BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
 |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
First-tier Tribunal (General Regulatory Chamber) |
||
|
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Williams v The Information Commissioner & Anor [2023] UKFTT 310 (GRC) (20 June 2023) URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2023/310.html Cite as: [2023] UKFTT 310 (GRC) |
||
[New search] [Printable PDF version] [Help]
Neutral citation number: [2023] UKFTT 310 (GRC)
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Heard by Cloud Video Platform
Heard on: 2 August 2022
Decision given on: 23 March 2023
Before
TRIBUNAL JUDGE NEVILLE
TRIBUNAL MEMBER A chafer
TRIBUNAL MEMBER r tatam
Between
edward williams
Appellant
and
(1) the information commissioner
(2) the home office
Respondents
Representation:
For the Appellant: Mr Williams in person
For the First Respondent: No attendance
For the Second Respondent: Mr A Moss, counsel
Decision: The appeal is dismissed.
REASONS
1. Mr Williams appeals against a Decision Notice [i] dated 28 September 2021, issued by the Information Commissioner under s.50 of the Freedom of Information Act 2000 ("FOIA"). These are our OPEN reasons and may be freely read by any person.
Background
The DDP works by providing tailored interventions which support individuals to stop participating in terrorism-related activity and to move away from terrorist ideology and ways of thinking. Such support can include practical mentoring, theological and ideological advice and in some cases psychological support. These interventions are designed to put in place protective factors and provide the best possible means for participating individuals to disengage from terrorism and reintegrate safely back into society. The programme works with a number of suppliers, who provide a variety of support and skills to work with a challenging cohort.
3. On 21 September 2020 Mr Williams requested the following information from the Home Office, pursuant to s.1 of FOIA (for ease of reference we have added numbers to each point):
[1] How many people are currently subject to the Home Office Desistance and Disengagement Programme?
[2] How many are on the programme because you consider them to hold extreme Islamic beliefs - 'Islamism'?
[3] How many are non-British citizens?
[4] How many are male / female?
4. On 24 September 2020 Mr Williams added the following:
[5] What is the age, in years and months, of the youngest person [who] is or was part of the programme?
[6] Were they identified as being a Muslim? What was their sex?
5. In its response of 5 October 2020, the Home Office confirmed that it held that information, but that it was exempt from the duty of disclosure at s.1 of FOIA. For request [1] the Home Office confirmed that the number of active participants in the DDP from April 2019 to March 2020 was 109. It refused to release the number at the exact time of Mr Williams' request, raising the exemption at s.35(2)(c) that disclosure would be prejudicial to the effective conduct of public affairs. The public interest in maintaining that exemption, it decided, outweighed the public interest in disclosure. As to the other requests, the Home Office raised the exemption at s.40(2) that the information constituted the personal data of the relevant participants, and that disclosure would be contrary to data protection principles.
6. Dissatisfied with the Home Office's response, Mr Williams complained to the Commissioner. During the Commissioner's investigation of the complaint, the Home Office additionally relied on exemption being required for the purpose of safeguarding national security under s.24(1). It further disclosed that there were 154 participants in DDP from March 2020 to April 2021.
7. Having completed his investigation, the Commissioner agreed with the Home Office's reasoning and conclusions on the initial two statutory exemptions. Having concluded that the Home Office was therefore entitled to withhold disclosure, the Commissioner declined to consider the additional national security exemption.
The appeal
8. On 29 September 2021 Mr Williams appealed to the Tribunal on the basis: first, that he should have been provided with a current number of participants rather than an annual figure, and that the public interest lays in disclosure; second, that the information sought in questions [2], [3] and [4] could not be classed as personal data if it "had been disclosed alone"; and third, that the Commissioner was put to proof that the information requested at questions [4] and [5] constituted personal data, arguing a legitimate interest in releasing the information due to its link with extremism and terrorism.
9. The Commissioner provided a Response to the appeal on 9 November, to which Mr Williams provided his Reply on 10 November 2021. Having been added as a respondent, the Home Office provided a Reply on 5 January 2022 that addressed all three claimed exemptions. We shall set out the positions taken in those documents in our own consideration of the issues.
The hearing
10. The appeal was heard by means of the Cloud Video Platform, all participants connecting remotely. The Commissioner did not attend and was not represented, having indicated in advance that he was content to rely on the case set out in his Response. The first part of the hearing was open to the public, and Mr Williams was able to participate. The OPEN documents to be considered were agreed as consisting of:
a. an open hearing bundle.
b. an authorities bundle provided by the Home Office.
c. a second witness statement from Ms Annabelle Doherty on behalf of the Home Office, dated 14 June 2022.
d. a series of news articles provided by Mr Williams.
e. skeleton arguments from Mr Williams and Mr Moss.
f. additional authorities.
11. Some of the Home Office's evidence and submissions were provided on a CLOSED basis, and not disclosed to any party save for the Tribunal and the Commissioner. After dealing with preliminary issues and hearing evidence from Ms Doherty, the Tribunal moved into a CLOSED session from which everyone was excluded except for those attending on behalf of the Home Office. During this session we heard additional evidence from Ms Doherty.
12. It is well-established that use of a CLOSED material procedure is to be exercised sparingly because its use derogates from the principle of open justice, which is essential in any free and democratic society: Bank Mellat v Her Majesty's Treasury (No. 1) [2013] UKSC 38 at [2]-[3], and specifically in relation to FOIA appeals in Browning v The Information Commissioner [2014] EWCA Civ 1050. Use of the procedure was previously authorised in this appeal and have we have kept that order under review. We remain satisfied that regard to CLOSED material is necessary to protect third party interests, including the interests of national security, and so that we can understand the nature of the requested information without the very purpose of the appeal being confounded by its disclosure. We have done our utmost to minimise the disadvantage to Mr Williams by disclosing as much as possible of what was said in the CLOSED session so that it could inform his submissions. We have taken the same approach to these OPEN reasons. A confidential CLOSED annexe has been provided to the respondents setting out only our reasons that cannot be disclosed, and this is subject to a direction under rule 14 of the Tribunal (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 prohibiting its disclosure to any person or body other than the respondents to this appeal and their personnel and legal representatives. Embargoed draft versions of both the OPEN and CLOSED reasons were provided to the respondents to ensure that no information was wrongly disclosed in OPEN, this did not result in any substantive changes to either document.
13. The OPEN hearing resumed. We heard closing submissions from Mr Moss and Mr Williams and reserved our decision. Before moving away from the hearing however, we make two further observations.
14. First, the Tribunal apologises for the delay in promulgating this decision. Applying the relevant principles, such as those discussed in R. (SS (Sri Lanka)) v SSHD [2018] EWCA Civ 1391, we are satisfied that it remains fair for us to decide the appeal.
15. Second, we wish to make an observation on the way in the hearing was conducted by remote means. Before the COVID-19 pandemic, hearings in this Chamber were conducted in-person, face-to-face. In many other courts and tribunals such a hearing is now again the starting point, a remote or hybrid hearing being the exception. Due to the nature of this Chamber and its proceedings, remote hearings are still routine. This has benefits in both efficiency and access to justice, but the overriding factor remains fairness. A party has no absolute entitlement to a remote hearing, much less to connect to a hearing in a particular way. In a recent decision, Swift v Information Commissioner & National Highways [2022] UKFTT 382 (GRC) [ii], the Tribunal said this:
28. The appeal was heard by means of the Cloud Video Platform. The Commissioner did not attend and was not represented. All participants attended by video, save for Mr Swift who connected by telephone. This is a matter of concern, given that Mr Swift proposed to both cross-examine witnesses and give evidence himself. During the pandemic, audio-only participation was often the only way in which appeals could be practicably heard. It is nonetheless generally inferior to video or in-person participation. We respectfully agree with the observations made by Dame Victoria Sharp in Gubarev & Anor v Orbis Business Intelligence Ltd & Anor [2020] EWHC 2167 at [50]-[52] as to the importance of the Tribunal observing and controlling the course of a hearing, as well as the behaviour of its participants. This is especially important in the case of evidence. The risk of unfairness must be even more acute when one side to a case can be seen and heard, and the other cannot.
29. We should make it clear that none of the above observations carry any criticism of Mr Swift in particular, and nor have they been applied to reduce the weight afforded to his evidence and submissions. In future however, the Tribunal will expect a party intending to connect without video to make an application for permission in advance. Such an application should give reasons why a video connection is impracticable, accompanied by evidence in support.
16. In the present appeal the only person to give oral evidence was Ms Doherty. Mr Williams cross-examined her, as he was entitled to do. We could not see Mr Williams, whose connection had been described to us as being "audio only". All other participants could be seen. As Mr Williams had signposted his intention to connect in this way early in the proceedings, without objection from the Tribunal or the respondents, we took no issue. But what causes us unease, on subsequent reflection, is a final comment by Mr Williams after the conclusion of the evidence, which revealed that (unlike Mr Swift in the above example) he could see the video feed even though he could not be seen himself. Not only does this engage the concerns expressed in Gubarev, for a witness to be unable to see her questioner when he can see her risks being unduly oppressive.
17. We make no criticism at all of Mr Williams. Until now he has never been put on notice that his preferred method of connection is anything other than entirely acceptable. Nor has the issue had any adverse consequences in this particular appeal. But in future, permission to join hearings by audio only should be sought in advance. If a party does not have the required facilities - a modern tablet, smartphone, or computer and webcam, together with a suitable place to use it - then any inability to obtain or access it should be explained and evidenced. There are further alternatives, such as the Tribunal arranging for the party's local court or tribunal centre to provide a video booth or indeed holding the hearing face-to-face at a convenient location, that the Tribunal may well require to be addressed before permission is given. All applications will, of course, be fact-specific and dealt with according to the overriding objective to the Procedure Rules including any request for reasonable adjustments.
Issues & Legal Framework
18. The Tribunal's approach to an appeal under s.58 of the Freedom of Information Act 2000 was confirmed by the Upper Tribunal in Information Commissioner v Malnick and Anor [2018] UKUT 72 (AAC) at [45] and [90]. Section 58(2) of FOIA provides that the Tribunal may review any finding of fact on which the notice in question was based. This means that the Tribunal exercises a full merits appellate jurisdiction, making any necessary findings of fact and then deciding for itself whether the provisions of FOIA have been correctly applied. But it does not start with a blank sheet: the starting point is the Commissioner's decision, to which the Tribunal should give such weight as it thinks fit in the particular circumstances. The issues are to be decided as of the date of the public authority's response, in this case 5 October 2020, but subsequent events can be considered when deciding on any substituted decision notice: Montague v Information Commissioner and DIT [2022] UKUT 104 (AAC).
19. As well as the exemptions at s.36 and s.40, the Home Office relies upon s.24, being that exemption is required for the purpose of safeguarding national security. In his closing submissions Mr Williams argued that there was no case for him to meet on s.24, given that it was not considered within the Decision Notice under appeal, and that we should not consider that exemption.
20. As confirmed in Birkett v DEFRA [2011] EWCA Civ 1606 at [24]-[28], subject to the Tribunal's case management powers a public authority is entitled to invoke additional exemptions at any point during the proceedings. We consider it appropriate to permit the Home Office to do so here. First, s.24 was raised in the Home Office's 'Revised Response' to Mr Williams dated 5 August 2021, as well as a letter to the Commissioner on 4 August 2021. The Commissioner declined to address the exemption, having already found others applied. That decision was out of the Home Office's control. The exemption is then squarely raised in the Home Office's rule 23 Response to Mr Williams' appeal, albeit 'in the alternative' to the other exemptions. It is directly addressed in Ms Doherty's witness statement and Mr Moss's skeleton argument provided on 8 June 2022. At the date of hearing Mr Williams had been on notice that the exemption would be claimed, and (insofar as is possible) the way in which it would be argued, for nearly a year. He has had a fair opportunity to deploy his own evidence and argument in response. While it must be said that the exemption's prominence in the Home Office's submissions has increased as time has gone by, so that it now stands as its primary argument, it is still appropriate and fair to consider it.
21. Having considered the evidence and submissions on the three exemptions, they are best dealt with in the following order:
a. Is exemption of the requested information required for the purposes of safeguarding national security?
b. Would disclosure be prejudicial to the conduct of public affairs?
c. Is the requested information exempt because disclosure to a member of the public would contravene any of the data protection principles?
22. The first two exemptions will only apply if the Tribunal considers that the public interest in maintaining it outweighs the public interest in disclosing the requested information. The third is an absolute exemption but incorporates its own balancing exercise.
The evidence
23. The Home Office's evidence relates to all three exemptions. It was principally given by Ms Doherty, the Head of Prevent Intervention Programmes within the Prevent Directorate, part of the Homeland Security Group within the Home Office. She has held that role since August 2021 and her responsibilities include case management policy and interventions for DDP.
24. The Home Office has argued that disclosure of the information requested by Mr Williams risks 'mosaic' identification of participants in DDP. It aims to release annual figures as to the total number of participants over that year. This differs from a snapshot of participants and their characteristics at any one time, which can be more readily compared with other contemporaneous sources of information to identify participants such as conviction statistics and media reports, as well as successive FOI requests. Ms Doherty gave a fictitious example of two snapshots being able to show that the number of participants with a particular characteristic has increased by one following a terrorism case being reported in the media, meaning that person is likely involved. To show that such successive FOI requests are made, Ms Doherty referred to two subsequent FOI requests made by Mr Williams himself, for the respective numbers of Islamist and far right participants both at 31 December 2021 and for the whole of that year. Inevitably the identity of a minority of participants is reported in the media, or at the very least can be hypothesised for analytical purposes from a particular conviction or the making of a particular type of order. Coupled with characteristics such as age and gender, mosaic identification by a so-called motivated intruder is a real potential outcome of snapshot identification.
25. For some participants, DDP may be a mandatory condition of release from prison on licence after a terrorism-related offence, of a Terrorism Prevention and Investigation Measure ("TPIM"), or of re-entry to the UK under the terms of a Temporary Exclusion Order ("TEO"). Some participants come to DDP voluntarily following referral, for example a serving prisoner about whom prison authorities have concerns.
26. Ms Doherty states that the programme is most successful when the participant willingly engages with the intervention, even where participation is mandatory. A possibility of being identified would, she said, risk reducing that engagement. Participants (or those mis-identified as participants) in the programme may face harassment and serious harm. They may be viewed as 'traitors' and 'spies' by their previous affiliates or those that have sought to radicalise them, and face stigma and distrust in their community. Identification as a participant might also risk difficulties such as media intrusion or problems with education and finding employment. Most participants subject to a TPIM or TEO have already been granted anonymity by the High Court when the measure or order was made, with identification potentially punishable by contempt proceedings. Identification of some participants, such as serving prisoners, could identify them as vulnerable targets for radicalisation or recruitment by other extremists.
27. Risk, Ms Doherty states, is not restricted to programme participants. The DDP engages Intervention Providers ("IPs"). This might be a practical mentor, giving the participant community and practical support, or an ideological or theological mentor. Mr Williams provided the Tribunal with an example of the role being publicly discussed, from the Chief Coroner's Action to Prevent Further Deaths Report [iii] following the inquests into the deaths in the 2019 Fishmonger's Hall Terror Attack perpetrated by Usman Khan:
91. The DDP is a Home Office programme for the rehabilitation of individuals who have been involved in terrorism or terrorism-related activity. It also aims to reduce the risk they pose to national security. One aspect of this programme is the appointment of mentors for offenders on licence.
92. Usman Khan had a theological mentor and a practical mentor. With his practical mentor he was able to have supervised access to the internet, so that he could seek employment and rebuild his life in other ways. His allocation of a practical mentor ended abruptly, as the Secretaries of State acknowledge in their written submissions. The Secretaries of State also accept that such sudden ceasing of mentoring should be avoided if possible.
93. The sudden end to the mentoring arrangement had the effect that one of the few social connections Usman Khan had in late 2019 was broken and that it became much more difficult for him to search for work. Isolation and a failure to integrate in the community had previously been identified as particular risk factors which might lead him to re-engage in extremism. Although it is unclear whether the ending of the mentoring arrangement actually contributed to Usman Khan conceiving a desire to carry out an attack, it is obviously undesirable that such mentoring arrangements should be disrupted in this way.
28. Ms Doherty described IPs as specialists in their field, subject to robust recruitment and training processes. They are required to meet directly with individuals, which itself carries risks. Care is taken to ensure IPs feel protected, and to safeguard their confidentiality. Many IPs go to great lengths to conceal their work for DDP, and the programme has encountered several instances of mentors receiving malicious messages. If identified, some mentors and their families could be exposed to a risk of harm from extremists and other hostile actors. They are advised not to discuss their IP role on social media or to the media in general, or to comment on government counter-terrorism policy. If an IP's confidence in the Home Office's ability to protect confidentiality is diminished, Ms Doherty stated, then their work for DDP may be threatened. IPs are already a scarce resource, and recruitment is difficult and time-consuming. Identification of participants in the programme risks identifying IPs, due to the need for the mentor to have regular contact and involvement in the participant's life.
30. In his robust and thorough cross-examination, Mr Williams did not specifically challenge Ms Doherty's evidence as to the potential consequences for a participant or IP identified through disclosure. He did question the claimed likelihood of mosaic identification. He referred Ms Doherty to an article in the Guardian entitled 'Extremists living in UK under secretive counter-terror programme', published on 5 April 2019 [iv]. Ms Doherty acknowledged that figures had been given to the Guardian that went beyond those which the Home Office now say is appropriate for disclosure. She was unable to say why this was considered appropriate as it pre-dated her involvement in DDP.
31. Mr Williams also questioned whether the Home Office truly intended to publish annual information as it claimed in its response of 5 October 2020, pointing out that DDP had been launched in 2016 and had still - even at the date of this hearing - never published annual statistics. Ms Doherty stated her understanding that in the early days of the programme when the number of participants was still low, there had been concerns over identification even from annual figures. While this was no longer the case, annual publication remained a "work in progress". Annual figures had been released in response to FOI requests but not in any form of report published online. Ms Doherty acknowledged that this was "not ideal" and arose from prioritising other matters. The programme had been under significant operational strain over the past two or three years, due to the work connected with terrorist incidents including (but not limited to) those at Fishmonger's Hall and the February 2020 attack in Streatham, as well as the pandemic - but it did remain the Home Office's intention to publish annual figures. The overall responsibility for this was not hers, but the head of the Prevent Directorate.
32. Ms Doherty also gave evidence in the CLOSED session. To assist the Tribunal in achieving a fair procedure, and as suggested in Browning at [35], at our request Mr Moss prepared a narrative setting out as much as possible of what transpired. Following amendment and approval by the Tribunal, the following was provided to Mr Williams:
No submissions were made in CLOSED. The Tribunal heard the evidence of Ms Doherty for approximately 30 minutes.
Ms Doherty was treated as still being subject to the affirmation she gave in OPEN, and the same was confirmed. Ms Doherty adopted her CLOSED witness statement, save for correcting one matter of fact which she had identified was inaccurate. Ms Doherty was then asked questions by Ms Tatam, and finally by counsel in respect of two matters which arose in evidence.
Ms Doherty returned to the issue of diversion of resources, which she had partly addressed in OPEN. She explained the operational impact on the Home Office. Ms Doherty gave evidence in respect of the recruitment of Intervention Providers, before going on to describe the role of Intervention Providers in response to a question from Judge Neville. Ms Doherty gave some specific reasons that Intervention Providers need to work anonymously in many cases and gave an example of how Islamist intervention works in practice. Ms Doherty spoke about the public image of DDP.
Ms Doherty noted that Mr Williams had made three requests for similar data since September 2020.
Ms Doherty was asked to expand on paragraph 53 of her OPEN witness statement, in respect of feigned compliance, and did do so.
Ms Doherty gave a further description of DDP's place in PREVENT and the wider Home Office counter-terrorism efforts.
Ms Doherty expanded upon the relationship between the numbers of participants and the risk of mosaic identification.
Ms Doherty was asked to consider whether the risk of identification relates to "Question 1", taken on its own. Her evidence was that it did do so, although the risk is higher when the questions are taken in concert.
33. In his closing submissions, Mr Williams asked us to "think carefully" about whether Ms Doherty should be considered as a reliable witness, given what he described as an implausible account of why no annual figures had yet been published by DDP despite years spent claiming an intention to do so. After carefully considering the evidence, we have concluded that Ms Doherty was an honest and reliable witness who did her best to answer Mr Williams' questions. Her knowledge was focussed, understandably, more on DDP's operational demands and the potential risks to participants and IPs, upon which she was well placed to give evidence, than schemes for publication of information. Mr Williams' consequent argument that the Home Office had "provided the wrong witness" reflects the relative importance he places on the discrete issue of annual publication. In addressing the actual issues that arise in the appeal, we consider Ms Doherty to have been an entirely appropriate person to give evidence. We found her evidence to be thoughtful, sincere and reliable. We have no hesitation in accepting her evidence, while recognising that the application of the exemptions and the balance of the public interest in disclosure is for the Tribunal to decide. We shall discuss the genuineness of the Home Office's intention to publish annual figures later in these reasons.
Section 24(1) - national security
Principles
34. In approaching this exemption, the Upper Tribunal in FCDO v Information Commissioner & Williams [2021] UKUT 248 approved six principles. We summarise them as follows:
(1) The term national security has been interpreted broadly and encompasses the security of the United Kingdom and its people, the protection of democracy and the legal and constitutional systems of the state.
(2) A threat to national security may be direct (the threat of action against the United Kingdom) or indirect.
(3) Section 24 is not engaged, unlike the majority of the qualified exemptions, by a consideration of prejudice. Its engagement is deliberately differently worded.
(4) The term "required" means "reasonably necessary".
(5) National security is a matter of vital national importance in which the Tribunal should pause and reflect very carefully before overriding the sincerely held views of relevant public authorities.
(6) Even where the chance of a particular harm occurring is relatively low, the seriousness of the consequences (the nature of the risk) can nonetheless mean that the public interest in avoiding that risk is very strong. The reality is that the public interest in maintaining the qualified national security exemption in section 24(1) is likely to be substantial and to require a compelling competing public interest to equal or outweigh it. That does not mean that the section 24 exemption carries "inherent weight" but is rather a reflection of what is likely to be a fair recognition of the public interests involved in the particular circumstances of a case in which section 24 is properly engaged.
Risk of identification
35. Mr Moss put forward that the risk of identification can be divided into five strands: identification of a particular participant; mis-identification of a particular person as a participant; a chilling effect on voluntary enrolment and individual engagement; a chilling effect on recruitment and retention of IPs; and finally that release of characteristics might show how resources are divided between different groups and increase the opportunities of participants to avoid the programme or to feign compliance. In relation to identification of individuals, he put forward Ms Doherty's evidence on successive snapshots and other publicly available information. We take all her evidence into account, without repeating it. Mr Moss also relied on the fictitious example given in the Home Office's rule 23 Response:
a. Throughout the year 2020 to 2021 there were 154 individuals on the DDP at one time or another. Accordingly, it is safe to assume that on any given day there were fewer than 154 individuals.
b. Suppose that on 1 April 2020 there are 140 individuals on the programme. Ten are female. Six are not British. Eight are not considered to hold extremist Islamic beliefs. A fictional FOIA request is made and answered on 1 April 2020, and that information is published.
c. On 10 April 2020, a female with a foreign citizenship is convicted of terrorism offences. The offence does not relate to extremist Islamic beliefs. She is given a suspended sentence. The same is reported by the press.
d. On 15 April 2020, a further FOIA request is made and answered. In response, the information is published that there are 142 individuals on the programme, that eleven are female, that seven are not British, and that nine are not considered to hold extremist Islamic beliefs.
36. The same could be said of a person sentenced to an immediate custodial sentence, as their release date (and therefore likely entry on to the programme) could be calculated. The Response contains a second example, by reference to request for the age of the youngest participant. If the age were to change between two successive FOIA requests then this could be connected to an individual whose age had been publicly reported, as is common and would be even more likely if conspicuously young. Furthermore, sometimes the Home Office was required to release details in response to other events. An example was the Fishmonger's Hall inquests. These are unforeseeable. The Response also cites Subject Access Requests as a further source of information. While they are not publicly available, there is nothing to prevent the recipient publishing the data or being the motivated intruder themselves.
37. Mr Williams argued in response that the risk of mosaic identification had been overblown. At best someone might guess at someone's identity, he argued, which was not the same as positive identification. He also asserted that most participants would share many personal characteristics such as to make individual identification unlikely, and that many of the triggers for inclusion on DDP - such as the making of a TEO - were not usually put in the public domain. As for the specific example given above, he argued that the non-British, non-Islamist female exemplar was extremely unlikely to arise in the real world.
38. Having carefully considered the parties' submissions, and without repeating all of them, we find that there is a high risk of mosaic identification of individual participants if any of the requested information is disclosed. This arises from the low number of participants overall, the chance of participants having a high media profile or being associated with a high-profile incident, and conviction for certain offences or the making of a TPIM or TEO often being a trigger for participation. Mr Williams' points above are defeated by both the low number of total participants and reliance on his own assumptions as to the characteristics of a typical participant. Even if many do share the same characteristics, then it becomes easier to identify those who do not, and the same can be said about those for whom conviction or the making of an order is the subject of publicity. Even if someone were only able to make an educated guess as to a participant's identity, without identification being conclusive, it might still be thought sufficient by a hostile actor to justify action.
39. We are satisfied that the risk of identification can arise even if only question [1] of Mr Williams' request is answered, its effect being to enable something close to real time tracking of the number of participants by multiple requests and which can be compared to other information in the public domain.
40. Rather like a traditional logic grid puzzle, the risk increases greatly with each characteristic then added to disclosure. Indeed, one of the factors put forward by Mr Williams in support of the public interest in disclosure is knowledge of the level and type of threat posed by particular extremist movements. In his closing submissions he expressed his disbelief of (what he says have been) comments by senior police officers that white supremacists pose a bigger threat to public security than Islamist extremists; he also said that his request for the age of the youngest participant related to identifying grooming "by Islamism, or perhaps by Extinction Rebellion." We will turn to the public interest in due course, but Mr Williams' intended use for the requested information illustrates its real potential to be cross-referenced to other sources about particular groups and particular individuals. Mr Williams may, as he told us, see his purposes as journalistic. But someone else could undertake the same exercise with hostile intent.
41. We therefore consider the risk of mosaic identification to be high for any of the individual questions, and as rising exponentially when combined with others. In reaching that finding we have placed no reliance on SARs as a source of information. The point was not pursued in Mr Moss's oral submissions, and no particular details are given as to how this might operate in practice.
42. We also accept that identification of a participant may risk identification of the IP. For example, the involvement of an individual in a participant's life might become known to friends and family, without them being aware that this is done as a practical mentor under the DDP. Upon the participant being identified as involved in the DDP, so too might the mentor.
Safeguarding national security
43. Do the potential consequences of identification risk adversely affecting national security? The starting point is the purpose of the DDP, as set out at paragraph 2 above, being to reduce the risk of terrorist activity posed by its participants. It does so as a core part of the government's wider counter-terrorism strategy. We apply the fifth and sixth principles set out in FCDO v Information Commissioner & Williams [2021] UKUT 248 to that context and have no hesitation in finding that the DDP's effectiveness has a direct causal link with safeguarding national security.
Public interest balancing test
45. Under s.2(2)(b) of FOIA, this exemption will only apply if the public interest in maintaining it outweighs the public interest in disclosing the information. The Tribunal balances all relevant factors against one another, and applies the specific principles already set out at paragraph 34 above.
47. Mr Williams put forward two other potential factors. First, as already noted, he wishes to test claims by senior police officers as to the relative risk posed by different forms of extremism. We do not know whether such claims have been made, but we accept in general terms that there is a public interest in knowing which ideologies and forms of extremism are most likely to pose a risk of terrorism such as to justify state intervention. This enables the public to assess the effectiveness and proportionality of the state's expenditure of resources and its use of investigatory and intrusive powers.
49. The factors in support of the public interest in maintaining the exemption have already been set out. We are satisfied that disclosure of information in response to any of the six questions has a real risk of causing an adverse effect on national security, in the ways described by Ms Doherty and as we have found at paragraph 44. We conclude that they wholly outweigh the factors in favour of disclosure. We therefore conclude that the requested information is exempt, pursuant to s.24(1).
Section 36(2)(c) - prejudice to the conduct of public affairs
Prejudice to the conduct of public affairs
50. Given our primary conclusion, we can express our conclusions on the remaining exemptions more briefly.
51. In the present appeal, this exemption will apply if disclosure would, or would be likely to, prejudice the effective conduct of public affairs. It was previously the Home Office's primary reason for refusing disclosure, on the basis recorded in the Decision Notice:
32. The Commissioner accepts that the Home Office told the complainant:
"The information for the period since April 2020 forms part of a subset of data - the total figures of which we intend to publish".
33. She also accepts that it told him, albeit with respect to the public interest test:
"Premature disclosure of statistics without adhering to established pre-publication procedures (which include internal consultation about the final statistics being published) would undermine the effective conduct of public affairs; specifically the Department's ability to use its staff resources effectively in a planned way, so that reasonable publication timetables are not affected".
52. The Home Office's argument above is, taken at face value, a good one. We agree that premature disclosure of statistics by a public authority, including internal consultation over their accuracy and suitability for release, may in some cases divert staff resources away from pre-planned publication that would serve a similar purpose.
53. Our concern in this case is the lack of any evidence that, at the time of the response on 5 October 2020, there was any coherent or set timetable to be disrupted. Ms Doherty's evidence was that annual publication of total numbers was intended as a matter of aspiration, but the resources to do so were simply not available. While she was able to point to other events that got in the way, such as the Fishmonger's Hall and Streatham attacks, and the restrictions arising from the pandemic, their effects would have all been well known by the time of the response. When pressed, she was unable to identify any actual schedule or timetable. While answering FOI requests undoubtedly diverted resources away from policy and operational work in general, the evidence before us does not establish that there was any publication plan of sufficient coherence to be disrupted. The requests also appear to be the only way in which annual figures were ever obtained, despite the Home Office accepting in principle that they should be released. It is difficult to see why the total annual figure for April 2019 to March 2020 could be given to Mr Williams in an FOI response which it was known would be published online [v], but that figure could not be published on gov.uk in the usual way.
54. In fairness to Ms Doherty, we should re-emphasise that she does not have overall responsibility for publication of data. As argued by Mr Williams, there may have been a better explanation of this point available from someone else in the Home Office. So far as the actual evidence before us is concerned, however, we are unable to accept the applicability of this exemption on the basis claimed in the 5 October 2020 response.
55. The way in which this exemption is argued has, however, evolved. While we are tasked with deciding the appeal on the basis of facts as they stood on 5 October 2020, we are entitled to consider new arguments on those facts. The Home Office Response, and Mr Moss, make what we consider to be three key points. First, the request is for snapshot information rather than annual figures. We have set out Ms Doherty's evidence that clearing snapshot figures for release would be resource-intensive, requiring consultation with stakeholder agencies and individuals to ensure that each snapshot would not identify a participant. Because this work might require engagement with risk factors specific to individual participants, and perhaps even the individuals themselves, it would be undertaken by operational staff who would be diverted from their usual work. Second, Mr Moss repeats the Home Office's case on national security as also showing that disclosure would have prejudice to the effective conduct of public affairs in a general sense and consequent to any identification through disclosure. Third, disclosure might reveal the resourcing of DDP in a way that would enable others to undermine its effectiveness.
56. Based on our findings as to the likelihood of identification that would arise from disclosure, we accept the first of Mr Moss's arguments in the above paragraph. We would ordinarily be reluctant to accept that s.36 could be engaged by the need to reallocate resources to comply with FOI requests. Compliance with FOIA is a legal obligation, and such a proposition risks promoting a lack of resources to a blanket defence. The situation here is qualitatively different. Fulfilment of a request for disclosure of a snapshot figure would, in effect, require a full risk assessment of what information would be disclosed and how likely it might be to identify an individual. This would involve more than the expense of time usually seen in responding to FOI requests, such as searching through records, redaction, and so on, which we would not accept as engaging this exemption. It would instead require direct operational work and potential liaison with individuals that itself might have a chilling effect on participation and engagement.
57. We further accept the second of Mr Moss's reasons, on the basis of our findings on the adverse effect upon national security that identification could cause. To those can be added increased operational work following any incident of inadvertent identification, and the potential for damage to the relationship between the Home Office and its Intervention Partners.
58. The prejudice required for s.36 to apply is accordingly established on those first two bases, subject to the balance of the public interest. On the OPEN evidence, we cannot accept the third argument. While we can see its logic, the causal link described by Ms Doherty and recorded at paragraph 29 above is not self-proving and requires further explanation.
Public interest balancing test
59. We carry forward our findings on the balance of the competing public interests in relation to s.24. Those in favour of disclosure are described at paragraphs 46 to 48 above. We find that the most prejudicial factors on the other side of the scales are the diversion of operational resources to risk-assess snapshot figures, and the actual and chilling effects of the risk of identification upon the relationship with IPs and their recruitment and retention. We consider the balance to lie strongly against disclosure, given the real risks to the effective running of the DDP programme that would arise from disclosure of snapshot figures and in dealing with the consequences of identification. The information is additionally exempt from disclosure pursuant to s.36(2)(c) of FOIA.
60. Again, we have reached the above findings with regard to only the OPEN evidence. The content of the CLOSED evidence substantially reinforces them.
Section 40(2) - Personal Information
Is the requested information personal data?
61. Insofar as applicable in this appeal, s.40(2) provides an exemption if the requested information both constitutes personal data and its disclosure, otherwise than under FOIA, would contravene any of the data protection principles.
62. The meaning of personal data is given by s.3 of the Data Protection Act 2018 ("DPA"):
3. Terms relating to the processing of personal data
...
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to—
(a)an identifier such as a name, an identification number, location data or an online identifier, or
(b)one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
...
63. In NHS Business Services Authority v Information Commissioner and Spivack [2021] UKUT 192 the Upper Tribunal held that the section defines personal data according to a binary test: can a living individual be identified, directly or indirectly? The test is applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated intruder. That intruder is described in Information Commissioner v Miller [2018] UKUT 220 as being a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so, the touchstone being an investigative journalist.
64. The test under this exemption is not the same as the test under s.24, where not only a very unlikely possibility might suffice if its consequences were severe, as indeed might misidentification. Here, a positive answer is required. The Commissioner accepts that the answer is "not clear cut" in relation to questions [2], [3] and [4].
65. Based on the OPEN evidence alone, we find that the probability identified under s.24 is sufficiently high to provide an affirmative answer here. Viewed in isolation, each of the six questions might seem unlikely to identify an individual. But each must be seen alongside the making of other FOI requests seeking additional information, or the same at other times, as well as access to the external sources of information already discussed. By an admittedly narrow margin, we consider the risk of identification to be sufficiently high to justify the response to each individual question being classed as personal data.
Would disclosure be contrary to the data protection principles?
Special category data
66. "Special category data", defined by Article 9 GDPR, is particularly sensitive and attracts more stringent protection. Both respondents argue that the request includes special category data as "some of it relates to" the data subject's religious beliefs. We agree, but solely in relation to question [6] that specifically requests the religious identity and sex of the youngest person on the programme. Insofar as either respondent also argues that question [2] engages Article 9, we disagree. Given the requirement to interpret the Data Protection Act 2018 and GDPR compatibly with the European Convention on Human Rights, we interpret religious belief in accordance with the authorities concerning Article 9 ECHR. To be protected, a belief must be consistent with basic standards of human dignity or integrity: R. (Williamson) v Secretary of State for Education and Employment [2005] UKHL 15; held to apply to Article 9(1) ECHR in Bull & Bull v Hall & Preddy [2012] EWCA Civ 83 at [45]. Nor can we see that underlying faith and extremist beliefs are severable when the former informs the latter.
67. Special category data may only be disclosed where one of the exceptions at Article 9(2) GDPR applies. Those considered in the Decision Notice are (a) (explicit consent from the data subject) or (e) (data made manifestly public by the data subject). We agree that neither applies, and nor has Mr Williams argued otherwise.
68. Mr Williams puts forward the exception at (g):
(g) processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
69. Part 2 of Schedule 1 to the Data Protection Act 2018 provides that reliance on the exception requires one of 23 potential conditions to be met. Mr Williams relies on condition no. 13. This, so far as might be relevant in this appeal, requires that processing: is for the purposes of journalism; is necessary for reasons of substantial public interest; and is carried out in connection with the commission of an unlawful act by a person, other seriously improper conduct of a person, mismanagement in the administration of a body or association or a failure in services provided by a body or association.
70. Mr Moss argued that Mr Williams is not a journalist. Mr Williams' reply was that the term is not defined by the Act, the FOIA response would be posted online, and it was not for the Home Office to choose who is and is not a journalist.
71. Processing must be for the sole purpose of journalism, or the condition will not be met. In Buivids v Datu valsts inspekcija [2019] EUECJ C-345/17 at [52], the Court of Justice held that journalistic purposes include the disclosure of information, opinions and ideas to the public; there is no requirement for the requester to be a professional journalist. Mr Williams' sole purpose being journalism is a fact that he is required to establish, by evidence. He did not give evidence before the Tribunal, and even taking an inquisitorial and informal approach to his skeleton argument and oral submissions there is insufficient material upon which to base such a finding.
72. We are satisfied that the information sought at question [6], insofar as it concerns religion, is special category personal data and its disclosure would be contrary to data protection principles. It is exempt from disclosure under s.40(2).
The remaining personal data
73. Processing, such as disclosure, must be lawful, fair and transparent. As to lawfulness, Article 6(1) GDPR provides a list of situations where processing will be lawful. The only one put forward as relevant in this appeal is provided by Article 6(1)(f) of UK GDPR:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
74. This provides a three-part part test: whether the request pursues a legitimate interest; whether disclosure is necessary to meet that legitimate interest; and whether the legitimate interest outweighs the interests and rights of the data subject.
75. In the FOIA context, necessity is established; disclosure under FOIA is the context of the exercise. We take the legitimate interests as being equivalent to the factors in favour of the public interest in disclosure we have already identified. In particular, the principles of transparency and accountability stand as a legitimate interest.
76. We turn to the balance between the legitimate interests in disclosure and the data subject's interests, first repeating our findings as to the potential adverse consequences of identification. Further relevant is the reasonable expectation of the data subject, at the time and in the context of the collection of their data, as to how that data would be used. Participation in DDP is on an explicitly confidential basis, and it may be sensibly assumed that this was a relevant factor behind some voluntary participants' decision to enrol. The protection of data subjects' private life also carries weight: Nowak v Data Protection Commissioner [2017] EUECJ C-434 at [57].
77. Balancing the above factors in the context of data protection, we are compelled to the same conclusion as reached in relation to the other exemptions. The legitimate interests in disclosure identified by Mr Williams fall far short of outweighing the interests of a data subject who would be identified. Disclosure of personal data in response to any of Mr Williams' six questions would be contrary to data protection principles. The exemption at s.40(2) FOIA applies.
The CLOSED evidence
78. Above, we have found each of the exemptions to be established solely on the basis of the OPEN evidence and submissions. Our conclusions are substantially reinforced once we take into account the CLOSED evidence, broadly on the basis set out in Mr Moss's OPEN skeleton argument. In particular:
a. The fictitious example in OPEN as to how a person might be identified was supplemented with real examples. We accept that they evidence a high probability of identification upon disclosure, and further accept the more detailed evidence as showing how identification might follow disclosure. This greatly increases the level of risk that we have identified.
b. We also heard more detailed and specific evidence on the risk of harm that can follow identification, which we accept as being very high.
c. Based on the CLOSED evidence, we now accept the Home Office's case on the systemic risks of disclosure and the risk of feigned compliance set out at paragraphs 51-53 of Ms Doherty's OPEN witness statement. This strengthens our conclusion that the public interest in disclosure is outweighed.
Conclusion
79. We find that the information is exempt from disclosure pursuant to all three exemptions. The Decision Notice is therefore treated as being in accordance with the law and the appeal is dismissed.
Signed Date:
Judge Neville 20 March 2023
Pursuant to rule 40 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, the above reasons were amended on 20 June 2023 to correct typographical errors in the underlined words at paragraphs 45 and 69.
Signed Date:
Judge Neville 20 June 2023
[iii] https://www.judiciary.uk/wp-content/uploads/2021/11/Fishmongers-Hall-Inquests-Prevention-of-future-deaths-report-2021-0362_Published-by-Chief-Coroner.pdf
