BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
 |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
Upper Tribunal (Administrative Appeals Chamber) |
||
|
You are here: BAILII >> Databases >> Upper Tribunal (Administrative Appeals Chamber) >> Information Commissioner v CF & Anor (Information rights : Data protection) [2015] UKUT 449 (AAC) (10 August 2015) URL: http://www.bailii.org/uk/cases/UKUT/AAC/2015/449.html Cite as: [2015] UKUT 449 (AAC) |
||
[New search] [Printable RTF version] [Help]
Decisions
of the Upper Tribunal
(Administrative Appeals Chamber)
This decision is given under section 11 of the Tribunals, Courts and Enforcement Act 2007:
The decision of the First-tier Tribunal under reference EA/2013/0163, made on 1 November 2013, did not involve the making of an error on a point of law.
As the decision of the First-tier Tribunal (made on 13 January 2014 under reference EA/2013/0176) involved the making of an error in point of law, it is SET ASIDE under section 12(2)(a) and (b)(i) of the Tribunals, Courts and Enforcement Act 2007 and the case is REMITTED to the tribunal for rehearing by a differently constituted panel. That panel must undertake a complete reconsideration of the issues that are raised by the appeal in accordance with the analysis in this decision.
Reasons for Decision
DPA: Data
Protection Act 1998
FOIA: Freedom of Information Act 2000
GMC: General Medical Council
NCND: neither confirm nor deny
NMC: Nursing and Midwifery Council
1. I held an oral hearing of these appeals on 30 June 2015. Mrs Rodriguez-Noza and Mrs Foster attended; each spoke on her own behalf, supported by her husband. Robin Hopkins of counsel represented the Information Commissioner. Timothy Pitt-Payne QC represented the NMC. I am grateful to all of them for their written and oral submissions.
2. The same issue arises in both appeals. It is this. A complaint is made to the NMC, which it rejects as without foundation. The person who made the complaint then asks for information that was before the NMC when it made its decision. How should the NMC respond? Should it give a NCND decision or should it confirm that it holds the information, but argue that it is exempt?
3. I emphasise that the request was not to disclose information that there had been a complaint. This was already known, as the person making the request was the person who made the complaint.
4. This case arises from the inadequate support that Mrs Rodriquez- Noza feels that she received from the Abertawe Bro Morgannwg University Health Board when she was employed the Board as a nurse. She brought proceedings against her employer in the employment tribunal and, eventually, in the Employment Appeal Tribunal. She also made a complaint to Unison, the trade union. What concerns me in this case is her complaint to the NMC about the conduct of the six senior nurses who were her line managers. That complaint was made on 1 May 2012. The NMC decided that there was no basis for a complaint in respect of the nurses’ fitness to practice; employment issues were outside its remit, as it explained in its letters of 9 and 28 May 2012. Mrs Rodriguez-Noza wrote a letter on 21 November 2012, which was treated as a request under FOIA for
a copy of comments or response made by all of the people named in my complaint.
The NMC made a NCND response, which it confirmed on internal review. On Mrs Rodriquez-Noza’s complaint, the Information Commissioner decided that this response was in accordance with Part I of FOIA. On Mrs Rodriquez-Noza’s appeal, the Information Commissioner applied for her appeal to be struck out. The First-tier Tribunal did so on the ground that ‘it is inevitable that the appeal must fail.’ I gave her permission to appeal to the Upper Tribunal, following an oral hearing before me in Cardiff. Having done so, I joined the NMC, which had not been a party before the First-tier Tribunal.
5. This case arises from the sad death of Mrs Foster’s son, Gary, on 14 October 2007. He had testicular cancer and took part in a research trial. In the course of that trial, he was administered an excess dosage of Bleomycin over several weeks, which eventually led to his death on 14 October 2007. This led to an inquest, a civil action against the hospital, a referral of two doctors to the GMC, and a referral of one of the nurses to the NMC.
6. At the hearing, there was some uncertainty about the time when this referral occurred. Mrs Foster was sure that she had not made a complaint until after 30 August 2012, whereas the NMC gave the date as January 2011. Nothing turns on the precise date, but Mr Pitt-Payne agreed to clarify this and provided me with detailed evidence. On 5 January 2011, the investigating officer of the GMC referred the case to the NMC, which wrote to Mrs Foster, who wrote setting out her concerns on 17 January 2011. That is the time when the case first came to the NMC’s attention.
7. The NMC investigated and decided that the nurse had no case to answer. Mrs Foster was dissatisfied with the outcome and made a request under FOIA on 8 December 2012. She wrote:
Please can you forward to us the names of the five witnesses interviewed at the Investigating Committee hearing which took place on 29 August 2012.
Also we would appreciate a copy of all the case material which we have not received as yet.
The NMC made a NCND response by letter dated 11 January 2013. At Mrs Foster’s request, the NMC carried out an internal review and confirmed its decision by letter dated 13 February 2013.
8. On Mrs Foster’s complaint to the Information Commissioner, he decided that the NCND response was in accordance with Part I of FOIA. On Mrs Foster’s appeal, the First-tier Tribunal decided that the NMC was obliged to confirm or deny whether it held the information requested and, if it did, whether disclosure should be made. Mrs Foster told the tribunal that she was not interested in knowing the names of the witnesses; she only wished to be sure that they were not part of the team involved in the trial.
9. I gave the Information Commissioner permission to appeal to the Upper Tribunal. Having done so, I joined the NMC, which had not been a party before the First-tier Tribunal.
10. The basic right to information is conferred by section 1(1):
1 General right of access to information held by public authorities
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
11. The authority to give a NCND response derives from section 2 and, in these cases, section 40(5):
2 Effect of the exemptions in Part II
(1) Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—
(a) the provision confers absolute exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information,
section 1(1)(a) does not apply.
(3) For the purposes of this section, the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption-
…
(f) in section 40-
(i) subsection (1), and
(ii) subsection (2) so far as relating to cases where the first condition referred to in that subsection is satisfied by virtue of subsection (3)(a)(i) or (b) of that section,
40 Personal information
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which do not fall within subsection (1), and
(b) either the first or the second condition below is satisfied.
(3) The first condition is—
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of ‘data’ in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene—
(i) any of the data protection principles, or
(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress), and
(b) in any other case, that the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
(4) The second condition is that by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1)(c) of that Act (data subject's right of access to personal data).
(5) The duty to confirm or deny—
(a) does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1), and
(b) does not arise in relation to other information if or to the extent that either—
(i) the giving to a member of the public of the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene any of the data protection principles or section 10 of the Data Protection Act 1998 or would do so if the exemptions in section 33A(1) of that Act were disregarded, or
(ii) by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1)(a) of that Act (data subject’s right to be informed whether personal data being processed).
12. Data, personal data and processing are defined by section 1:
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires—
‘data’ means information which—
(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,
(b) is recorded with the intention that it should be processed by means of such equipment,
(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, …
(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68; or
(e) is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d);
…
‘personal data’ means data which relate to a living individual who can be identified—
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
‘processing’, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including—
(a) organisation, adaptation or alteration of the information or data,
(b) retrieval, consultation or use of the information or data,
(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or
(d) alignment, combination, blocking, erasure or destruction of the information or data; …
13. Schedule 1 to DPA sets out the data protection principles. Paragraph 1 sets out the first principle, which is the only principle relevant to this case:
Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, …
Schedule 2 sets out the conditions:
Conditions relevant for purposes of the first principle: processing of any personal data
1 The data subject has given his consent to the processing.
2 The processing is necessary—
(a) for the performance of a contract to which the data subject is a party, or
(b) for the taking of steps at the request of the data subject with a view to entering into a contract.
3 The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
4 The processing is necessary in order to protect the vital interests of the data subject.
5 The processing is necessary—
(a) for the administration of justice,
(aa) for the exercise of any functions of either House of Parliament,
(b) for the exercise of any functions conferred on any person by or under any enactment,
(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or
(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.
6-
(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.
14. The DPA implemented Directive 95/46/EC. It is always necessary to take account of the terms of the Directive, because the DPA must be interpreted in order to comply with it and its terms may assist in understanding the domestic legislation. Article 7(f) is relevant, as it is the basis for paragraph 6(1) of Schedule 2 to the DPA:
Member States shall provide that personal data may be processed only if:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).
This reflects recital 30:
(30) Whereas, in order to be lawful, the processing of personal data must in addition … be necessary … in the legitimate interests of a natural or legal person, provided that the interests or the rights and freedoms of the data subject are not overriding; …
Paragraph 6(1) of Schedule 2 broadly follows the language of Article 7(f), although DPA uses unwarranted rather than overridden. If the difference is significant, the former must be interpreted to conform with the latter.
15. Recital 72 is also relevant:
Whereas this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive.
16. I will deal with counsel’s argument, in so far as it is necessary, in the course of my analysis. Mr Hopkins took the lead in presenting the legal argument, which explains why he is mentioned more than Mr Pitt-Payne.
17. The NMC was not subject to a duty to confirm or deny if the case fell within section 10(5)(b)(i) of FOIA. That depended on whether giving confirmation or denial to a member of the public would contravene any of the data protection principles. The principle relevant to these cases is that found in paragraph 6(1) of Schedule 2 to the DPA. There is also the requirement of fairness under paragraph 1 of Schedule 1 to the DPA, but I cannot see that that adds anything to the paragraph 6(1) analysis in this case.
18. I begin by looking in general terms at the structure of paragraph 6(1) before coming to its relationship with FOIA.
19. The application of paragraph 6(1) is often referred to as involving a balance. I prefer not to use that language, as it is potentially misleading. Any balance involved is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA. As I said of paragraph 6(1) in Farrand v the Information Commissioner and the London Fire and Emergency Planning Authority [2014] UKUT 310 (AAC):
29. … It contains a condition that must be satisfied – that processing is necessary – to which there is an exception – prejudice to the data subject. …
That is made particularly clear by the way that recital 30 is expressed. Applying paragraph 6(1) may involve up to three stages:
· The first stage is to consider whether the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data would be disclosed. If not, it is not necessary to proceed to the other stages. That is what I decided in Farrand at [29].
· The second stage only arises if the consideration passes the first stage. It is then necessary to identify the rights and freedoms or legitimate interests of the data subject. If there are none, it is not necessary to proceed to the third stage.
· The third stage only arises if the consideration passes the first and second stages. It is then necessary to consider whether the processing is unwarranted, or overridden, in any particular case by reason of prejudice to the data subject’s rights, freedoms or legitimate interests.
Putting it briefly and in the context of these cases, the interests of the nurses can trump the interests of Mrs Rodriguez-Noza and Mrs Foster, but only if the nurses’ interests are sufficient to override those other interests or to render disclosure unwarranted.
20. Against that background, I can now deal with an argument put by Mr Hopkins. He pointed out that FOIA refers to disclosure to ‘a member of the public’: section 40(3)(a) and (b) and (5)(b)(i). This differs from ‘applicant’, which is used elsewhere, such as in section 40(1). He argued that this was significant and that paragraph 6(1) had to be applied as if ‘the party … to whom the data are disclosed’ was any member of the public. In other words, paragraph 6(1) had to be applied for the purposes of FOIA as if the data would be disclosed to a notional member of the public. I do not accept this argument.
21. It is important to take account, as Mr Hopkins’ argument did, of the language used by FOIA, but it is also important to take account of the policy underlying section 40. That section provides for the interrelationship of FOIA and the DPA. It distinguishes between applications seeking a person’s own data and those seeking the data of other people. The former are covered by section 40(1), the effect of which is to ensure that all applications are dealt with under the DPA. The latter are covered by section 40(2). The purpose and effect of that provision is to give DPA protection to the person who is the subject of the data.
22. Mr Hopkins’ argument was, no doubt, intended to narrow the possible application of paragraph 6(1) by generalising the consideration of the legitimate interests that have to be considered. That might be the effect in a case like Mrs Foster’s, as her concerns are very personal to her. As she told me at the hearing, her reasons are unique. So, the individual making the request under FOIA might have a legitimate interest whereas the public generally might not. But this approach could have the opposite effect. There may be cases in which there is a legitimate interest that might be held by members of the public generally, but which is not shared by the person to whom the data would be disclosed. In those circumstances, disclosure would, on Mr Hopkins’ argument, be required under FOIA, but would involve a breach of the data protection principles under the DPA. That result would be, to say the least, surprising.
23. This does not mean that there is no merit in Mr Hopkins’ point. It is important to take into account that disclosure of data under FOIA would be free of any duty of confidence, as Mr Pitt-Payne put it. That is a factor that is relevant to the application of paragraph 6(1). It can be taken into account in identifying the rights, freedoms and interests of the data subject and in deciding whether they override the interests of the person to whom the data would be disclosed. In other words, the language of FOIA is relevant at the second and third stages involved in applying paragraph 6(1) rather than at the first stage. Taking it into account in that way:
· gives effect to the language of section 40,
· ensures that disclosure under FOIA cannot involve a breach of a data protection principle, and
· may provide more protection for the data subject than the DPA provides.
24. There is another way of looking at this issue. I am aware of an argument that paragraph 6(1) is only concerned with the public (as opposed to private) interests of the person to whom the data would be disclosed. I prefer to apply the language of the statute (legitimate). Often the difference is little more than presentation. Take Mrs Foster’s case as an example. She told the tribunal that she should be entitled to know everything about the death of her son. The tribunal said that it had to find a public interest, but was able to identify two public interests embedded within her concerns and could easily have found more. On the basis, though, that a public interest is required, my concern that disclosure under FOIA could result in a breach of paragraph 6(1) would be misplaced. But that does not mean that Mr Hopkins’ argument is correct. The focus must be on the data subject and the protection of that person’s privacy, as that is the policy of the DPA. In those circumstances, it seems preferable to take account of the FOIA language at the second and third stages of applying paragraph 6(1) rather than distorting the analysis of the interests of the person making the request.
25. I raised the issue that the existence of a complaint to the NMC was known to both Mrs Rodriguez-Noza and Mrs Foster. They had made the complaints and were free to make that known to anyone else. At the oral hearing of Mrs Rodriguez-Noza’s appeal in Cardiff, for example, a local TV reporter was present in the court. The NMC had also acknowledged the existence of the complaints and given notice of its decisions. That information was not subject to any condition of confidentiality. I also referred the parties to the decision of Upper Tribunal Judge Turnbull in MC v Information Commissioner and Chief Constable of Greater Manchester Police [2014] UKUT 481 (AAC), where he said:
22. In my judgment it is a nonsense to say that the public interest demands that a public authority give a ‘neither confirm nor deny’ response when the fact that the information exists is already in the public domain.
26. Mr Hopkins presented a detailed argument to the effect that existing knowledge of a complaint was only relevant when it had a necessary authoritative quality. He distinguished this quality by reference to the source of the information. Recognition of the existence of a complaint in a High Court judgment was authoritative, whereas mention in the course of argument to the Court or in a blog was not. I asked Mr Hopkins about information that had already been disclosed by the authority and about the right to be forgotten. He argued that there would be no new processing if the information was already disclosed, although new processing might occur if there had been a long gap; he gave the example of 10 years.
27. I do not accept Mr Hopkins’ approach, because it is too restrictive. When the Upper Tribunal first acquired jurisdiction over information rights cases, I was struck by the extent to which the decisions of the Information Tribunal (now the First-tier Tribunal) had generated detailed rules and sub-rules for what were merely issues of fact. I do not doubt that that was for the best of motives, principally to do with consistency in decision-making. But it runs the danger that it will become cumbersome and restrictive. Mr Hopkins’ approach would have the same effects of generating rules (a necessary authoritative quality) and sub-rules to cope with different circumstances (High Court judgment, counsel’s argument, blogs). More importantly, the legislation is capable of coping with those considerations without the need for a series of principles. The application of paragraph 6(1) involves a comparison of the interests of the parties concerned. The factors that Mr Hopkins mentioned can easily be taken into account as part of the assessment of the interests of the parties and the legitimacy of those interests. That analysis allows those and other factors to be taken into account, while avoiding the analysis becoming encumbered by any general principles, leaving the focus where it should be: on the nature of the interests in the individual case.
28. Given that conclusion, I do not need to discuss the relevance of Judge Turnbull’s decision in MC. It is sufficient to record that both Mr Hopkins and Mr Pitt-Payne argued that it could be distinguished.
29. I agree with the First-tier Tribunal that there is no general principle that the subject of a complaint that has been rejected as without merit has an unqualified right to privacy in respect of the existence of the complaint to the NMC. The language of paragraph 6(1) requires an individual consideration and comparison of the interests on both sides. It is always dangerous for judges to give examples, which are inevitably devoid of any helpful context. So, I will take an extreme example based on recent events. Imagine a case in which a nurse has been the subject of a series of seemingly unrelated complaints, each of which is rejected as being without merit on the evidence provided. It is possible that information about the totality of the complaints could indicate a more general cause for concern.
30. Before leaving the analysis, I want to comment on two aspects of the arguments from Mr Hopkins and Mr Pitt-Payne. They both deployed general statements that are often made in FOIA cases. First, I was told that FOIA is applicant and motive blind. Second, I was told that disclosure under FOIA was disclosure to the whole world. There is much truth in both propositions, but they are not universally true. That makes it dangerous to rely on them as universally applicable principles that provide a sound basis on which to interpret FOIA. I merely wish to draw attention to this danger for future cases. I will not dwell on it beyond pointing out, by way of illustration, that it is impossible to apply paragraph 6(1) without having regard to the identity of the applicant, the interest pursued by the request, and the extent to which information is already potentially available to the public.
31. I asked Mrs Rodriquez-Noza how she would express the interest that she had in seeing the information that she had asked for. Her answer was that it was ‘in the public interest for all nurses to be treated equally, especially the nursing director and her deputy, who had rejected my grievances.’ I accept that that is how she feels and that it is a matter of public interest for nurses who have complaints against their employer to be treated equally. That does not mean, though, that it is a legitimate interest for the purposes of paragraph 6(1). That paragraph requires that the processing must be necessary in pursuit of the interest. In this case, that processing would take the form of disclosure of the information (head (c) of the definition in section 1(1) of the DPA). As the NMC rightly pointed out, its function is limited to fitness to practice. How a nurse, however senior, handles a complaint does not relate to fitness to practice. Mrs Rodriquez-Noza’s concern is in substance a matter of employer-employee relations. If it has to be addressed through the legal system, the proper routes are under the employment legislation or by action against the relevant union, both of which Mrs Rodriquez-Noza has pursued. In those circumstances, it would be unfair to the nurses concerned for the information to be processed as requested. The NMC was entitled to give a NCND response by virtue of section 40(5)(b)(i) of FOIA. The First-tier Tribunal was also entitled to strike out the appeal. That is why I have dismissed the appeal to the Upper Tribunal.
32. Mrs Foster’s case is different. She was not just asking for information about the nurse who was the subject of her complaint to the NMC, but also about the witnesses who supported her. The tribunal failed to take account of the fact that the witnesses were themselves data subjects to whom paragraph 6(1) had to be applied. Failing to consider them was an error of law.
33. I also accept Mr Hopkins’ argument that the tribunal made an error of law in the factors it took into account. I do not need to set out the details, as they are of no general interest. It is sufficient to say that the error occurred in paragraph 17 of the tribunal’s reasons. Mr Hopkins characterised the tribunal’s analysis as ‘second-guessing the conclusions of the NMC’s Investigating Committee.’ I would not go that far. I prefer to say that the tribunal failed to take account of the fact that the information held by the NMC would be available elsewhere. It also failed to take account of the information that had made available through the inquest and during the civil litigation. In other words, it was possible for Mrs Foster to obtain the information that concerned the tribunal without affecting the privacy rights of the nurse by seeking it from its original source. Putting it differently again, Mrs Foster’s legitimate interests as identified in paragraph 17 of the tribunal’s reasons might be met without resort to FOIA, rendering the processing by way of disclosure unnecessary.
34. There was some discussion at the hearing about the circumstances in which public authorities participate in proceedings before the First-tier Tribunal. The issue arose because Mrs Rodriquez-Noza argued that the First-tier Tribunal had made an error of law by not joining the NMC. I am not going to comment on that issue, as it is not necessary. In Mrs Rodriguez-Noza’s case, the interests that she was pursuing were outside the scope of the NMC. And in Mrs Foster’s case, the NMC will be able to apply to join as a party for the rehearing.
35. I also understand that the President of the General Regulatory Chamber of the First-tier Tribunal is considering the manner in which the parties are identified in freedom of information cases.
|
Signed on original |
Edward Jacobs |
