Joshua Howells v The Information Commissioner

Factual and Procedural Background

The Appellant submitted a request on 23 January 2021 to a regional police force ("The Police Force") seeking confirmation whether a specific individual, depicted in a photograph provided by the Appellant, was employed by the Police Force. The request was made concurrently with a formal police complaint regarding the conduct of the individual in question. The Police Force responded by refusing to confirm or deny the existence of such information under the Freedom of Information Act 2000 ("FOIA"), citing the exemption under section 40(5) relating to personal data. Following an internal review, the Police Force upheld its position. The Appellant then complained to the Information Commissioner ("The Commissioner") about the handling of the request.

The Commissioner issued a decision notice upholding the Police Force's refusal to confirm or deny holding the information, applying the data protection principles under the UK General Data Protection Regulation ("UK GDPR") and FOIA. The Appellant appealed the Commissioner's decision to the First-tier Tribunal (General Regulatory Chamber) Information Rights ("The Tribunal"). The hearing was conducted remotely via video platform, with the Appellant representing himself and the Commissioner unrepresented.

Legal Issues Presented

1. Whether the Police Force was entitled under section 40(5B)(a)(i) FOIA to neither confirm nor deny holding the requested information on the basis that such confirmation or denial would disclose personal data and contravene UK GDPR principles.
2. Whether confirming or denying that the Police Force holds the requested information would be lawful, fair, and transparent processing of personal data under Article 5(1)(a) and Article 6(1)(f) UK GDPR.
3. Whether the legitimate interests in disclosure outweigh the rights and freedoms of the data subject(s) involved, particularly in the context of the Appellant's complaint and the public interest in police accountability.
4. The applicability and outcome of the three-part test under Article 6(1)(f) UK GDPR concerning legitimate interest, necessity, and balancing of interests.

Arguments of the Parties

Appellant's Arguments

• The Appellant contended that the request was not for personal information per se but solely for confirmation whether an individual was employed by the Police Force.
• The information was necessary to pursue a complaint of possible misconduct in public office related to the individual’s contact with the Appellant, who was a victim in a related matter.
• The Appellant asserted that he did not require any further personal details, only confirmation or denial of employment status.
• The Appellant argued that the Police Force's refusal and the Commissioner's decision hindered the ability to properly investigate his complaint, as he could not confirm whether the complaint was directed at the correct police force.
• The Appellant stated that alternative complaint mechanisms had been inaccessible or ineffective, with the Police Force allegedly refusing complaints and threatening him with a contact management strategy.
• The Appellant disputed the Commissioner's assertion that there were less intrusive means to resolve the matter without FOIA disclosure.

Commissioner's Arguments

• The Commissioner initially found that confirming or denying whether the Police Force held the information would disclose personal data of a third party, as defined under the Data Protection Act 2018 and UK GDPR.
• The Commissioner applied the data protection principles, concluding that disclosure would only be lawful if it met one of the lawful processing conditions under Article 6(1) UK GDPR, identifying Article 6(1)(f) concerning legitimate interests as most applicable.
• The Commissioner acknowledged the Appellant’s legitimate interest in transparency and accountability but later revised her position on the necessity test, concluding that disclosure was not necessary as alternative, less privacy-intrusive complaint mechanisms existed.
• The Commissioner submitted that the requested confirmation or denial was not necessary to achieve the legitimate aims, given the availability of misconduct complaint procedures with the Police Force.
• The Commissioner noted that the Appellant did not know the identity of the individual or whether the individual was employed by the Police Force, but considered that disclosure would reveal personal data identifiable from the photograph provided.
• The Commissioner emphasized that disclosure under FOIA would be to the world at large, removing any duty of confidence and potentially causing unjustified harm to the data subject.

Table of Precedents Cited

No precedents were cited in the provided opinion.

Court's Reasoning and Analysis

The Tribunal accepted the statutory framework and analytical approach applied by the Commissioner, including the identification of the duty to confirm or deny under section 1(1)(a) FOIA and the exemption under section 40(5B)(a)(i) concerning personal data. The Tribunal agreed that confirming or denying whether the Police Force held the requested information would constitute disclosure of personal data, and that the data protection principles under UK GDPR applied.

However, the Tribunal diverged from the Commissioner’s revised view on the necessity test. It found that the Appellant had no effective alternative means to progress his complaint without confirmation or denial of employment status. The Tribunal noted that the Police Force had not provided evidence of any misconduct process initiated or alternative complaint resolution, and that the Appellant’s reluctance to disclose the photograph without confirmation of the correct police force had led to a stalemate.

The Tribunal considered the legitimate interests in disclosure, specifically the Appellant’s interest in ensuring his complaint was directed appropriately and the broader public interest in effective police complaints handling. It found these interests outweighed the data subject’s rights and freedoms in this context.

The Tribunal also reasoned that a police officer would generally have a lower expectation of privacy regarding employment status, especially when identifiable by uniform or epaulettes, and that no specific harm or justification for non-disclosure was presented by the Police Force.

Therefore, the Tribunal concluded that the Police Force must confirm or deny whether the individual in the photograph was or was not employed by the Police Force at the time of the request.

Holding and Implications

The Tribunal's final decision is ALLOWING THE APPEAL and substituting the Commissioner's decision notice with one directing the Police Force to comply with the following:

• Within 35 calendar days, confirm or deny to the Appellant whether the individual depicted in the photograph submitted with the request was or is a member of the Police Force.

The direct effect of this ruling is to permit the Appellant to pursue his complaint with the appropriate police authority. The Tribunal’s decision does not establish new legal precedent but clarifies the application of the FOIA exemption under section 40(5B)(a)(i) in circumstances where legitimate interests in disclosure outweigh data protection concerns, particularly in the context of police complaints and public accountability.

Failure by the Police Force to comply may result in certification to the Upper Tribunal and potential contempt of court proceedings.