BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
 |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
Upper Tribunal (Administrative Appeals Chamber) |
||
|
You are here: BAILII >> Databases >> Upper Tribunal (Administrative Appeals Chamber) >> PricewaterhouseCooper v Information Commissioner [2011] UKUT 372 (AAC) (13 September 2011) URL: http://www.bailii.org/uk/cases/UKUT/AAC/2011/372.html Cite as: [2011] UKUT 372 (AAC) |
||
[New search] [Printable RTF version] [Help]
DECISION OF THE UPPER TRIBUNAL
(ADMINISTRATIVE APPEALS CHAMBER)
The DECISION of the Upper Tribunal is to dismiss the appeal.
The decision of the First-tier Tribunal (General Regulatory Chamber) (Information Rights) dated 4 March 2010 under reference EA/2009/0049 does not involve an error on a material point of law.
This decision is given under section 11 of the Tribunals, Courts and Enforcement Act 2007.
Introduction
1 To what extent, if at all, can any person make a request of the tax authorities about information held about the tax affairs of any other person? That is the central question in this appeal. Our conclusions, in summary, are as follows.
2 First, we agree with Her Majesty’s Revenue and Customs (HMRC) that when section 23(1) of the Commissioners for Revenue and Customs Act 2005 (CRCA) refers to information the “disclosure of which is prohibited by section 18(1)”, it is referring solely to section 18(1), and not section 18(1) as affected by any of the exceptions in section 18(2). Accordingly we agree with HMRC’s submissions on what we describe as “the construction issue”.
3 Second, and lest we are wrong on that point, we consider what we call “the consent issue”. On this issue we agree with PricewaterhouseCoopers LLP (PwC) that a consent to disclose relevant information under section 18(2)(h) of CRCA may be adequate to prevent a disclosure being characterised as a breach of a statutory prohibition (and therefore exempt under Freedom of Information Act 2000 (FOIA), section 44) even though it only permits disclosure to a third party (in this case PwC). It follows that such a consent to disclosure may be effective in removing the exemption even if it is avowedly not a disclosure to the whole world, which is in principle the usual consequence of a disclosure following a request under FOIA.
4 The formal request was in this case made by PwC, a limited liability partnership that, among other services, provides assistance and advice to taxpayers. The request was made to HMRC, the main tax authority in the United Kingdom. The formal request is not set out fully as it identifies a specific taxpayer (Mr H in this decision). But it also identifies kinds of tax, specific tax offices, and another taxpayer. As the details of the request themselves raise issues about anonymity, the tribunal takes the view that the full request should remain closed at least while there remains a live dispute between the parties. For instance, the request indicates the kinds of tax that the tax authorities may be considering to be those for which the taxpayer has an unresolved liability, the extent to which there may be disagreement with the taxpayer, the involvement of third parties, and the geographical location of the taxpayer.
5 The tribunal therefore considers the appeal in this decision with regard to the following anonymised form of the request, made on 22 09 2008:
“The information required is all material answering to the description below,
relating to the tax affairs of Mr H, which was generated in the period from 1 12 2006 to the current date:
Copies of all internal HMRC communications – whether in the form of letter or memorandum or report or submission or “opinion”; or whether transmitted by post, internal circulation, fax or e-mail – between Mr H’s tax office …
and any other part of HMRC, including (but not restricted to):
all technical specialists (including the technical specialists dealing with questions of …)
Any other Head Office or Policy divisions (e.g., …)
Any … units
The tax office of …; plus
Copies of all noted of meetings and all notes of telephone conversations between persons working within any of these parts of HMRC; plus
Copies of any briefing papers prepared for these meetings or telephone conversations.”
6 HMRC responded promptly to this request. Its response was that it would neither confirm nor deny if it held the information requested, relying in so replying on section 44 of FOIA and section 23 of CRCA. However, it explained that it might disclose some of the information on a discretionary basis if it received the necessary consent from the taxpayer as the matter could be dealt with under the Data Protection Act 1998 (DPA). During correspondence that followed a form of consent by the taxpayer was offered to HMRC by PwC. It was not accepted. HMRC also undertook, at PwC’s request, an internal review of its decision. HMRC did not accept any of the consents offered. But it did offer PwC some information on the basis that it was releasable data, while refusing to reveal any other information.
7 PwC complained to the Information Commissioner, arguing both that it had provided adequate consent and that it was entitled to the information under the relevant provisions of the CRCA.
8 In a detailed decision issued on 20 05 2009 the Information Commissioner confirmed the right of HMRC to decline to either confirm or deny the requested information under section 44 of FOIA. The Information Commissioner took the view that the taxpayer had not consented adequately to the request and that in the absence of that consent PwC was not entitled to any information from HMRC.
The decision indicated that, had PwC had proper consent, then the Commissioner may have reached a different conclusion.
9 PwC appealed to the First-tier Tribunal (FTT). After a hearing and full arguments from PwC, HMRC and the Information Commissioner, the FTT gave a detailed decision (analysed below) dismissing the appeal. In summary, the FTT decided that the provisions of CRCA prevented HMRC releasing the requested information to PwC even if PwC held adequate consent. The FTT also concluded that in any event PwC did not hold adequate consent to support its request.
10 PwC sought to appeal from that decision to the Upper Tribunal. Permission was given. At that stage the Information Commissioner declined to take any further active part in the proceedings, while continuing to maintain the view taken before the FTT. This tribunal therefore heard argument between PwC and HMRC.
11 It is to be emphasised that this request is to be treated as an application by a third party, not by the data subject. The papers make clear that the information, or much of it, could have been sought by a number of methods. One is by means of the disclosures that take place as part of any appeal before the FTT Tax Chamber (or its predecessors, the Special and General Commissioners). Another is by means of an application under the DPA. A third is by means of a request by or in the name of the taxpayer under FOIA in so far as the other applications did not reveal the information sought.
12 The proceedings to date seem to be made by PwC and treated by HMRC partly on the basis that PwC is a tax adviser to Mr H and partly on the basis that PwC is a third party. This has in the view of this tribunal resulted in some conflation in, and some confusion of, thinking about the nature of the application made.
13 PwC explained its position as follows. It acts as tax adviser to Mr H. There are a number of live tax issues between Mr H and HMRC in which PwC is involved. Some, if not all, arise from returns made by or for Mr H under the self-assessment regime that has applied to income tax returns for over a decade.
14 Those with detailed knowledge of the tax system that applies to self-assessed income tax will know that HMRC can enquire into a self-assessed tax return following certain procedures only and within certain time limits, depending on the nature of the enquiry being followed. Further, for the matter to remain in dispute and not be finalised, a taxpayer must exercise rights of appeal at appropriate times. During the ensuing process both parties have duties to disclose evidence and information to each other and to the FTT Tax Chamber that decides any appeal. Often during that process – and perhaps after production of evidence and documents – the parties reach agreement under section 54 of the Taxes Management Act 1970. If they do, that agreement acts in place of a tribunal decision to determine the appeal. And if so, then the agreement and all details remain confidential to the parties. Nothing is published, even to the tribunal. It is only if there is a full hearing and decision by the tribunal that details will emerge. Otherwise, the long-standing tradition of the relationship between taxpayers and the tax authorities has been one of secrecy. No part of the taxpayer’s affairs, or of the dispute, will be put into the public domain by HMRC or (in practice) by the taxpayer.
15 It follows that it is only if, and only when, an appeal reaches the final stage of a decision by the tribunal that it will become public. It also follows that, save for the exercise of the provisions in dispute in this appeal, HMRC will put nothing on the public record about any dispute it is having with any taxpayer. Further, by longstanding convention, this is something in which Parliament, Ministers, and other politicians take no part. So nothing comes into the public domain through the political process either.
16 In this case PwC sought both to use its links with the taxpayer and its status as a third party. It was made clear both in the earlier stages of this appeal and before us that this was a request made by PwC in its own name and not as agent. It wanted the information for its own purposes. The issues disputed between its client and HMRC were difficult issues on which PwC advised others as well as the taxpayer. The information it sought would be valuable to PwC in addressing those issues and not just with regard to this particular taxpayer.
17 At the same time it used its detailed knowledge of the taxpayer’s affairs to make a targeted request for the information. It did so, the tribunal was told, because PwC already had some documentation about the relevant tax issues but took the view that other material must exist. And PwC also took the view that by making its request by reference to particular taxpayers and particular periods it would be more convenient and less onerous for HMRC to comply.
18 PwC also asserted that its relationship with Mr H, the taxpayer, was such that the information it sought to obtain would not be disclosed publicly and that there would continue to be a professional relationship between it and Mr H. So although it was making a third party request it would not treat the information as a disinterested third party. Notwithstanding that the bundle contained extracts from relevant professional codes of conduct, this tribunal was not taken to, and did not ask to see anything about, the specific terms of the contractual relationship between PwC and Mr H. Nor were any factual findings made about that relationship in any earlier stage of the appeal.
21 The request was refused under section 44 of FOIA. The refusal was because disclosure by HMRC was prohibited under other legislation, namely the provisions of CRCA.
22 By the time the appeal came before this tribunal, the issues in dispute had been clarified and refined into two specific issues:
(a) The construction issue: was the information sought by PwC exempt information under section 44 of FOIA because its release was prohibited by sections 18 and 23 of CRCA?
(b) The consent issue: if and in so far as the consent of the taxpayer was necessary to authorise the disclosure by HMRC to PwC, was a consent limited to PwC valid or was it necessary for Mr H to consent to disclosure to the public at large?
23 The parties disagreed on both issues, and disagreed about the order in which they were to be considered. The Information Commissioner’s position was that he supported PwC on the construction issue and HMRC on the consent issue.
24 Against that background, and with respect to the full argument given to both issues both in this tribunal and below, this tribunal considers that it should consider both issues in full. It also considers that it is useful to consider the construction issue first both to set the consent issue in its legislative context and to ensure any difficulties in interpreting that part of the legislation are considered in a wider context.
The construction issue: was the information exempt information?
The context in which the issue arises
25 The legislative framework under which HMRC is both established and carries out its functions is that of CRCA. This replaced longstanding previous provisions when the former tax authorities, the Inland Revenue and the Commissioners of Customs and Excise, were merged a few years ago. Obtaining and processing information are central essential functions of HMRC. Much of the relevant legislation for this is in the Tax Acts, including in particular the Taxes Management Act 1970. However, the core provisions are in sections 17 to 23 of CRCA, under the heading “Information”. The full text of those sections is set out in the appendix to this decision and not repeated here. The references below are to those sections in that Act unless otherwise stated.
26 Section 18 is headed Confidentiality. Subsection (1) sets out the primary obligation on all concerned at HMRC to keep information confidential:
“(1) Revenue and Customs officials may not disclose information which is
held by the Revenue and Customs in connection with a function of the Revenue and Customs.”
27 Subsection (2) then provides that subsection (1) does not apply to a list of 8 types of disclosure. It is common ground that only one, the last one, is relevant on the facts here. This is a disclosure:
“(h) made with the consent of each person to whom the disclosure relates.”
28 Subsection (3) makes subsection (1) subject to any other enactment permitting disclosure. Subsection (4) is interpretative.
29 This is followed by section 19, headed Wrongful disclosure. Section 19(1) provides that:
“(1) A person commits an offence if he contravenes section 18(1) or 20(9) by disclosing revenue and customs information relating to a person whose identity –
(a) is specified in the disclosure, or
(b) can be deduced from it.”
The rest of the section provides a defence to, and further details about, prosecution and conviction under the section.
30 Section 18(2)(b) provides that section 18(1) does not apply to a disclosure made under section 20 or section 21. Section 20 deals with Public Interest Disclosure. It permits HMRC to make disclosure if satisfied that it is in the public interest and that the Commissioners give instructions for the release and that it is to one of a list of closed classes of recipients (such as the police) or for a closed list of categories of reasons (such as public health). Section 20(9) (to which section 19 refers) provides that information disclosed in reliance on section 20 may not be further disclosed without the consent of the Commissioners. While this permits limited disclosure it provides, with section 19, that any further disclosure is a criminal offence.
31 Section 21, also provided for in section 18(2)(b), provides for disclosure to prosecuting authority. This is a parallel provision to section 20. Like section 20, any further disclosure without further consent by the Commissioners is a criminal offence. Neither of these sections are relevant to this appeal.
32 Section 22 (Data protection &c) makes sections 17 to 21 subject to the DPA. Nothing specifically turns on that in this appeal, although HMRC’s initial response to the request by PWC was made by reference to that Act.
33 Section 23, on Freedom of information, completes the code. This provides:
“(1) Revenue and customs information relating to a person, the disclosure of which is prohibited by section 18(1), is exempt information by virtue of section 44(1)(a) of the Freedom of Information Act 2000 (prohibitions on disclosure) if its disclosure—
(a) would specify the identity of the person to whom the information relates, or
(b) would enable the identity of such a person to be deduced.
(2) Except as specified in subsection (1), information the disclosure of which is prohibited by section 18(1) is not exempt information for the purposes of section 44(1)(a) of the Freedom of Information Act 2000.
(3) In subsection (1) ‘revenue and customs information relating to a person’ has the same meaning as in section 19.”
34 Taking these provisions in the order that must be considered here:
(1) Section 44(1)(a) of FOIA provides that information is exempt information if its
disclosure, otherwise than under FOIA, is prohibited by or under any other enactment;
(2) Section 23(2) of CRCA provides that information, the disclosure of which is prohibited by section 18(1) of CRCA, is not exempt information for the purposes of section 44(1)(a) of FOIA except as specified in section 23(1);
(3) Section 23(1) provides that if the disclosure of information is prohibited information under section 18(1) of CRCA then it is also exempt information under section 44(1)(a) if its disclosure either specifies the identity of the person to whom the information relates or would enable the identity of that person to be deduced.
35 It is to be noted that the references in section 23(1) and (2) are to section 18(1), rather than to section 18 as a whole, while the reference in section 23(2) to section 19 is to the section as a whole rather than to section 19(2). That subsection contains the definition of “revenue and customs information relating to a person” to which section 23(3) refers.
36 The specific reference to section 18(1), and not to section 18 as a whole, is regarded by HMRC as intentional and as incorporating section 18(1) into section 23 without reference to the other parts of section 18. PwC contends that section 18(1) must be read subject to the rest of the section, and therefore the reference in section 23 must be to the whole of section 18. The Information Commissioner agreed with PwC on this issue. The importance of this disagreement lies in whether the consent of the taxpayer is relevant to the scope of the exemption under section 44. If section 18(1) is subject to section 18(2), then it is subject to the right of the taxpayer to consent to the request under section 18(2)(h). But if section 18(1) is not to be read for these purposes as subject to section 18(2), then consent is irrelevant.
37 In the view of this tribunal, the way in which section 23 refers to section 18(1) and not to section 18 as a whole, while it refers to section 19 as a whole rather than to section 19(2), introduces an ambiguity into section 23 that prevents the tribunal taking the view that there is only one clear interpretation of the section. It cannot be said that the drafter of the section was following any particular convention or drafting approach when referring in section 23 to the other sections as the drafting adopts no single approach. Indeed, the lack of clarity is emphasised by the fact that the reference to section 19 is wider than needed while, if PwC is right, the reference to section 18 is narrower than needed. In Allison v Information Commissioner and HMRC (EA/2007/0089) the Information Tribunal found:
“As a matter of statutory construction, therefore the Tribunal finds that in the absence of clear words which would expressly distance the operation of section 18(2) from section 18(1) such as to make section 18(1) a complete code in the way suggested, it is necessary to consider whether any of the exceptions in section 18(2) apply before an answer can be given to the question of whether disclosure is prohibited under section 18(1).”
That section 23 is ambiguous is in the view of this tribunal therefore confirmed by the different views taken about it in arguments to, and decisions of, the tribunal below: in Allison the tribunal accepted the construction now advanced by PwC, whereas in this case the FTT adopted HMRC’s interpretation.
38 This tribunal therefore rejects any argument that the language is clear. Rather, it must seek the proper interpretation with reference to the full context of the ambiguity and using the usual guides to resolving the ambiguity. It is not surprised, however, to note that despite the importance of the issue to taxpayers generally and to those engaged in tax matters, there is little authority on the point. This is in part because of the availability, in the usual case, of tax tribunal powers to require the production of relevant evidence and of powers available to taxpayers under the DPA. It is also because this ambiguity is not in FOIA itself but in referential legislation. It is specific to tax information only.
39 For PwC, Mr McDonnell argued that the information sought was fairly and squarely within the scope of the FOIA request. The tribunal accepts that for the purposes of this appeal. The appeal is treated as an issue of principle, and the tribunal does not seek to analyse the specific request in any way. It accepts that the target of the request is the release of information about HMRC policies and practices. It also accepts for the purposes of this appeal the general principle that taxpayers and their agents have good reason to seek information about the policies and practices used in the operation of any part of the tax laws. However, for whatever reason, that is not the approach PwC took in making this request. Instead, PwC took the approach of asking for information specific to named taxpayers.
40 PwC acknowledged that in taking this approach it was asking for information that was, or might be, in documents that disclosed personal details of the identified taxpayer. It took the view that this could be avoided by the use of redaction or blacklining. Mr McDonnell pointed out that this was the approach recommended by the Information Commissioner’s Office in its technical guidance note Dealing with subject access requests involving other people’s information (2006). In his view the same principles applied to this guidance about FOIA requests as to subject access data, the specific focus of the guidance. He also emphasised that the request was for information, not for documents. The information did not have to be contained in pre-existing documents to be within the request.
41 Mr McDonnell also argued that the complete refusal of HMRC to offer any information in response to the PwC request was also wrong. In the view of PwC it was scarcely credible that none of the relevant information held by HMRC was free of personal taxpayer details (with the consequence that it should be disclosed irrespective of our decision on the construction and consent issues).
42 In connection with that aspect of the response of HMRC, PwC was unable to comment on materials in the closed bundle. This tribunal did not hold a closed session as part of its hearing and did not have regard to anything in the closed bundle as it was not asked to do so by either party and saw no reason to do so in the context of this appeal. The tribunal therefore makes no comment on anything that might be found in the closed bundle put to the tribunal below.
43 Mr McDonnell’s main argument was focussed on the proper interpretation of the relevant law as it stood at the date of the request. It was his submission that the information sought by PwC in this application was not exempt information under section 44 of FOIA. The extent of the exemption is to be found by reference to sections 18, 19 and 23 of CRCA. Section 19 is important because section 23 parallels the form of section 19, so the two should be read together to derive their proper meanings in context. Section 23 looks to future publication of information while section 19 looks to past publication. The two sections reflect a common policy and the key to that policy is in section 19.
44 To see the full effect of the sections, information relevant to this appeal should be divided into two categories: information that is “revenue and customs information relating to a person” within the meaning of section 19(2) of CRCA such that a person could be identified and information that either did not relate to any specific person or did not allow any person to be identified. The second of those categories falls outside the scope of section 23(1) altogether. So does any information redacted so that it was no longer in the other category. Such information should be disclosed in any event. In this case the first category should also be disclosed because the taxpayer had consented to disclosure.
45 The position with regard to the disclosure with consent was clear. Section 44 of FOIA only excluded disclosure where another enactment provided for the exclusion. In this case, section 18(1), read with section 18(2)(h), and section 19 apply generally. They apply to all disclosures by HMRC.
46 So, in Mr McDonnell’s submission the position was that all the information requested was disclosable. Any information that did not specifically identify the taxpayer was disclosable in any event. Any information from which the identifying phrases were redacted came within the disclosable category once redacted. Any information that identified the taxpayer of its nature was disclosable with consent by the taxpayer, which had been given.
47 Miss Demetriou, for HMRC, agreed that the answer to the question before the tribunal was to be found in section 44 of FOIA read with sections 18 and 23 of CRCA.
She did not agree that section 19 and section 23 were to be read together in the way suggested by Mr McDonnell. In her submission section 18(1) was not to be read as subject to, or with, section 18(2) and the FTT had been right to take that view. Further, she submitted, even if section 18(2) was relevant, that did not make the appellant’s case. Section 18(2) did not create full exceptions to the general imperative of taxpayer confidence laid down in section 18(1). Rather, it gave HMRC discretion to release information within the specific and narrow exceptions listed in section 18(2) by removing the prohibition of section 18(1) backed by the criminal sanctions of section 19.
48 It is wrong to argue, as has been suggested, that section 23 simply reflected section 18 in the context of FOIA. It did not. The wording of section 23 made clear that it was section 18(1), and not section 18(2) or (3), to which reference was made. Further, section 23 is narrower than section 18. The prohibition imposed by section 18(1) is general:
“information which is held by the Revenue and Customs in connection with a function of the Revenue and Customs”.
The scope of section 23 is narrower:
“revenue and customs information relating to a person”.
Section 23(3) defines the latter phrase as having the same meaning as in section 19(2). The definition in section 19(2) clearly narrows the scope of that phrase compared with the general prohibition in section 18(1). Further, section 23(1) relates only to information disclosure of which either (a) would specify the identity of a person or (b) would enable that identity to be deduced.
49 That is consistent with the underlying policy of section 44. There is a clear framework imposing confidentiality in CRCA. Section 44 of FOIA is designed to reconcile the general approach of that Act to freedom of information with the separate approach to confidentiality that is central to CRCA and explains the criminal sanctions for its breach. Miss Demetriou further submitted that this policy was that put to Parliament when the relevant clause was put to the House of Commons (in Hansard, 26 January 2005, col 395) and endorsed by Parliament when section 23 was amended to add a new section 23(1A) by section 19 of the Borders, Citizenship and Immigration Act 2009 (the 2009 Act).
50 In her submission, the argument for PwC that it was asking for two classes of information was wrong. It was a fundamentally flawed approach in the request. PwC had not asked for any generic information. It had asked only for information about Mr H. So there was no general category of the kind advanced by Mr McDonnell either before or after redaction. Redaction was an irrelevance to the key issue.
51 HMRC had taken the view that it could not answer the request about information relating to Mr H in any way without revealing in so doing information about Mr H. Merely to state that it had information was to reveal “Revenue and Customs information relating to a person”. That was prohibited under section 18(1). HMRC was therefore correct in answering the request as it did.
52 The Information Commissioner, with our agreement, did not present oral argument to us. Instead the Commissioner relied on the argument presented to the First-tier Tribunal. In the view of the Commissioner, there was no general interest in pursuing the case further as the construction issue had been clarified for the future by section 19 of the 2009 Act.
53 Those submissions are reflected in the Information Commissioner’s decision. This was given in a decision notice dated 20 05 2009 under reference FS50220497. The Commissioner summarised his decision as follows:
“The Commissioner has investigated and found that the requested information, if held, would be exempt by virtue of section 44(1)(a) of the
Act. Further HMRC were correct to rely on section 44(2) to neither confirm nor deny if the requested information is held.”
54 The Commissioner found that the information, if held, would be within section 18(1) and section 23. But the Commissioner agreed with PwC, and did not agree with HMRC, that section 18(1) was to be read with section 18(2). His view on that was consistent with the recently expressed view of the Information Tribunal in Allison v Information Commissioner and HMRC (EA/2007/0089) (see paragraph 37 above).
55 The Commissioner therefore went on to consider if consent had been given.
56 This tribunal was also shown other decisions of the Information Commissioner. As they all raised the same essential issues as are raised in this appeal, the tribunal derived no additional assistance from them.
57 The FTT (Judge David Marks QC sitting with two members) understandably regarded the case as a complex one, the difficulties arising from the interaction of FOIA and CRCA. The heart of the problem was in the meaning to be attributed to “the disclosure of which is prohibited by section 18(1)” in section 23(1) of CRCA. There was a deep divergence of view before the tribunal between the Information Commissioner and HMRC about that phrase, and in particular whether or not section 18(1) was to be read with section 18(2). Further, it regarded that as the primary issue in the appeal. The other issue dividing the parties, that of consent, was a secondary issue.
58 The FTT recorded evidence of two official witnesses for HMRC. However, it did not find that this evidence assisted it in resolving the main issues in the appeal. As a result there are no relevant findings that affect this decision.
59 The FTT found that the FOIA and CRCA disclosure regimes were distinct. The FOIA system “reflects a general right subject to certain exemptions enjoyed by every person to have disclosed to the public all information legitimately disclosable within the terms of the request … irrespective of the requesting person’s interest in that information and irrespective of the subject matter of the information” (paragraph 50).
60 In its analysis of the issue, the FTT paid particular attention to the earlier decision in Allison. It quoted the view in Allison that “it is simply not possible to determine whether or not section 18(1) is engaged without reference to section 18(2)… (paragraph 57). But it noted that this was strictly not part of the ratio of the Allison appeal, and that in any event the FTT was not bound by the decision of the earlier tribunal in Allison. Further, that decision was given following consideration on paper only while the FTT in this appeal had the advantage of full argument from three parties.
61 The FTT then noted the legislative response to the Allison decision in section 19(4) of the 2009 Act (amending section 23 of CRCA). It was entirely satisfied that there was no relevant ambiguity that brought consideration of that subsequent measure into play. But it did accept that section 23 was itself ambiguous.
62 The FTT’s approach was to treat the case as based on, in effect, a fiction. PwC used the FOIA regime to engage in what was in effect a subject access request by Mr H himself (paragraph 65). In that context the FTT considered that to introduce the concept of consent, either under section 18(2)(h) of CRCA or under FOIA was to introduce an unwarranted complexity which was avoidable if the HMRC argument was correct.
63 The FTT concluded (at para 67):
“On the Appellant’s own admission despite its clear terms, the subject access request was used as a means of attempting to seek disclosure for the Appellant’s own professional benefit of certain tax insights and learning believed to be held by the Revenue regarding certain specific taxation issues. Whatever other means were open to the Appellant to seek such disclosure, the means in fact employed were inappropriate.”
64 This tribunal accepts that the starting point in this appeal is as stated by PwC. This is an FOIA request made by a third party. The third party had a genuine concern, as would all similarly placed tax advisers and taxpayers, in the way HMRC was considering particularly difficult tax questions. PwC did not however ask for HMRC disclosure of all relevant policy documents about the issues. Instead, it identified a particular taxpayer, Mr H, that it had reason to believe was in discussions with HMRC about matters involving the issues and used him as the focus of the request.
65 That choice of approach, the tribunal accepts from Mr McDonnell, was intended to provide a route by which the disclosure of the material wanted by PwC could be identified by HMRC more easily. However, the actual request made under FOIA was extremely broad – what is often termed a “fishing expedition” in tax terminology. It would not be too far wide of the mark to say that it was a request, within a set period, to disclose everything HMRC had thought about or discussed with some reference to Mr H during that period.
66 Behind that lay a point of considerable importance, as Miss Demetriou rightly stressed. If HMRC was bound not to disclose information about Mr H, then it was bound not to disclose that it had considered him at all. As this tribunal noted at the start of this decision, the request suggested strongly that Mr H was in discussion with HMRC about several specific issues, some of which involved another identified taxpayer. If HMRC had given any positive reply, it would have been identifying on the public record that it was discussing these matters with Mr H and perhaps also with the other taxpayer. Even a reply so redacted as to leave large parts of the reply blank would still be an indication of those discussions and therefore was of itself information about Mr H.
67 This point should, in this tribunal’s view, be seen against the context of a tax system that has been, as the parties jointly reminded the tribunal, one of self-assessment for over a decade. As all taxpayers now know, it is the duty of a taxpayer to make a self-assessment return for income tax if any return is needed. That does not involve HMRC in doing anything, and in many cases HMRC merely accepts the return subject to basic arithmetical and similar checks. In such cases, therefore, a disclosure request such as the one in this case, would produce nothing that was not already known to the taxpayer. So a reply by HMRC stating that it had documents involving a particular taxpayer of which the taxpayer was not author or recipient would of itself be an admission to a third party that it had – to use what is intended as a neutral word – issues with that taxpayer’s returns.
68 The tribunal has indicated above that it regards section 23, when read with section 18 and section 19, as ambiguous. It is, in the view of the tribunal, entirely possible to adopt either the HMRC reading of section 23 as referring only to section 18(1) and the PwC reading of section 23 as referring not only to section 18(1) but with it section 18(2). (The latter argument involves reading in section 18(3) and (4) as well.)
69 The solution to the ambiguity must be found in the context of the group of sections of which these are part – the sections from 17 to 23, with the usual interpretative aids. However, the tribunal finds only limited assistance in both the Parliamentary record behind the sections (in so far as the parties referred to it) and the subsequent amendment of section 23 by the 2009 Act. As the arguments of both Mr McDonnell and Miss Demetriou made clear, that latter point can be read two ways itself. It could be regarded as correcting what Parliament realised was an earlier error or omission, or it could be regarded as declaratory. The one point this tribunal accepts is that Parliament clearly considered it an important provision as it found room for it in an Act which had its main focus elsewhere. The significance of the amendment is to emphasise the distinction between the approach to the release of information by HMRC and the approach of the FOIA regime. This tribunal does not regard that approach as having changed.
70 The pattern of the information sections in CRCA was not changed by the amendment by the 2009 Act. CRCA brought about the merger of HM Customs and Excise with the Inland Revenue. Before the merger the two tax authorities had in many ways radically different approaches to their task of tax collection in part caused by major differences in their powers. As with any tax authority, the acquisition and interpretation of information was central to those powers. Section 17 of CRCA removes the barriers that previously existed between and within the former tax authorities. It allows the assembly and deployment of a formidable amount of information about any taxable asset or activity of anyone who is or may be a taxpayer. So it was important for Parliament to ensure that such information stayed confidential for both privacy and commercial reasons. That was achieved by sections 18 (confidentiality), 19 (wrongful disclosure), 22 (data protection &c) and 23 (freedom of information). Sections 20 and 21 made specific provision for limited exceptions to that regime, as reflected in section 18(2)(b).
71 Section 22 is of importance in this context, though little was said about it in this appeal. It ensures that CRCA is read subject to the restrictions of both the DPA and Part I of the Regulation of Investigatory Powers Act 2000. So nothing in section 18 can remove the restrictions in either Act. In that context, the tribunal considers that the provisions in section 23 should be read narrowly. They should only provide additional access to the information held by HMRC if that is a necessary reading of the section. The same approach should be adopted to the exceptions in section 18(2) and (3) to section 18(1).
72 Approached in that way, the tribunal considers that it is proper to read section 23(1) literally. When it states that it provides an exception to section 18(1) it means precisely that, not section 18 as a whole. But when it refers to section 19 it means that, not section 19(2). So the meaning of section 19(2) can be read in the full context of that section. The meaning of section 18(1) should be read by itself.
73 The tribunal finds that approach is reinforced by a fuller examination of section 18(2), something that did not form a significant part of the arguments either before it or below. Section 18(2)(a) permits HMRC to disclose information for the purposes of an HMRC function. This authorises the considerable guidance to taxpayers published by HMRC. It is a power not a duty. But it is not a general power. It must be read subject to the DPA. Section 18(2)(b) is a drafting link as it makes the section subject to sections 20 and 21. Sections 18(2)(c) to (g) enabled release of information to courts and the police. (Section 18(3) also, so far as relevant, provides indirectly for release of information to tribunals.) Section 18(2)(h) (consent) is an entirely different kind of exception, and that is considered separately below.
74 Can section 18(1) be read in isolation from the rest of the section? It is central to the argument for PwC and those taking the same approach that the section cannot be severed. That is the approach taken, for example, by the tribunal in Allison. This tribunal does not accept that argument. Perhaps the strongest argument for the non-severability was one not deployed before the tribunal. It is that section 18(1) must be read with section 18(4). If so, why is it not to be read with section 18(2) and (3)? The tribunal heard no argument on this point, suggesting that it was not regarded as a major issue by those contending for the wider approach. And, without the benefit of argument, it does not consider that this is an insuperable argument. Section 18(1) is a definitive statement prohibiting disclosure. Nothing in section 18(4) detracts from that. If anything, it broadens it.
75 Nor does the tribunal consider that anything in section 19 requires a different reading of section 23. It agrees with Miss Demetriou that they are not to be regarded, as Mr McDonnell argued, as two sides of the same proposition. Section 19(1) expressly makes it an offence to divulge information about an identified or identifiable person “if he contravenes section 18(1)”. The defence to a charge under that section is that the individual reasonably believed, in part, that the disclosure was lawful (section 19(2)). A disclosure would arguably be lawful under section 19(2) if it was a disclosure under one of the exceptions listed in section 18(2) or (3). But section 19(2) is not drafted in those terms. Here again, the tribunal considers, the drafting of the reference to section 18 was deliberately confined to section 18(1).
76 The tribunal therefore considers that the narrower literal interpretation of section 23(1) is consistent with the drafting of sections 17 to 23 read together as a whole, and is also consistent with the underlying philosophy enacted by those sections read as a whole. Put another way, it does not regard the reference in section 23 to section 18(1) as a drafting error or omission.
77 More broadly, this reading is in the tribunal’s view one that keeps the FOIA regime and the CRCA regime clearly separate. The CRCA regime is made expressly subject to the separate regime under the DPA: see section 22, the effect of which is that nothing in sections 17 to 21 can authorise the making of a disclosure which contravenes the 1998 Act. HMRC initially reacted to this request as made under that Act, which deals with applications made by data subjects. It follows that section 18(1) does not have to be read subject to section 18(2) to allow a taxpayer access to his or her information.
78 The tribunal’s conclusion is that section 23(1) should be read with section 18(1), not section 18 as a whole, and that the exceptions in section 18(2) and (3) are not relevant to section 23.
79 It follows that the tribunal agrees with HMRC that the only proper response to this request was to refuse to provide any answer at all. Only by taking that approach could HMRC ensure that it was not disclosing that it had dealings of any sort with the identified taxpayer.
The consent issue: had Mr H given valid consent?
The context in which the issue of consent arises
80 Notwithstanding our decision on the construction issue, we think it appropriate (in case we are found on any appeal to have been wrong) to consider the question of whether such consent as Mr H gave for the disclosure of the relevant information was effective to remove the prohibition against disclosure under CRCA section 18(1) (and hence disapply the exemption of the information under section 44 of FOIA).
81 It would have been possible for PwC to have asked for the information on behalf of its client, Mr H. That would have brought into play section 40(1) of FOIA, which reads:
“Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.”
The effect of that provision is that a request to a public authority by an individual seeking his or her own personal information falls to be considered under DPA and not under FOIA. In the context of this case, the effect of the extensive rights given to an individual under section 7 of DPA would have been to give Mr H the right to require HMRC to disclose to him, through PwC as his agent, all the personal data on him that it held.
82 Questions might have arisen, in the context of a DPA request, as to whether all the information falling within the scope of the information request constituted Mr H’s personal data. It is conceivable that the language of the information request was sufficiently broad that it encompassed material such as policy statements or generic technical guidance which, although on Mr H’s file at HMRC, did not have the necessary connection to him to constitute his personal data. But, subject to any considerations of that nature, Mr H would have been in a position to enforce disclosure of all the personal data HMRC held on him had his advisers proceeded by the DPA route. However, Mr H and his advisers very clearly took a decision not to do so. PwC made it clear in its grounds of appeal to this tribunal that it had “its own genuine and substantial interest in the subject matter of [the information request]”, albeit that the request was made with Mr H’s consent. The same point was made, with equal clarity, in the course of correspondence during the Information Commissioner’s investigation and in the submissions to us.
83 It is clear, therefore, that the information request was deliberately constructed as one made by the requester, PwC, in respect of information about a third party, Mr H.
84 To the extent that information falling within the scope of a FOIA request for information constitutes or includes the personal data of an individual other than the requester, section 40(2) of FOIA has the effect that the information is exempt from the relevant public authority’s disclosure obligation if disclosure would contravene the data protection principles set out in Schedule 1 to DPA. Those principles will not be contravened if consent to disclosure is given by the individual whose data has been requested. However, just as PwC has very clearly and deliberately not sought to rely on section 40(1) of FOIA, so HMRC has, equally clearly and deliberately, not sought to rely on section 40(2). It has based its refusal to disclose solely on section 44 of FOIA.
85 In the course of correspondence HMRC offered to make a discretionary disclosure to PwC outside the scope of FOIA. The effect would have been that HMRC would have avoided the consequences of a FOIA request – the imposition of an obligation to disclose all the information requested – but would not have felt obliged to require Mr H to consent to disclosure to the world, as opposed to just PwC. The offer was rejected. The consequence was that PwC retained its claim to have all information disclosed, not just a selection determined by HMRC, but could not avoid the challenge as to the scope of the consent Mr H was required to provide.
The consents to disclosure given by Mr H
86 There is no dispute as to the basic facts. Mr H provided a form of consent on three occasions. (Although these are referred to as “consents”, this is at this stage simply for convenience, but without prejudging whether any one or more meets the requirements of a valid consent for the purposes of section 18(2)(h) in this case).
87 Mr H’s first consent was in the form of a copy of HMRC’s standard consent, Form 64-8, which Mr H had completed when appointing PwC as his nominated agent. Form 64-8 is in daily use, whether by accountants and other professional advisers or family members or friends advising or otherwise assisting a taxpayer. As Form 64-8 states: “This authority allows us to exchange and disclose information about you with your agent and to deal with them on matters within the responsibility of HM Revenue & Customs (HMRC), as specified on this form”. However, although it includes this express authorisation to HMRC to disclose information to the agent it makes no express reference to FOIA.
88 A second consent was given to PwC by telephone shortly before the FOIA request was submitted on 22 September 2008. The consent was given in response to an e-mail to Mr H from PwC in which they sought his instructions to make an FOIA request for HMRC’s internal correspondence on his case. The e-mail did not include any warning by PwC that the effect of an FOIA disclosure would be that the disclosed information would thereafter be available to any other member of the public who requested it. The reason for that is that PwC considered then, and has continued to argue in this appeal, that this would not be the consequence.
89 Mr H’s third consent was in the form of a specific written consent to the disclosure to PwC of the material in the FOIA request. That document read simply as follows:
“FOI Consent Form
I [Mr H] of ... am aware that PwC has made an application to HMRC under the Freedom of Information Act for information relating to me and I consent to disclosure of this information to PwC.”
Mr H signed the form on 13 11 2008. It was then forwarded to HMRC by PwC on 17 11 2008, some days before HMRC completed its internal review of its original refusal to release the requested information.
The First-tier Tribunal’s decision
90 The FTT accepted the submissions of the Information Commissioner and HMRC to the effect that two criteria had to be satisfied in order for there to be a valid consent under section 18(2)(h) for the purposes of a request that was effective to disengage section 44 (at paragraph 74):
“First, the law on guidance as to consent as to disclosure of personal data must be respected and secondly, there must be a clear and unequivocal consent to the particular disclosure in question.”
91 The FTT accepted the argument put by both the Information Commissioner and HMRC that the consent in place in the present case failed to satisfy the requirements of FOIA as it was not “freely and fully informed” (at paragraph 72). Further, the FTT concluded as follows (“the Appellant”, of course, refers to PwC, and not to Mr H):
“73. The Tribunal considers that, even if it were possible to make a FOIA-related disclosure under section 18(2)(h), there would be a very high threshold regarding the degree and type of informed consent required. The Tribunal finds that it was clear from the brief evidence of Ms Jane Thomson (a tax adviser to the Appellant) that she did not realise the effect of FOIA disclosure would be to place the Appellant’s client’s tax affairs in a category of information that would be disclosable to anyone who chose to ask for it. The Appellant maintained throughout the hearing, as well as in its further written submissions, that information relating to Mr H which was disclosed to it would remain confidential under the Appellant’s professional rules and obligations. As already indicated above this ignores the way in which FOIA works which is to characterise information as either generally disclosable or not disclosable, in the latter case because it is subject to an exemption. Mr H did not provide a signed consent which recognised that the effect of a successful FOIA application would be to strip his information of all confidentiality, in the event that any other person made a request for the very same information. This is perhaps not surprising, as this point was in the Tribunal’s judgment, clearly not understood by the Appellant.”
The submissions for PwC
92 PwC’s case was that each of the three separate consents was sufficient to open the door to disclosure in accordance with section 18(2)(h). As to the first, it was HMRC’s universal practice to accept a Form 64-8 as a valid consent by the taxpayer for the purposes of sections 18 to 23 of CRCA to the disclosure to his named agent of any “Revenue and Customs information” relating to himself. As to the second and third – and we think they can be taken together – they represented an explicit consent to disclosure by HMRC to PWC for the purposes of the FOIA request, the third using an express form of words which HMRC had previously indicated would be acceptable to it.
93 Furthermore, Mr McDonnell submitted, it was sufficient that Mr H had consented to disclosure by HMRC to PwC alone rather than to the whole world. In his submission an effective consent to disclose to just the requester may be sufficient to remove the prohibition under CRCA section 18 (so that the information ceases to be exempt under FOIA section 44). Accordingly, PwC says, there is no need for the consent to be a disclosure to the whole world and no reason to enquire whether a consent which might be said to have that effect had been given on a fully informed basis. There were essentially three arguments advanced to support this analysis. First, the word “consent” in section 18(2)(h) of CRCA was only capable of bearing one meaning, namely a simple consent as routinely used on a daily basis on Form 64-8. Second, section 1 of FOIA only requires the relevant disclosure to be made “to him”, namely the particular requester, and does not necessarily involve publication to the world at large. Third, PwC’s professional code of ethics and contractual relationship with Mr H were both such that PwC was bound to keep the information in question confidential.
94 Thus before this tribunal PwC criticised the FTT for having decided that the consent provided by PwC did not recognise that the effect of a successful FOIA application would be to strip the information of all confidentiality and that the consent given was therefore not sufficient. PwC accepted that it was not open to a public authority (or the Information Commissioner on investigation of a complaint, or the FTT on appeal from him) to impose on a requester a condition restricting the further dissemination of information disclosed to him or her pursuant to a FOIA request. It conceded that, as a consequence, FOIA requests must be assessed without reference to the requester’s personal motives for seeking the information in question. It also conceded that in some circumstances, when considering whether disclosure would prejudice particular interests and/or when balancing public interests in favour and against disclosure, it is appropriate, and necessary, to consider the impact of disclosure to the world, not just to the individual requester. However PwC argued that it did not necessarily follow that disclosure to the world is the automatic consequence in all circumstances.
95 So, whereas disclosure in favour of, for example, a journalist would clearly be equivalent to disclosure to the world, that would not be the case where the requester was either already subject to confidentiality restrictions (such as the professional obligation of confidentiality stated before us as imposed on PwC) or offered to enter into an appropriate undertaking having the same effect. It relied, too, on the decision of the Information Tribunal in S v ICO and the General Register Office (EA/2006/0030). In that case the disclosure of information had been resisted because, it was claimed, it had been obtained by the public authority from a third party and its disclosure would constitute a breach of confidence actionable by the person who had originally provided it. The exemption provided by section 41 of FOIA was therefore said to apply. PwC argued that, as no question had been raised in that case of the information provider being asked to consent to disclosure to the whole world, it was clear that it was only disclosure to the person requesting the information that was under consideration.
The submissions for HMRC
96 Miss Demetriou submitted that neither the express FOIA consent (whether by telephone or in its written form) nor Form 64-8 had the effect claimed by Mr McDonnell. No significant point was taken as to the timing of Mr H’s consent, although the FOIA-specific consent had not been known to HMRC at the time that the request had been made. The third form of consent had been provided after HMRC had made it clear in correspondence that it was considering disclosure under the DPA or on a discretionary basis under CRCA, but not under FOIA. The main thrust of HMRC’s case was that the consent, whenever given, did not cover the disclosure of the requested information to the world at large, but only to PwC. It said that a consent restricted in that way may be adequate when a discretionary disclosure has been agreed to, but does not suffice when the request has been made under the compulsory disclosure process under FOIA. Disclosure through that process necessarily amounts to disclosure to the world, not just the requester. It is clear from the terms of the consents that none includes express approval for disclosure to anyone other than PwC.
97 HMRC also focused on the fact that section 1 of FOIA entitles “any person” to request information. It said that this means that there can be no limit to the categories of people who are entitled to have the information once it has been disclosed in response to a request. It conceded that this consequence of a successful information request was not stated in express terms in FOIA and that, although public authority publishing schemes will frequently include information released in response to an individual request, there is no express statutory rule to that effect. Nevertheless, it argued that, once released, the information loses its confidentiality and must be treated as being freely available to anyone else who seeks it. It said that this was because the consent referred to in CRCA section 18(2)(h) had to be considered in the context of the particular disclosure in question. Where it was to be disclosure under section 1 of FOIA, there must be consent to the form of public disclosure that follows from the operation of that provision.
The submissions for the Information Commissioner
98 In his written submissions, the Information Commissioner argued that for a consent to disclosure of information covered by CRCA to be valid for the purpose of disengaging the absolute exemption from disclosure under section 44 of FOIA, the legal principles governing the disclosure of personal data must be respected. There had to be a clear and unequivocal consent to the particular disclosure in question. In this case, in the Information Commissioner’s view, agreeing with HMRC, was that there was no such valid consent for the purposes of section 18(2)(h) present at the date of the request.
The Upper Tribunal’s conclusions on the consent issue
99 FOIA is “An Act to make provision for the disclosure of information held by public authorities …”. Its whole purpose is to create more open government by providing the public with access to information that would previously have been kept secret. The mechanism by which that purpose is achieved is by the creation (in section 1 of FOIA) of an entitlement for “any person” to have information held by a public authority communicated to him or her. FOIA contains no explicit right for a public authority to impose on a person requesting information a restriction on the publication or use of any information it discloses pursuant to an information request – indeed, such a stipulation would undermine the very premise of the legislation.
100 We accept that once a public authority has either decided to disclose particular information to a requester, or has been ordered to do so, it is unlikely that it will be able to resist a second or subsequent request for the same information. In most cases the arguments for imposing the obligation to disclose will be exactly the same. And by then the original requester may well have released at least some of the information into the public domain. It follows that, when considering whether the disclosure obligation should be ignored because disclosure would give rise to a particular detriment (to engage one of the prejudice-based exemptions set out in FOIA), it must be assumed that the recipient of the information will exercise his or her freedom to disclose it to the world at large. The same assumption will need to be made where, after it has been determined that a qualified exemption is engaged, disclosure will depend on whether the public interest in maintaining the exemption outweighs the public interest in disclosure (see section 2(2)(b) of FOIA).
101 It does not follow, however, that it must always be assumed that every disclosure in response to a FOIA request must automatically be treated as a disclosure to the world at large. That will be the most usual result in cases turning on the interplay between, on the one hand, the obligation to disclose, and, on the other, the recognition that some categories of information may not be suitable for disclosure. But section 44 of FOIA creates a different test. It is not based on those broad freedom of information principles but provides, in effect, that they do not arise where another statute overrides them by imposing a prohibition on disclosure. In those circumstances, the outcome of an information request falls to be determined solely on the interpretation of the relevant provisions of that other statute. Care must be taken not to imply into them freedom of information criteria that were not or may not have been under consideration at the time when the legislation was enacted (see Secretary of State for the Home Office v BUAV [2008] EWHC 892 (QB)).
102 We reach those conclusions because of our analysis of the overall statutory purpose and framework. We did not find that S v ICO and the General Register Office provided quite the support that Mr McDonnell sought. True, in that case, and in the context of section 41 of FOIA, it was only disclosure to the person requesting the information that was under consideration. However, that suggestion is qualified somewhat by the statement at paragraph 19 of the Information Tribunal’s decision:
“It is clear that the motive for requesting the disputed information is that the
Appellant feels that the Informant was not entitled and should not have
been permitted to register the death and other related matters. FOIA is,
however, applicant and motive blind. It is about disclosure to the public,
and public interests. It is not about specified individuals or private interests.”
103 With the general principles we have set out above in mind, we turn to consider the particular forms of consent relied upon in the present case.
104 We acknowledge that the FOIA-specific written consent was provided by PwC to HMRC in the course of an exchange of correspondence in which HMRC made it clear that it was prepared to consent to disclosure under the DPA, or on a discretionary basis under CRCA, but not under FOIA. Both parties also accept that it was for disclosure to PwC alone. However, to be effective, all the consent needed to have addressed was the particular disclosure for which approval was being sought. The fact that HMRC believes that it was not possible to limit disclosure in this way, because the request was expressed to have been made under FOIA, does not alter the fact that this was how it was clearly expressed and that it was Mr H’s intention that this should have been its effect.
105 In these circumstances it is clear in our judgment that, viewing section 18 of CRCA on its own, and without imposing on it an overlay of freedom of information considerations, the disclosure would not have been prohibited. It follows, on that basis, that if we are wrong on the construction point in the present case, the information will not be exempt if the effect of Mr H’s consent is that disclosure would not have been prohibited under section 18(1) of CRCA. Accordingly, and again on that basis, the information was not exempt under section 44 of FOIA. It is important to recall that the precise wording of section 44, is that “information is exempt information if its disclosure (otherwise than under this Act) by the public authority holding it (a) is prohibited by or under any enactment”.
106 We acknowledge Miss Demetriou’s point that, even if one of the section 18(2) exceptions applies, including consent in section 18(2)(h), all that means is that the statutory prohibition on disclosure in section 18(1), backed up by the criminal sanctions in section 19, is removed. The effect of that under CRCA is that HMRC then has a discretion to exercise to determine whether, in all the circumstances of the case, and bearing in mind its duty to protect taxpayer confidentiality, disclosure is appropriate. To that extent a valid consent under section 18(2)(h) of CRCA is not by itself a key which automatically unlocks the HMRC safe and allows access to the confidential contents held therein. However, FOIA in effect provides a master key – the question under section 44 is not whether disclosure is required under any enactment, but rather whether it is prohibited.
107 The result of our conclusion on this point is that this is a case where disclosure pursuant to a FOIA information request would not make the information available to anyone else who requested it. It does not have the effect of releasing the information into the public domain. It is not right to say, as HMRC does, that the outcome is wrong because it is inconsistent with the principles underlying FOIA (although it certainly has the effect, on the facts of this particular case, of enabling PwC to make a FOIA request without imposing on Mr H the consequences that would normally apply). The reality is that FOIA itself suspends the application of those principles when ceding responsibility for determining an information request to another statute which does not incorporate them.
108 The practical outcome is that if a second request for the same information is received by HMRC from a third party then it may not assume from the outcome of this case that it is free from its obligations under section 18 of CRCA. It will have to ask itself the same question as it did in this case, namely, whether disclosure would breach that provision. That will almost certainly lead it to seek consent from Mr H. It would then be for him to decide whether to consent to the terms of the particular request presented to him. It may be assumed that, the requester on that future occasion not being his tax adviser, he will refuse. Disclosure would then be prohibited and the section 44 exemption engaged under FOIA in respect of that request. But in the unlikely event that Mr H gave his consent in favour of a requester who was not subject to the professional obligation of confidence owed to him by PwC then that would effectively be a consent to public disclosure.
109 We have our doubts as to whether the outcome reached in this decision is one which would have been foreseen by the drafters of either FOIA or CRCA. However, it is the logical consequence of the clash between the respective starting points and cultures of FOIA and CRCA. The FOIA principle is that information should be disclosed unless it should not be disclosed. The CRCA principle is that no information should be disclosed unless it may be disclosed. Section 44 of FOIA therefore poses the question as to whether there is a prohibition on disclosure in the other statute. The effect of a valid CRCA consent under section 18(2)(h) – again, we emphasise, assuming that we are wrong on the construction issue – is that that particular disclosure is not prohibited. The result of the interaction of the two codes is that what is a discretionary power to disclose vested in HMRC by CRCA becomes a duty under FOIA to disclose. We also stress that our conclusions might not have led to disclosure if HMRC had relied on other FOIA exemptions that were conceivably available to it.
110 We reach the conclusions above on the basis of consents two and three above. We are much less sure that Form 64-8 has the effect claimed for it by Mr McDonnell. Such a form will undoubtedly often act as a valid consent for the purposes of section 18(2)(h). However, context is everything.
111 Miss Demetriou submitted that Form 64-8 is a document drafted for specific purposes and is not designed or intended for use in relation to FOIA requests. Certainly, the declaration signed by the taxpayer, authorising HMRC to disclose information to the relevant agent, is in the following terms:
“I agree that the nominated agent has agreed to act on my/our behalf, and the information is correct and complete. The authorisation is limited to the matters shown on the right-hand side of this form.”
Those matters (on the right hand side of the form) are: (i) individual/partnership/trust tax affairs; (ii) tax credits; (iii) corporation tax; and (iv) VAT. The four boxes do not all need to be ticked, and different boxes can be ticked for different agents. This shows that Form 64-8 is not a general consent, but rather a focussed consent for specific purposes. Moreover the reverse of Form 64-8 states:
“This authority does not allow your agent to request personal information held about you under the subject access provisions of the Data Protection Act 1998.”
112 Although initially attracted by Miss Demetriou’s submissions on this point, we were not persuaded by them. They are premised on the assumption that the consent has to be a consent to a FOIA disclosure. However, as explained above, the effect of section 44 of FOIA is simply to ask whether disclosure is prohibited by section 18 of CRCA. The consent only needs to be effective for the purposes of section 18(2)(h).
113 However, Form 64-8 is by its terms expressly confined to authorising the exchange and disclosure by HMRC of information held by it “about you” to the nominated agent. Thus it allows the accountant or other agent to receive information from HMRC, and impart information to HMRC, about e.g. a taxpayer’s own tax affairs, or a parent to act in a similar capacity for a daughter or son on a gap year abroad. In that contest it seems to us that it is ill-suited as a vehicle for providing the authority for the disclosure of broader policy material held by HMRC which will not be “about you” in the day-to-day operational sense intended by Form 64-8. Indeed, as Mr McDonnell candidly admitted, PWC was only interested in the wider policy information – it was not interested in Mr H’s personal data for the very reason that it already had access to such information.
Conclusion
114 The tribunal agrees with HMRC on the construction issue. For that reason the appeal is dismissed. It is therefore not necessary for us to determine the consent issue. Nonetheless, as the matter was argued fully and ably both here and below, the tribunal has indicated its view were it to be found to be wrong in law on the construction issue. If the question of consent were to become relevant, then the tribunal indicates that it would have agreed with PwC in the outcome although not with the full PwC argument.
115 Neither of these issue deals directly with a third line of argument advanced by Mr McDonnell. This was that HMRC should have redacted from the requested information any confidential taxpayer information that it thought it should withhold in order to comply with CRCA section 18. As indicated in paragraph 79 above, we consider that the context of the request itself, which focuses only on information relating to Mr H, has the effect that any specific disclosure in response to it, even in redacted format, might still fall within the CRCA section 18(1) prohibition. Therefore the view of this tribunal is that HMRC took the correct decision in refusing to reply to the request by refusing to confirm or deny that it had any relevant information.
116 For these reasons, the tribunal has not considered the actual request made by PwC in detail. The issue of redaction does not arise. Had the specific terms of the request been relevant, the tribunal would have had to consider whether, and to what extent, the information sought by PwC was information about Mr H. It is arguable that, in relying heavily on the issue of redaction in his argument, Mr McDonnell presented the request in a way that suggested that some of the information sought was not about Mr H at all. If so, it was not a request for information about him. For reasons apparent in the detailed application (though not in this decision), we would also have had to consider whether the consent of any other person was necessary for a full disclosure of the information sought in the request and if so whether that consent had been given. A definitive determination of those issues would require close examination of the documents falling within the wide scope of the information request. Although those exercises may have to be carried out, (should it be decided on appeal from this decision that we are wrong on the construction issue but right on the consent issue), it is not necessary or appropriate for us to consider them at this stage.
Appendix
Relevant legislation
Freedom of Information Act 2000
1 General right of access to information held by public authorities
(1)Any person making a request for information to a public authority is entitled—
(a)to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b)if that is the case, to have that information communicated to him.
(2)Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.
(3)Where a public authority—
(a)reasonably requires further information in order to identify and locate the information requested, and
(b)has informed the applicant of that requirement,
the authority is not obliged to comply with subsection (1) unless it is supplied with that further information.
(4)The information—
(a)in respect of which the applicant is to be informed under subsection (1)(a), or
(b)which is to be communicated under subsection (1)(b),
is the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request.
(5)A public authority is to be taken to have complied with subsection (1)(a) in relation to any information if it has communicated the information to the applicant in accordance with subsection (1)(b).
(6)In this Act, the duty of a public authority to comply with subsection (1)(a) is referred to as “the duty to confirm or deny”.
40 Personal information
(1)Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2)Any information to which a request for information relates is also exempt information if—
(a)it constitutes personal data which do not fall within subsection (1), and
(b)either the first or the second condition below is satisfied.
(3)The first condition is—
(a)in a case where the information falls within any of paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene—
(i)any of the data protection principles, or
(ii)section 10 of that Act (right to prevent processing likely to cause damage or distress), and
(b)in any other case, that the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
(4)The second condition is that by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1)(c) of that Act (data subject’s right of access to personal data).
(5)The duty to confirm or deny—
(a)does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1), and
(b)does not arise in relation to other information if or to the extent that either—
(i)the giving to a member of the public of the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene any of the data protection principles or section 10 of the Data Protection Act 1998 or would do so if the exemptions in section 33A(1) of that Act were disregarded, or
(ii)by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1)(a) of that Act (data subject’s right to be informed whether personal data being processed).
(6)In determining for the purposes of this section whether anything done before 24th October 2007 would contravene any of the data protection principles, the exemptions in Part III of Schedule 8 to the Data Protection Act 1998 shall be disregarded.
(7)In this section—
“the data protection principles” means the principles set out in Part I of Schedule 1 to the Data Protection Act 1998, as read subject to Part II of that Schedule and section 27(1) of that Act;
“data subject” has the same meaning as in section 1(1) of that Act;
“personal data” has the same meaning as in section 1(1) of that Act.
44 Prohibitions on disclosure
(1) Information is exempt information if its disclosure (otherwise than under this Act) by the public authority holding it –
(a) is prohibited by or under any enactment,
(b) is incompatible with any community obligation, or
(c) would constitute or be punishable as a contempt of court.
(2) The duty to confirm or deny does not arise if the confirmation or denial to be given to comply with section 1(1)(a) would (apart from this Act) fall within any of paragraphs (a) to (c) of subsection 91).
Commissioners for Revenue and Customs Act 2005
Information
17 Use of information
(1) Information acquired by the Revenue and Customs in connection with a
function may be used by them in connection with any other function.
(2) Subsection (1) is subject to any provision which restricts or prohibits the use of
information and which is contained in—
(a) this Act,
(b) any other enactment, or
(c) an international or other agreement to which the United Kingdom or
Her Majesty’s Government is party.
(3) In subsection (1) “the Revenue and Customs” means—
(a) the Commissioners,
(b) an officer of Revenue and Customs,
(c) a person acting on behalf of the Commissioners or an officer of Revenue
and Customs,
(d) a committee established by the Commissioners,
(e) a member of a committee established by the Commissioners,
(f) the Commissioners of Inland Revenue (or any committee or staff of
theirs or anyone acting on their behalf),
(g) the Commissioners of Customs and Excise (or any committee or staff of
theirs or anyone acting on their behalf), and
(h) a person specified in section 6(2) or 7(3).
(4) In subsection (1) “function” means a function of any of the persons listed in
subsection (3).
(5) In subsection (2) the reference to an enactment does not include—
(a) an Act of the Scottish Parliament or an instrument made under such an
Act, or
(b) an Act of the Northern Ireland Assembly or an instrument made under
such an Act.
(6) Part 2 of Schedule 2 (which makes provision about the supply and other use of
information in specified circumstances) shall have effect.
18 Confidentiality
(1) Revenue and Customs officials may not disclose information which is held by
the Revenue and Customs in connection with a function of the Revenue and
Customs.
(2) But subsection (1) does not apply to a disclosure—
(a) which—
(i) is made for the purposes of a function of the Revenue and
Customs, and
(ii) does not contravene any restriction imposed by the
Commissioners,
(b) which is made in accordance with section 20 or 21,
(c) which is made for the purposes of civil proceedings (whether or not
within the United Kingdom) relating to a matter in respect of which the
Revenue and Customs have functions,
(d) which is made for the purposes of a criminal investigation or criminal
proceedings (whether or not within the United Kingdom) relating to a
matter in respect of which the Revenue and Customs have functions,
(e) which is made in pursuance of an order of a court,
(f) which is made to Her Majesty’s Inspectors of Constabulary, the Scottish
inspectors or the Northern Ireland inspectors for the purpose of an
inspection by virtue of section 27,
(g) which is made to the Independent Police Complaints Commission, or a
person acting on its behalf, for the purpose of the exercise of a function
by virtue of section 28, or
(h) which is made with the consent of each person to whom the
information relates.
(3) Subsection (1) is subject to any other enactment permitting disclosure.
(4) In this section—
(a) a reference to Revenue and Customs officials is a reference to any
person who is or was—
(i) a Commissioner,
(ii) an officer of Revenue and Customs,
(iii) a person acting on behalf of the Commissioners or an officer of
Revenue and Customs, or
(iv) a member of a committee established by the Commissioners,
(b) a reference to the Revenue and Customs has the same meaning as in
section 17,
(c) a reference to a function of the Revenue and Customs is a reference to
a function of—
(i) the Commissioners, or
(ii) an officer of Revenue and Customs,
(d) a reference to the Scottish inspectors or the Northern Ireland inspectors
has the same meaning as in section 27, and
(e) a reference to an enactment does not include—
(i) an Act of the Scottish Parliament or an instrument made under
such an Act, or
(ii) an Act of the Northern Ireland Assembly or an instrument
made under such an Act.
19 Wrongful disclosure
(1) A person commits an offence if he contravenes section 18(1) or 20(9) by
disclosing revenue and customs information relating to a person whose
identity—
(a) is specified in the disclosure, or
(b) can be deduced from it.
(2) In subsection (1) “revenue and customs information relating to a person”
means information about, acquired as a result of, or held in connection with the
exercise of a function of the Revenue and Customs (within the meaning given
by section 18(4)(c)) in respect of the person; but it does not include information
about internal administrative arrangements of Her Majesty’s Revenue and
Customs (whether relating to Commissioners, officers or others).
(3) It is a defence for a person charged with an offence under this section of
disclosing information to prove that he reasonably believed—
(a) that the disclosure was lawful, or
(b) that the information had already and lawfully been made available to
the public.
(4) A person guilty of an offence under this section shall be liable—
(a) on conviction on indictment, to imprisonment for a term not exceeding
two years, to a fine or to both, or
(b) on summary conviction, to imprisonment for a term not exceeding 12
months, to a fine not exceeding the statutory maximum or to both.
(5) A prosecution for an offence under this section may be instituted in England
and Wales only—
(a) by the Director of Revenue and Customs Prosecutions, or
(b) with the consent of the Director of Public Prosecutions.
(6) A prosecution for an offence under this section may be instituted in Northern
Ireland only—
(a) by the Commissioners, or
(b) with the consent of the Director of Public Prosecutions for Northern
Ireland.
(7) In the application of this section to Scotland or Northern Ireland the reference
in subsection (4)(b) to 12 months shall be taken as a reference to six months.
(8) This section is without prejudice to the pursuit of any remedy or the taking of
any action in relation to a contravention of section 18(1) or 20(9) (whether or
not this section applies to the contravention).
20 Public interest disclosure
(1) Disclosure is in accordance with this section (as mentioned in section 18(2)(b))
if—
(a) it is made on the instructions of the Commissioners (which may be
general or specific),
(b) it is of a kind—
(i) to which any of subsections (2) to (7) applies, or
(ii) specified in regulations made by the Treasury, and
(c) the Commissioners are satisfied that it is in the public interest.
(2) This subsection applies to a disclosure made—
(a) to a person exercising public functions (whether or not within the
United Kingdom),
(b) for the purposes of the prevention or detection of crime, and
(c) in order to comply with an obligation of the United Kingdom, or Her
Majesty’s Government, under an international or other agreement
relating to the movement of persons, goods or services.
(3) This subsection applies to a disclosure if—
(a) it is made to a body which has responsibility for the regulation of a
profession,
(b) it relates to misconduct on the part of a member of the profession, and
(c) the misconduct relates to a function of the Revenue and Customs.
(4) This subsection applies to a disclosure if—
(a) it is made to a constable, and
(b) either—
(i) the constable is exercising functions which relate to the
movement of persons or goods into or out of the United
Kingdom, or
(ii) the disclosure is made for the purposes of the prevention or
detection of crime.
(5) This subsection applies to a disclosure if it is made—
(a) to the National Criminal Intelligence Service, and
(b) for a purpose connected with its functions under section 2(2) of the
Police Act 1997 (c. 50) (criminal intelligence).
(6) This subsection applies to a disclosure if it is made—
(a) to a person exercising public functions in relation to public safety or
public health, and
(b) for the purposes of those functions.
(7) This subsection applies to a disclosure if it—
(a) is made to the national Policing Improvement Agency for the
purpose of enabling information to be entered in a computerised
database, and
(b) relates to—
(i) a person suspected of an offence,
(ii) a person arrested for an offence,
(iii) the results of an investigation, or
(iv) anything seized.
(8) Regulations under subsection (1)(b)(ii)—
(a) may specify a kind of disclosure only if the Treasury are satisfied that
it relates to—
(i) national security,
(ii) public safety,
(iii) public health, or
(iv) the prevention or detection of crime;
(b) may make provision limiting or restricting the disclosures that may be
made in reliance on the regulations; and that provision may, in
particular, operate by reference to—
(i) the nature of information,
(ii) the person or class of person to whom the disclosure is made,
(iii) the person or class of person by whom the disclosure is made,
(iv) any other factor, or
(v) a combination of factors;
(c) shall be made by statutory instrument;
(d) may not be made unless a draft has been laid before and approved by
resolution of each House of Parliament.
(9) Information disclosed in reliance on this section may not be further disclosed
without the consent of the Commissioners (which may be general or specific);
(but the Commissioners shall be taken to have consented to further disclosure
by use of the computerised database of information disclosed by virtue of
subsection (7)).
21 Disclosure to prosecuting authority
(1) Disclosure is in accordance with this section (as mentioned in section 18(2)(b))
if made—
(a) to a prosecuting authority, and
(b) for the purpose of enabling the authority—
(i) to consider whether to institute criminal proceedings in respect
of a matter considered in the course of an investigation
conducted by or on behalf of Her Majesty’s Revenue and
Customs,
(ii) to give advice in connection with a criminal investigation
(within the meaning of section 35(5)(b)) or criminal
proceedings. Or
(iii) in the case of the Director of Revenue and Customs Prosecutions, to exercise his functions under, or in relation to, Part 5 or 8 of the Proceeds of Crime Act 2002.
(2) In subsection (1) “prosecuting authority” means—
(a) the Director of Revenue and Customs Prosecutions,
(b) in Scotland, the Lord Advocate or a procurator fiscal, and
(c) in Northern Ireland, the Director of Public Prosecutions for Northern
Ireland.
(3) Information disclosed to a prosecuting authority in accordance with this
section may not be further disclosed except—
(a) for a purpose connected with the exercise of the prosecuting authority’s
functions, or
(b) with the consent of the Commissioners (which may be general or
specific).
(4) A person commits an offence if he contravenes subsection (3).
(5) It is a defence for a person charged with an offence under this section to prove
that he reasonably believed—
(a) that the disclosure was lawful, or
(b) that the information had already and lawfully been made available to
the public.
(6) A person guilty of an offence under this section shall be liable—
(a) on conviction on indictment, to imprisonment for a term not exceeding
two years, to a fine or to both, or
(b) on summary conviction, to imprisonment for a term not exceeding 12
months, to a fine not exceeding the statutory maximum or to both.
(7) A prosecution for an offence under this section may be instituted in England
and Wales only—
(a) by the Director of Revenue and Customs Prosecutions, or
(b) with the consent of the Director of Public Prosecutions.
(8) A prosecution for an offence under this section may be instituted in Northern
Ireland only—
(a) by the Commissioners, or
(b) with the consent of the Director of Public Prosecutions for Northern
Ireland.
(9) In the application of this section to Scotland or Northern Ireland the reference
in subsection (6)(b) to 12 months shall be taken as a reference to six months.
22 Data protection, &c.
Nothing in sections 17 to 21 authorises the making of a disclosure which—
(a) contravenes the Data Protection Act 1998, or
(b) is prohibited by Part 1 of the Regulation of Investigatory Powers Act
2000.
23 Freedom of information
(1) Revenue and customs information relating to a person, the disclosure of which
is prohibited by section 18(1), is exempt information by virtue of section
44(1)(a) of the Freedom of Information Act 2000 (prohibitions on
disclosure) if its disclosure—
(a) would specify the identity of the person to whom the information
relates, or
(b) would enable the identity of such a person to be deduced.
(2) Except as specified in subsection (1), information the disclosure of which is
prohibited by section 18(1) is not exempt information for the purposes of
section 44(1)(a) of the Freedom of Information Act 2000.
(3) In subsection (1) “revenue and customs information relating to a person” has
the same meaning as in section 19.
Signed on the original David Williams
on 13 September 2011 Judge of the Upper Tribunal
Nicholas Wikeley
Judge of the Upper Tribunal
Christopher Ryan
Judge of the Upper Tribunal
