In Information Commissioner v Colenso Dunne [2015] UKUT 0471 (AAC) the Upper Tribunal has upheld the decision of the First-tier Tribunal that information could be released notwithstanding the Information Commissioner’s view that it was exempted from the freedom of information right. The case includes some interesting reflections on the interplay between freedom of information legislation and data protection legislation and on the strange dual role of the Information Commissioner but is chiefly important because of what is said about sensitive personal data.
The case arises out of the ICO’s investigation into Mr Steve Whittamore, a private investigator, as part of ‘Operation Motorman’. Cast your mind back to the phone-hacking scandal, the Leveson Inquiry and so on and you will get the context. The ICO refused to release a list of some 300-odd journalists’ names which it had seized in a raid on Mr Whittamore in response to Mr Colenso-Dunne’s request for the list under FOIA. Following a dispute, the First-tier Tribunal determined that the ICO should disclose the names of the journalists who had commissioned Mr Whittamore’s services, that the information in issue was not “sensitive personal data” and that its disclosure was for a legitimate purpose, rather than an unwarranted intrusion into the journalists’ privacy rights. Judge Wikeley in the Upper Tribunal judgment said that the First-tier Tribunal relied on three principal reasons:
(1) none of the requested names, in their context, comprised “sensitive personal data” for the purposes of the Data Protection Act 1998;
(2) disclosure of some of the names would not breach any of the data protection principles set out in Sch 1 to the Data Protection Act 1998; and
(3) the statutory prohibition under s 59(1) of the Data Protection Act 1998 did not apply because, by virtue of s 59(2)(e), disclosure of the requested names would have been made “with lawful authority” (and so the bar under s 44 of the Freedom of Information Act 2000 was not relevant).
Sensitive personal data
Insofar as relevant, s 2 of the Data Protection Act 1998 defines “sensitive personal data” thus:
‘In this Act “sensitive personal data” means personal data consisting of information as to—
…
(g) the commission or alleged commission by him of any offence, ‘
As Judge Wikeley puts it (at [38]-[39]):
The question for the Tribunal in this case was whether the personal data in question relating to any of the journalists was data “consisting of information as to – … (g) the commission or alleged commission by him of any offence.” The Tribunal’s answer to that was in the negative. The key passage in its final decision … read as follows:
“Having carefully examined the information in the Consolidated Reduced Spreadsheet we have concluded that it does not constitute information as to the commission or alleged commission of any offence by any of the journalist identified in it. It does contain evidence that the investigator engaged by the journalist committed, or contemplated committing, criminal activity. And, self-evidently, it discloses that the investigator received some form of instruction from the journalist. But there is no suggestion in the Consolidated Reduced Spreadsheet that the journalist had instructed the investigator to use unlawful methods or that he or she had turned a blind eye to their adoption or, indeed, whether he or she had in fact expressly forbidden the investigator from doing anything that was not strictly legal.”
In essence, the Tribunal made a finding of fact that the information demonstrated that particular journalists had commissioned Mr Whittamore to obtain information but, so far as the journalists were concerned, no more than that. The information did not carry with it any assertion as to the actual or alleged commission of any crime by those journalists. The line may be a fine one, but a sustainable line it is, and it is clear from the sequence of its rulings and its inquisitorial approach that the Tribunal interrogated the evidence rigorously in making its findings of fact.’
He went on to say (at [46]):
The fact that some people might misconstrue the fact that a journalist’s name was in the material seized from Mr Whittamore as an allegation that he or she had committed an offence did not convert personal data into sensitive personal data.
Balancing interests
The Information Commissioner’s contention was that the First-tier Tribunal had erred in its application of the balancing of interests under condition 6(1) of Sch. 2 to the Data Protection Act 1998. It was argued that it would be unfair to release the names in question, principally. Because of the very serious reputational consequences which disclosure would have for the journalists in question. Judge Wikeley felt that the First-tier Tribunal had adequately addressed that issue and that it was not for him to address it anew. In observing that there was a legitimate interest in the public being made aware of the sort of information the ICO had in its hands at the time when it pursued criminal proceedings against certain investigators but did not take any steps that might have led to the prosecution of those who had engaged the services of those investigators, the First-tier Tribunal had made it clear that it had carried out a proper balancing exercise.
Other grounds of appeal effectively fell away and Judge Wikeley dismissed the appeal.
