, considering information beyond the data controller's possession. | The court cited it to establish the correct approach to identifying personal data in anonymised datasets, emphasizing public identifiability. |
| R (Department of Health) v Information Commissioner [2011] EWHC 1430 (Admin) | Discussed the application of the "motivated intruder" test and the concept of identifiability including likelihood of identification by public using all reasonable means. | The court relied on this case to explain how the FTT should assess the risk of identification, including consideration of motivated intruders. |
| Information Commissioner v Magherafelt District Council [2013] AACR 14 | Confirmed that the test for personal data in anonymised information involves assessing whether identification is possible using other information likely to come into possession of third parties. | The court used this precedent to affirm the approach that identification risk includes information held by persons other than the data controller. |
| Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 | Considered the identification risk posed by determined persons using investigative methods beyond those of ordinary persons. | The court referenced this case to support the notion that identification risk includes actions by motivated or determined individuals such as investigative journalists. |
| Oxford Phoenix Innovation Limited v Information Commissioner and MHRA [2018] UKUT 192 (AAC) | Outlined the appellate court's approach to reviewing tribunal reasons, emphasizing broad sufficiency rather than narrow textual analysis. | The Upper Tribunal applied this principle in assessing whether the FTT applied the correct legal test and sufficiently explained its decision. |
| UCAS v Information Commissioner and Lord Lucas [2014] UKUT 557 (AAC) | Set the standard for tribunal reasons, requiring that the tribunal show it has applied the correct legal test and broadly explained its decision. | The court applied this standard in evaluating the adequacy of the FTT’s reasoning. |
| IC v Malnick and ACOBA [2018] UKUT 72 (AAC) | Confirmed that the FTT exercises a full merits review and has investigatory powers in appeals against the Information Commissioner. | The court cited this to discuss the FTT’s duty to consider relevant evidence and submissions in appeals involving FOIA and data protection issues. |
Court's Reasoning and Analysis
The Upper Tribunal carefully considered whether the FTT applied the correct legal test to determine if the "small data" constituted personal data. The court found that the FTT addressed the correct question: whether there was a reasonable likelihood that individuals could be identified from the data combined with other information likely to be in the possession of third parties, consistent with the "motivated intruder" test derived from precedent.
The Tribunal noted that while the FTT did not explicitly use the term "motivated intruder," it effectively considered what knowledge would be necessary for identification, including specific details about individuals' homelessness applications, outcomes, age, household composition, and location.
The court found the FTT's scrutiny of the sample data and its conclusion that identification was extremely remote to be adequate, rejecting the appellant's attempts to reargue the case or impose a higher evidential burden on the public authorities. The FTT's reasoning that the data was sufficiently anonymised was supported by the absence of compelling evidence from the DCLG or Commissioner of a realistic identification risk.
Regarding the appellant’s argument that the FTT should have examined the full disputed data and electronic files, the court accepted that the Commissioner had indicated the sample extracts were sufficient and that the FTT was entitled to rely on this. The Upper Tribunal also reviewed the full files and agreed that they would not materially alter the FTT’s conclusion on identifiability, noting the passage of time and the limited detail in the data reduced the risk of identification to negligible.
On the procedural issue of whether the FTT should have adjourned to seek further submissions from the Commissioner or DCLG, the court upheld the FTT’s decision not to adjourn. It reasoned that the parties had access to legal representation, had been given adequate opportunity to present their cases, and that further delay would be disproportionate and unfair to the appellant. The FTT had exercised its inquisitorial role appropriately and had sufficient material to determine the appeal fairly.
The court rejected submissions that adjournment could not constitute procedural unfairness, noting that delay can amount to unfairness depending on circumstances. The FTT’s balancing of the overriding objective of the Tribunal Procedure Rules, including proportionality, efficiency, and fairness, was found to be lawful and reasonable.
Holding and Implications
The Upper Tribunal DISMISSED the appeal by the Information Commissioner against the FTT's decision.
The direct effect is that the FTT's determination that the "small data" at issue does not constitute personal data under section 1(1) of the DPA and is therefore not exempt under section 40(2) of FOIA stands. The data in question may be disclosed. The decision does not establish new legal precedent but affirms the application of existing principles regarding anonymisation, identifiability, and procedural fairness in FOIA appeals involving personal data exemptions.
Alert