Ryland v The Information Commissioner & Anor [2024] UKFTT 396 (GRC) (21 May 2024)

Introduction:

1. The Appellant appeals under section 57 of the Freedom of Information Act 2000 ("FOIA"), against the Decision Notice with reference IC- 136681 - Z7Z2 dated 07 September 2022 (the DN) issued by the Information Commissioner (the Commissioner). In the DN at §§1-3, the Commissioner concluded that: The Appellant has requested all documents held by Channel Four Television Corporation ("C4") relating to any decisions regarding the implementation of C4's Supplier Code of Conduct, its policy on Viewer Trust, bullying; or the 'Speak Up' process in relation to a particular organisation within a specified timeframe. C4 cited section 41(1) and section 40(2) FOIA as its reasons for withholding some of the requested information. It also cited section 40(5A) FOIA to neither confirm nor deny whether some of the requested information is held. The Tribunal have been supplied with voluminous papers mostly contained in an Open Bundle ("OB"), a Closed Bundle ("CB") and an Authorities Bundle in which the CB includes the withheld information, which is subject of the request.

2. The DN determined that C4 has correctly cited section 41(1) and section 40(2) to the withheld information. The Commissioner has also decided that C4 appropriately cited section 40(5A) to neither confirm nor deny whether it held certain information. However, C4 breached section 10(1) FOIA by providing a small amount of information outside the legislative time frame and section 17(7)(b) by not providing details of the Appellant's right to complain to the Commissioner when it provided its refusal notice.

3. The Commissioner did not require C4 to take any further steps.

4. As required by rule 23(3) of the 2009 Rules, the Commissioner states that he opposes the appeal and thereby invites the Tribunal to dismiss this appeal.

Chronology:

5. On 22 October 2021 C4 provided its refusal notice to the Appellant. It cited section 41 FOIA (information provided in confidence) regarding the requested information. C4 did not cite section 40 FOIA at that time because it had made the assumption that the Appellant had excluded personal data.

6. The Appellant asked for an internal review on 23 October 2021, disputing C4's application of section 41. The Appellant also reiterated that he was not asking for personal data and that it could be redacted. The Appellant provided some further argument on the same day. This was acknowledged by C4 on 25 October 2021.

7. The Appellant clarified the 27 September 2021 request on the same date as follows:

"Dear C4 FOI, I just thought I would specify that I believe this would include any relevant communications with representatives of [redacted] including: [redacted names of individuals] but does not have a [redacted] email address."

8. The Appellant also corrected what he believed to be a factual error on 24 October 2022, concerning the provision of personal data in relation to the 27 September 2021 request, suggesting that they had not excluded all third-party personal data. He also noted the following: "...that my request specifies it covers information regarding the 'volume and nature' of the evidence assessed by Speak Up in relation to [redacted]. Please ensure that any documents whose contents are exempt in their entirety are still identified such that they provide any such information to the fullest extent possible. This should include details such as, but not limited to, the time and date if originally knowable, format (email, text, WhatsApp, document etc) if obscured by redaction, number of pages, and even give some indication of the length of any content redacted."

9. On 22 November 2021, C4 provided its internal review where it maintained its position regarding section 41 and also cited sections 40(2) (third party personal information) and 40(5A) to neither confirm nor deny whether some of the requested information is held.

10. Channel 4 apologised for not making it clearer that its refusal notice had included the clarification that had been made and attached the policy 'Respect at Work'. It concluded that the right to have a review had been included in its refusal notice and included details of how to complain to the Commissioner in its review.

Factual Background:

11. C4 provided the Commissioner with some background information regarding this complaint.

12. Prior to the request that is the subject of this complaint, the Appellant submitted a separate but related request. This request was for the same information that was withheld under this request. C4 neither confirmed nor denied that it held this information.

13. Therefore, at the time C4 responded to that request it had already explained that section 40(5A) was engaged.

14. The Commissioner noted that Channel 4 describes 'Speak Up' as follows: "Our Speak Up facility provides people working at Producers and other third parties with a confidential process whereby they can escalate concerns to senior Channel 4 management. We are committed to dealing with everything that is reported to us promptly, fairly and confidentially, in accordance with this guidance."

15. The Appellant initially contacted the Commissioner on 24 October 2021 to complain about the way the request for information had been handled procedurally by C4 because no reference had been made to his rights. He complained again on 26 November 2021 because he was not satisfied with the internal review outcome.

16. During several exchanges of correspondence, the Appellant also raised matters pertaining to his request that related to the substantive issues of the exemptions cited and whether Channel 4 had considered the "volume and nature" as part of the request.

17. The Commissioner wrote his investigation letter to Channel 4 and subsequently asked further questions about its use of section 40(5A) and the "volume" of information that the Appellant stated that he had requested but that Channel 4 had not addressed. The Commissioner did not explore the complaint having asked for the "nature" of the information held because his view was that this would fall under the exemptions cited by Channel 4.

18. Channel 4 responded on 5 September 2022 stating that, having reviewed the correspondence, it did not consider that the Appellant had specifically requested the "volume and nature" of the evidence it had assessed, though it had been referred to in that correspondence.

19. The Commissioner considered that the scope of his investigation is Channel 4's citing of section 40(2) (personal information), section 40(5A) (neither confirm nor deny) and section 41 (information provided in confidence). He also looked at any procedural matters that may have occurred.

Relevant Policies & Processes:

20. Channel 4 is a statutory corporation formed under an Act of Parliament in accordance with s.23, Broadcasting Act 1990. It is a publicly owned UK public service broadcaster and is commercially funded; it does not receive funding from the public. It operates the main 'Channel 4' television channel, along with 11 other channels and a streaming service. Channel 4 does not generally produce its own content; rather, it commissions or acquires content by licence from independent production companies and third parties and it also relies on a range of third-party suppliers for other goods and services.

21. Everything that Channel 4 does is governed by its public service remit, which is enshrined in legislation, most relevantly ss.198A, 199 and 265(3), Communications Act 2003. In brief, that remit is to champion unheard voices and to deliver high-quality, innovative, alternative content that challenges the status quo.

22. The request that is the subject of this appeal ('the Request') refers to three separate Channel 4 policies and processes:

i. C4's Supplier Code of Conduct ('the Supplier Code');

ii. C4's Viewer Trust Guidelines ('the Viewer Trust Guidelines'); and

iii. C4's 'Speak Up' Facility ('Speak Up').

23. These "best practice" policies and processes were put in place, and are implemented, voluntarily by Channel 4, rather than (for instance) being required under statute. They do not empower Channel 4 to compel any party to take or refrain from engaging in a given action, or to impose any kind of legal sanction.

The Supplier Code:

24. The Supplier Code sets out the minimum standards of behaviour which all third parties that supply programmes and other goods and services to C4 are expected to follow when carrying out that work. It applies alongside C4's requirement that all companies with which it works comply with all of their applicable legal obligations. The current version of the Supplier Code was produced in June 2018.

25. The Viewer Trust Guidelines set out rules and procedures for programme-makers. They apply to all factual programmes or items or portrayals of factual matters across all genres and are designed to promote best practice in ensuring that viewer trust is maintained. The current version of the Viewer Trust Guidelines was produced in approximately January 2022.

26. Speak Up is a facility voluntarily and proactively provided by C4 through which C4 employees, freelancers working on C4 programmes, and employees of companies supplying products and/or services to C4 are able to confidentially raise concerns with C4 through a third-party service provider (currently an external company called Safecall). The Speak Up facility has been in place for several years.

27. Channel 4's dedicated Speak Up webpage (which, in terms of this appeal was most recently updated in May 2021) explains how the facility works ('the Speak Up Webpage'). The Speak Up Webpage informs the reader that:

i. Speak Up is a "confidential process";

ii. C4 is committed to dealing with everything reported through Speak Up confidentially;

iii. the confidentiality of anyone choosing to use Speak Up will be respected;

iv. the information provided by anyone choosing to use Speak Up will be shared only with those responsible at C4 for assessing and/or investigating the matter;

v. in cases where it is not appropriate or possible for C4 to conduct an investigation itself, alternative guidance may be given to the complainant;

vi. complainants have the right to remain anonymous (although this may affect C4's ability to conduct an investigation itself);

vii. C4 will not tolerate any retaliation against an individual for raising a concern, making a report or assisting in an investigation; and

viii. results of investigations will be routinely reported up to the Audit Committee of Channel 4's Board, on a confidential basis.

28. While Speak Up has since its inception been available to people working in C4's entire supply chain, in 2021, to improve awareness amongst production companies producing content for C4. C4 mandated that those companies include Speak Up contact details on their daily call sheets (or details of those companies' own equivalent service(s)). C4 did this in recognition of the fact that there are a very high number of freelancers working within the television industry, for whom mechanisms for resolving human resources related concerns are not always straightforward or readily available.

29. The efficacy and ultimate viability of Speak Up rests on the co-operation of both suppliers and complainants, as C4 does not have any legal or regulatory powers to compel companies or individuals to conduct or cooperate with investigations regarding concerns raised via Speak Up. Nor can C4 impose fines or other quasi-regulatory sanctions in relation to such matters. In light of these constraints, C4 seeks to work with suppliers and complainants to ensure that concerns are properly investigated and, where it appears that standards have not been met, to support suppliers in identifying and introducing appropriate remedial measures (e.g. training and/or education).

30. Reports via Speak Up are made on an entirely voluntary basis. As noted above, C4 assures all complainants who raise concerns via this facility that their identity will be kept confidential unless they agree otherwise.

The Decision Notice:

31. In summary the Commissioner held in the DN that the exemptions under section 40(2) (personal information) and section 41(1) (information provided in confidence) of the Freedom of Information Act 2000 ("FOIA") identified by the Appellant as reasons for withholding certain of the information requested, and section 40(5A) FOIA cited as the basis to neither confirm nor deny whether certain of the information request was held, had been correctly applied by Channel 4.

The Grounds of Appeal:

32. By a Notice of Appeal dated 24 September 2022 the Appellant has appealed the DN, helpfully summarised at OB §§ 34 -77, which read as follows;

"I am appealing the Commissioner's decision on several grounds, briefly summarised.as follows:

- The Commissioner has erred in upholding the application on Section 41, based on a flawed assessment of 'obligation of confidence', detriment to the confider', and 'public interest defence'

- The Commissioner has erred in upholding C4's engagement of Section 40(2)

- The Commissioner erred in dismissing the part of this request asking for details of the 'volume and nature' describing information, or 'metadata', describing documents covered by the request, under which exemption it is not entirely clear.

- The Commissioner has erred in upholding the withholding of information that does not fall under the exemptions cited (Section 41 and Section 40)"

33. The Commissioner submits that the appeal should be dismissed for the reasons given in the DN, and further elaborated in his Response dated 26 May 2023 ("OB 78 - 90"). The Appellant's Response to the Commissioner's Response ("OB 91 -108") is dated 8th June 2023.

34. Channel 4 opposes this appeal and agrees with the Commissioner that it should be dismissed for the reasons set out in the Commissioner's DN, the Commissioner's Response to the Appellant's GoA and in their own Response to the GoA, ("OB 109-128") dated 11 August 2023.

35. Finally, the Appellant has provided his Reply to Channel 4's Response on 8 June 2023 ("OB91 - 108") which have been the main, but not exclusive focus of the Tribunal's deliberations in the appeal.

Legal Framework:

Section 58, FOIA: Determination of Appeals:

36. S.58, FOIA, provides:

(1) If on an appeal under section 57 the Tribunal considers—

(a) that the notice against which the appeal is brought is not in accordance with the

law, or

(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

37. In Thompson v Information Commissioner, 7 November 2016, [EA/2016/0044], the Tribunal, acknowledging that it could receive evidence that was not before the Commissioner, identified the above provision as being the extent of its remit in cases involving complaints: it was not appropriate to consider the substance of any complaint regarding alleged behaviour or the handling of that complaint by the relevant body.

38. S.1, FOIA: General Right of Access to Information Held by Public Authorities:

S.1(1), FOIA provides for a general right of access to information held by public authorities. It states:

(1) Any person making a request for information to a public authority is entitled –

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him.

39. The duty of a public authority to comply with s.1(1)(a), FOIA is, pursuant to s.1(6), referred to in the FOIA as "the duty to confirm or deny".

40. Under ss.3(1)(a) and 7(1) and Part VI, Schedule 1, FOIA, C4 is a public authority for the purposes of the FOIA; "in respect of information held for purposes other than those of journalism, art or literature". Channel 4 does not dispute for the purposes of this appeal that the withheld Information is held for purposes other than those of journalism, art or literature, and that Parts I to V of the FOIA therefore apply.

41. It is well established that for the purposes of the FOIA, including the exemptions identified herein, disclosure of information under the Act is to be considered as if it were being released to the world at large. See, for instance, the approach in Page v Information Commissioner [2023] UKFTT 476 (GRC), [5], [6], [147], [152], [160], [174] and [177].

42. S.40, FOIA: Personal Information:

Personal Data: Ss.40 (1) and (2) set out exemptions which apply to "personal data".

Under s.40(7), FOIA, "personal data" has the same meaning as in the Data Protection Act 2018 ('DPA').

S.3(2), DPA defines "personal data" as "any information relating to an identified or identifiable living individual". An "identifiable living individual" means, pursuant to s.3(3), DPA: ... a living individual who can be identified directly or indirectly, in particular by reference to—

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or society identity of the individual.

43. A name is personal data unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure: Edem v Information Commissioner [2014] EWCA Civ 92, [20].

44. The Tribunal has held that information, opinions and allegations put forward by an identifiable individual constitutes information relating to that individual and is thereby their personal data: McAuley v Information Commissioner, 26 July 2022, [EA/2022/0018].

45. In Innes v Information Commissioner, 7 September 2015 [EA/2013/0044], [§20], the Tribunal made general observations relating to personal data relating complaints: ... any record of complaints could be expected to be the personal data of those complained about, those complaining and any witnesses. It is about them, has biographical significance for them and is used to make decisions about them and it has them as their main focus. In relation to any interviewed or complaining, it would contain their views and opinions. The Tribunal added, that the: "contemporaneous timeframe... satisfied [it] on balance that any individuals would still be living and can be identified from the withheld material".

Personal Data of the Applicant:

46. Under s.40(1), FOIA, any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. Under s.40(7), FOIA, "data subject" has the same meaning as in the Data Protection Act2018 ('DPA'). S.3(5), DPA provides that "data subject" means "the identified or identifiable living individual to whom personal data relates".

47. Pursuant to s.2(3)(f), FOIA, the exemption at s.40(1) is absolute: the separate public interest balancing test under FOIA does not apply.

48. Further, under s.40(5A), FOIA, the duty to confirm or deny at s.1(1)(a) does not arise in relation to information which is, or which if held by a public authority would be, exempt information under s.40(1). The public authority's right to respond to a request by neither confirming nor denying whether it holds the relevant information, is also an absolute exemption: Shamir Ahmed Ali v The Information Commissioner [2022] UKFTT 434 (GRC), [§§12 - 13].

Third Party Personal Data:

49. Under s.40(2), FOIA, any information to which a request for information relates is exempt information if it (a) constitutes personal data which does not fall within s.40(1), and (b) one of three conditions at ss.40(3A), (3B) or (3C) is satisfied.

50. The first of the three conditions referred to at s.40(2), FOIA is set out at s.40(3A)(a), and is relied upon by Channel 4 for the purposes of this appeal. The condition is that the disclosure of the information to a member of the public otherwise than under the FOIA would contravene any of the data protection principles.

51. Under s.40(7), "data protection principles" means, for the purposes of general personal data processing, the principles set out in Art. 5(1), UK General Data Protection Regulation ('UK GDPR').

52. The first data protection principle identified at Art. 5(1); UK GDPR is set out at Art. 5(1)(a). It provides that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject". (Our emphasis).

53. Regarding the requirement of fairness, in DH v Information Commissioner [2016] UKUT 139 (AAC) the Upper Tribunal endorsed, at [33] and [36], guidance by the Commissioner summarising several of the considerations that will be relevant: "- the possible consequences of disclosure on the individual; - the reasonable expectations of the individual, taking into account: their expectations both at the time the information was collected and at the time of the request; the nature of the information itself; the circumstances in which the information was obtained; whether the information has been or remains in the public domain; and the FOIA principles of transparency and accountability; and - any legitimate interests in the public having access to the information and the balance between these and the rights and freedoms of the individuals who are the data subjects."

54. The Tribunal has previously, when considering "fairness" in the context of FOIA requests concerning investigatory proceedings, held that there is a recognised expectation that:-"the internal disciplinary matters of an individual will be private, even among senior members of staff...", and that witnesses who give evidence during an investigation can have a reasonable expectation that the information they provide will not be released to the general public: Waugh v Information Commissioner, 29 December 2008, [EA/2008/0038], [§§39 - 41].

55. Relatedly, the Tribunal has held that "information relating to complaints against individuals carries a very strong general expectation of privacy. This is due to the likelihood that disclosure could cause the individual distress and potential damage to future prospects and general reputation. Even where the investigation exonerates the individual, the matter can be potentially distressing or stressful if it is thought in time that it might be revealed to the world. Likewise... even if the complaint is unmeritorious, its existence can be potentially damaging to an individual. It is foreseeable to some to conclude 'there's no smoke without fire'.": Thompson v Information Commissioner, 7 November 2016, [EA/2016/0044], [§31.A(d)].

56. The Tribunal has also identified as a relevant consideration "the need for a 'safe space' in which to conduct any investigation or disciplinary action" and noted that "a relevant factor in assessing fairness would be the extent to which disclosure would jeopardize any investigation or disciplinary process": Innes v Information Commissioner, 7 September 2015 [EA/2013/0044], [§35].

57. As to the requirement of lawfulness, Art. 6(1), UK GDPR provides that processing shall be lawful only if and to the extent that at least one of six identified conditions is met. The condition most relevant to this appeal is set out at Art. 6(1)(f), UK GDPR: "processing is third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...".

58. The Tribunal set out, in Page, [§59], the three questions that Art. 6(1)(f), UK GDPR requires be answered:

(i) Is the data controller or a third party pursuing a legitimate interest or interests?

(ii) Is the processing involved necessary for the purposes of those interests?

(iii) Are the above interests overridden by the interests or fundamental rights and

freedoms of the data subject?

59. S.40(8), FOIA provides that the second subparagraph of Art. 6(1), UK GDPR (which disapplies Art. 6(1)(f) in relation to public authorities in the performance of their tasks) does not apply for the purposes of s.40, FOIA.

60. When considering whether processing is "necessary" for the purposes of a legitimate interest or interests, "necessary" means "reasonably" rather than absolutely or strictly necessary. A measure will not be necessary if the legitimate aim can be achieved by a lesser measure: Page, [60], citing South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55; [2013] 1 WLR 2421, [§27].

61. S.41(1), FOIA provides that information is exempt information if:

(a) it was obtained by the public authority from any other person (including another public authority), and

(b) the disclosure of the information to the public (otherwise than under [the FOIA]) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.

62. Pursuant to s.2(3)(g), FOIA, the exemption at s.41 is absolute: the separate public interest balancing test under FOIA does not apply (although a public interest defence is available to breach of confidence claim, as addressed below).

63. In Coco v AN Clark (Engineers) Ltd [1968] F.S.R. 415, Megarry J set out the three elements normally required if, apart from contract, a claim for a breach of confidence is to succeed:

i. The information must have the necessary quality of confidence about it ;

ii. The information must have been imparted in circumstances importing an obligation of confidence; and

iii. There must have been an unauthorised use of that information to the detriment of the party communicating it.

64. Coco v AN Clark (Engineers) Ltd [1968] F.S.R. 415 (Authorities Bundle at page 5), establishes that:

i. information which is "trivial tittle-tattle" cannot provide the basis for an action for breach of confidence;

ii. information which is already common knowledge cannot provide the basis for an action for breach of confidence; and

iii. an equitable obligation of confidence will be imposed " - if the circumstances are such that any reasonable man standing in the shoes of the recipient of the information would have realised that upon reasonable grounds the information was being given in confidence".

65. For a claim for breach of confidence to be actionable within the meaning of s.41(1)(b), FOIA, the public authority must establish that the claim would succeed on the balance of probabilities: Higher Education Funding Council for England v Information Commissioner, 13 January 2010, [EA/2009/0036]. This involves considering whether the public authority would be able to succeed in a "defence" of public interest. The test, as set out in ABC v Telegraph Media Group Ltd [2018] EWCA Civ 2329, [2019] E.M.L.R. [22] and [60] is: "whether, in all the circumstances, it is in the public interest that the duty of confidence should be breached." That question must be answered by a consideration of "all the relevant circumstances", while "having regard to the nature of the information". The test is ultimately one of proportionality.

S.36, FOIA: Prejudice to Effective Conduct of Public Affairs:

66. Under s.36(3), FOIA, the s.1(1)(a), FOIA duty to confirm or deny does not arise in relation to information to which s.36 applies (or would apply if held by the public authority) if, or to the extent that, in the reasonable opinion of a qualified person, compliance with that duty would, or would be likely to, have any of the effects mentioned in s.36(2). For present purposes, the relevant effects mentioned in s.36(2) are:

i. inhibiting the free and frank provision of advice (s.36(2)(b)(i));

ii. inhibiting the free and frank exchange of views for the purposes of deliberation (s.36(2)(b)(ii)); or

iii. otherwise prejudicing the effective conduct of public affairs (s.36(2)(c)).

67. Pursuant to ss.2(1)(b) and (3), FOIA, the exemption at s.36(3), FOIA is, in the context of the Appellant's request and the instant appeal, qualified: for it to apply, in all the circumstances of the case the public interest in maintaining the exclusion of the duty to confirm or deny must outweigh the public interest in disclosing whether the public authority holds the Information.

Channel 4's Submissions:

68. Channel 4 submits that there is no basis to disturb the DN and that the appeal should be dismissed.

Personal Data of the Applicant:

69. Insofar as the Information contained any personal data belonging to the Appellant, C4 submits that:

i. the absolute exemption at s.40(1), FOIA would be engaged;

ii. C4 was right, under s.40(5A), FOIA, to neither confirm nor deny whether it held such information;

iii. the Commissioner was right, at §§85-97 of the DN, to uphold C4's approach in this regard.

70. Third Party Personal Data: As to §§48-84 of the DN, C4 submits that the Commission was right to uphold Channel 4's reliance on the exemption at s.40(2), FOIA, for the following reasons:

First, as the Commissioner rightly concluded, the Information contains, for the purpose of s.40(2)(a), FOIA, third parties' personal data, with that personal data comprising both individuals' names and information relating to those individuals within the meaning of s.3(2), DPA.

Second, the requirement at s.40.2(b), FOIA that one of the three conditions identified at s.40 be satisfied is met - specifically, the condition at s.40(3A) (a). Disclosure of the Information to a member of the public otherwise than under the FOIA would contravene the principle at Art. 5(1)(a), UK GDPR, that personal data shall be processed fairly and lawfully. Regarding the fairness requirement, C4 submits that disclosing the Information to the world at large would not be fair, because:

i) Individuals who are the subject of a Speak Up complaint have, as the Tribunal recognised in Thompson, a very strong general expectation of privacy in information relating to complaints against them, due to the likelihood that disclosure would cause them distress and potential reputational damage.

ii) Individuals who assist in Speak Up investigations do so with the reasonable expectation that their identities and/or their contributions will remain confidential, on the basis of the express guarantees on the Speak Up Webpage and/or an implicit presumption, in line with the Tribunal's approach in Waugh, in light of the obvious sensitivity of the information in play (which in this case includes allegations of bullying) and inherently confidential nature of whistleblowing processing generally.

iii) C4 staff involved in assessing any Speak Up complaint have a similar reasonable expectation that their identities and/or their assessments will not be disclosed to the world at large, given the sensitivities around such a complaint and the importance of these matters to those affected or involved.

iv) The Information is not in the public domain, and no party relevant for the purposes of C4's reliance on this exemption has consented to its disclosure.

v) Disclosure of the Information to the world at large would jeopardise the efficacy of the Speak Up process, in that if individuals felt they could no longer trust that their complaints, participation and/or contributions would remain confidential, they would be reluctant to use or engage with Speak Up, undermining its utility and thus the case for its continued existence.

vi. Disclosing the Information to the world at large would be unfair to those who have either previously complained through Speak Up, been the subject of such a complaint, or assisted in an investigation, in that it could cause them to be concerned that their own previous involvement in Speak Up was now at risk of being disclosed.

vii) As noted above, scrutiny of how the Speak Up process operates is already provided through the routine reporting of the results of investigations to the Audit Committee of C4's Board.

71. The outcome of a complaint made via Speak Up is also communicated to the complainant. Regarding the lawfulness requirement, none of the conditions set out at Art. 6(1), UK GDPR would be satisfied in this case:

i) None of the third-party data subjects have consented to their personal data being disclosed, meaning that C4 could not satisfy Art. 6(1)(a), UK GDPR;

ii) Art. 6(1)(b) UK GDPR is inapplicable on the facts of this case;

iii) The FOIA cannot supply the requisite legal obligation for the purposes of Art.

6(1)(c), UK GDPR, and no alternative legal obligation for disclosure exists;

iv) Art. 6(1)(d), UK GDPR is inapplicable on the facts of this case;

The FOIA cannot supply the requisite task or the exercise of any official authority for the purposes of Art. 6(1)(e), UK GDPR; no alternative task exists, and the exercising of any official authority does not arise.

72. Whether C4 could satisfy the condition at Art. 6(1)(f), UK GDPR was the subject of intense focus by the Commissioner and is addressed at §§60-84 of the DN. As to this:

i) From the relevant section of the Appellant's Grounds (§§241-255), C4 understands the Appellant's submissions regarding the legitimate interests pursued to relate to the names of senior staff at the Organisation and C4, and to ensuring accountability in circumstances where, the Appellant alleges, (a) senior staff at the Organisation failed to properly investigate a complaint and (b) senior staff at C4 responsible for a Speak Up investigation incorrectly relied on a policy document and refused to accept relevant evidence. C4 submits that such matters, as well as the matters at §§7-105 of the Appellant's Grounds and related matters reiterated elsewhere, fall outside the Tribunal's remit - as identified in Thompson - on this appeal, concerning as they do the substance of a complaint regarding alleged behaviour and the handling of a complaint by the Organisation (which is not a public authority) and by C4.

ii) To the extent that the Appellant relies, for the "legitimate interests" requirement of Art. 6(1)(f), UK GDPR, on his wider contention in the Request that "it is a matter of public interest" that the Supplier Code, the Viewer Trust Guidelines and Speak Up "function as designed", C4 submits that such an interest cannot be "legitimate" in the sense of militating for disclosure in circumstances where the confidential Speak Up mechanism can only "function as designed" if, as discussed further, the confidential nature of the process is protected and preserved, and in circumstances where Speak Up is a "best practice" mechanism put in place and implemented voluntarily by C4.

iii) Even if, which C4 does not accept, it could be established that a legitimate interest was being pursued, C4 submits that disclosure of the Information is not necessary for the purposes of that interest. Unrestricted disclosure to the world at large of the names of staff at the Organisation and C4, and of any other individuals assisting in a confidential complaints process, will not contribute to and is not necessary or proportionate for any generic interests of transparency or accountability in relation to Speak Up. As to the disclosure of personal data beyond the names of those individuals, scrutiny of how the Speak Up process is functioning is already provided through the routine reporting of the results of investigations to the Audit Committee of C4's Board.

iv) Even if (which C4 does not accept) it could be established in this case that disclosure was necessary for the purposes of legitimate interests, C4 submits that such interests would clearly be overridden by the interests identified at §§67(i)-(iii) above.

Information Provided in Confidence:

73. As to §§20-47 of the DN, C4 submits that the Commission was right to uphold C4's reliance on the exemption at s.41(1), FOIA, on the basis that (a) the Information contained information obtained by C4 from third parties and (b) its disclosure otherwise than under the FOIA would constitute a breach of confidence actionable by those third parties and the subjects of that complaint.

First: for the purposes of s.41(1)(a), FOIA, the Information contained information obtained from third parties - namely the original complainant and staff at the Organisation - as well as, in the case of C4 staff, information reflecting the substance of that information (together, 'the Complaint Information').

Second: the Complaint Information has "the necessary quality of confidence about it". It is not already common knowledge and is evidently not "trivial tittle-tattle". As the Commissioner identified, it relates to serious allegations, including bullying.

Third: contrary to the submissions at §§113-160 of the Appellant's Grounds, the Complaint Information was imparted in circumstances importing an obligation of confidence, for the reasons set out above.

Fourth: disclosure to the world at large would, in these circumstances, and in the absence of consent by the individuals concerned, be an unauthorised use of the Complaint Information, to the detriment of:

i) The subjects of the complaint, given the likelihood of distress and potential reputational damage, as was recognised in Thompson; and

ii) Individuals at the Organisation who have assisted, and C4 staff who have been involved in assessing, the complaint, who have done so in the reasonable expectation that their identities and/or their contributions will remain confidential, such that they do not need to fear any retaliation for having done so.

Fifth: C4 would not be able to successfully rely on any public interest "defence" to a breach of confidence claim by the subject of the complaint and/or any concerned third party because, in all the circumstances, and having regard to the nature of the Complaint Information, it is not in the public interest that the duties of confidence should be breached - for all of the reasons set out §67 above. Prejudice to Effective Conduct of Public Affairs.

74. The s.1(1)(a), FOIA duty to confirm or deny would be likely to: - inhibit the free and frank provision of advice, for the purposes of s.36(2)(b)(i), FOIA; C4 submits that these points apply equally to the 'metadata' sought by the Appellant, that information being an integral part of the confidential Speak Up process.

75. C4 submits that the above points apply equally to the 'metadata' as sought by the Appellant, that information being an integral part of the confidential Speak Up process.

Opinion of a Qualified Person:

76. On 11 August 2023, C4's Qualified Person gave an opinion ('the Opinion') that compliance with the s.1(1)(a), FOIA duty to confirm or deny would be likely to: "i. inhibits the free and frank provision of advice, for the purposes of s.36(2)(b)(i), FOIA";

77. Pursuant to s.36(5)(o)(iii), C4's Qualified Person in this appeal for the purposes of s.36, FOIA, is Mr Martin Baker, Chief Commercial Affairs Officer at C4.

78. C4 further submits that:

i) the Opinion was reasonable for the purposes of s.36(3), FOIA; and ii) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing whether C4 holds the Information. As to this, C4 will rely on:

a) The facts and matters identified by the Qualified Person in the Opinion regarding the balance of the public interest;

b). The prejudices identified by the Qualified Person in the Opinion as being likely to arise from disclosure of the Information under the FOIA; and

c). The fact that the Qualified Person has provided an opinion identifying those prejudices.

Discussion:

79. The Tribunal take the Appellant as a conscientious citizen in expressing his legitimate concerns relating to transparency and accountability in the public authority herein and have carefully considered all of his voluminous submissions both in his Replies to the Respondents formal responses to his detailed GoA and taking his substantive submissions into account including in particular his Reply to the C4 Response to his GoA, we summarise our deliberations as follows.

80. Citations from authorities, while always helpful can be misplaced and misleading. Each case must be decided on its merits and on all the material circumstances pertaining, for example in the LRT case (cited by the Appellant) ruling from the Court of Appeal - London Regional Transport v The Mayor of London [2001] EWCA Civ 1491 – which established that a fairly broad public interest defence can apply in breaches of confidence. Lord Justice Snedley did note that Article 10 of the European Convention on Human Rights: "--recognised the legitimacy of disclosing information, even in breach of a contractual undertaking not to do so, "if the public interest in the free flow of information and ideas will be served by it." (our emphasis). Lord Justice Snedley also established a test for how to assess this balancing act: "Does the measure meet a recognised and pressing social need? Does it negate the primary right or restrict it more than is necessary? Are the reasons given for it logical?". The Tribunal are of the view that in relation to the factual circumstances pertaining to this appeal it can be distinguished and although this is not a breach of contract undertaking - article 10 is very broad. We find it would be inappropriate to suggest that Lord Snedley would have condoned it being used in circumstances such as have occurred in this case. He wasn't suggesting that safe space would be denied, he wasn't expecting that the granular detail of what was going on in an investigation would be published to the world large.

81. The Appellant argues that the 'measure' in this case is the publication of documents detailing C4's investigation of a C4 supplier's compliance with its Supplier Code of Conduct and Viewer Trust guidelines and he argues 'pressing social need' is the need to disabuse the public of C4's claims to investigate. That is, the Appellant poses, one balance that would need to be weighed. The Tribunal have a significant amount of material information before us and in the closed session, which has a purpose, we have considered and deliberated on it all. We are satisfied that the C4 investigation process did comprehensively and thoroughly cover and investigate all material and credible suggestions of malfeasance, wrongdoing, misdemeanours etc. and it probed with appropriate rigour all relevant and material issues that we would have expected them to scrutinise.

82. In relation to wider media coverage, as referred to by the Appellant, any suggestion of malfeasance or misconduct reported in the media or social media is not before us to determine under FOIA.

83. The panel has fully examined the DN and found it to be comprehensive. We do not agree that it omits material factual matters. On our own scrutiny of all the evidence and submissions before us, while taking into account the closed materials we find that there was a comprehensive and robust investigation by the public authority C4 herein and further and in any event, accordingly the DN contains no error of Law.

84. We did read all of the comments and assertions that have been made by the Appellant, but we agree with the Commissioner that many are not material.

85. We are not saying that the Appellant is not entitled to be concerned, but that is not the test. He may have concerns and may wish to know the intricacies of these investigations, that however is not the purpose of FOIA particularly where S40 personal information and S41 information provided in confidence is in play. The conduct of the internal and confidential investigation carried out by the public authority herein, which we have seen and scrutinised, is in our view thorough and robust.

86. The Appellant refers to the 'underlying factual matters' in this case that he asserts the Commissioner has chosen to ignore. We disagree with the Appellant on the basis that we have seen the investigation carried out by the public authority and we can find no material evidence of malfeasance or wrongdoing that has been overlooked. Nor in these circumstances is it for the Tribunal to tell a Public Authority how they conduct their business. We provide an annex with a Gist which includes some of the closed evidence we have considered herein.

87. In relation to the Appellant's arguments regarding the confidential information of others, FOIA has exemptions to protect individuals. S40 personal information and S41 information provided in confidence, and these cannot be simply cast aside. The whistle-blower provisions have a great degree of expected confidentiality. This is not just about one person, and it is not just about waving confidentiality, it's about the effect on those involved in the investigations. The Appellant cannot realistically hope to impose the result on others who don't wish their data to be disclosed, we have seen the closed witness statement of Rebecca Miller which directly indicated that others involved would object to their confidential information being published and have clear expectations of confidentiality. The exemptions are in place to protect private individuals' information, they may be absolute exemptions, but the fundamental basis is the protection of the safe space and people being confident to fully engage in investigations and the whistle-blower provisions. We agree that the information at issue does not necessarily only relate to the Appellant, or at least not the Appellant in isolation, but to a number of other individuals, not least the individual against whom the complaint was made. Certain of that information necessarily includes information summarising or derived from such individuals acquired in the course of the various investigations or procedures that form the underlying subject matter of the Request. The Appellant does not appear to understand that the confidential information also relates to individuals other than himself. The Tribunal take carful cognisance of and refer to comprehensive and material open (and closed) witness statements of Rebecca Miller. We are satisfied that third parties have not waived their rights to personal data being released.

88. We refer to the comprehensive and compelling submissions made on behalf of the Second Respondent above and counsels' summary of the Legal Framework [See §§36 - 75 above].

89. The Appellant, in our view, fails to properly recognise or understand the concept of fairness that must prevail in any balance of public interest to be considered. If someone is found responsible for any wrongdoing after a proper and fair hearing, then there would be legitimate expectation that their details might subsequently appear in the public domain. But each case is to be considered on its merits and we are not dealing with hypothetical situations because we have not seen evidence which established any wrongdoing. There may be recommendations made as a result of an investigation but that would not and should not necessarily result in the disclosure of personal data being released. The individuals' legitimate rights to personal data protection cannot be overestimated and it is very high barrier to cross in asserting and establishing the public interest favours such disclosure. This it seems to us is not fully apparent to the Appellant, but we have no reservations in the factual matrix and all the circumstances pertaining to this appeal as set out above that the Public Interest balance clearly and unambiguously favours non- disclosure.

90. We have concluded that as result of the internal investigation carried out by C4, recommendations were made but no material findings of wrongdoing or misconduct resulted. After a thorough and comprehensive internal investigation no legal entity or individual were considered culpable for wrongdoing. If the Appellant has a legitimate complaint his redress must be found elsewhere, if one indeed exists. Consideration of any such remedies as may be available to him are not the purpose of FOIA or the function of this Tribunal.

91. The Tribunal have considered a large volume of closed material in relation to the internal investigation by C4, including an investigation report in draft and final format (See Annex to this Judgment, of the Gist provided herewith). The panel considered what if anything in these documents could be sufficiently redacted to protect personal information and information provided in confidence. The panel concluded that any such redaction would result in most of the documents being heavily redacted and the remaining content being un-readable and totally out of context.

92. In relation to the request and what withheld information the Appellant wants the Tribunal to address when he indicates his request: "- - specifies it covers information regarding the 'volume and nature' of the evidence assessed by Speak Up in relation to [redacted]". It is evident to us that the Appellant has received from C4 (on or about on the 14th of June 2021), a 4-page summary of the internal investigation, which summarised the investigation undertaken and makes general recommendations, including to a material third-party organisation. The Tribunal panel felt that this document which has been released into the public domain, was in fact material to the scope of the request, was informative and accurately reflected the substantive investigation findings.

93. Obiter, the Tribunal note the submissions on the Qualified Opinion produced on behalf of the public authority and referred to at §§74 - 79 above but do not intend to address the submissions on this part of the appeal, a) because the Opinion in question post-dated the DN and in any event b) we are satisfied on the submissions and evidence before us that it is unnecessary to do so in all the circumstances of this appeal.

Conclusion:

94. The Tribunal have considered this appeal afresh and made our own inquiries and observations to arrive at our unanimous judgment in accepting and adopting the comprehensive submissions on the Law and on the issues before us, made by Counsel on behalf of the Second Respondent herein at §§35 - 75 above and for all the above reasons we must dismiss the appeal.

95. It follows from the above also that we can find no error of law, or error in the exercise of his discretion by the Commissioner in his DN, the subject to the appeal, and finally we make the following Directions:

CASE MANAGEMENT DIRECTIONS

96. Any party in possession of or to whom a document has been provided in an appeal (or application) to the First-tier Tribunal (including those in bundles) may use that document only for the purpose of the proceedings in which it is disclosed, except where the Tribunal gives permission or the party who disclosed the document and the person to whom the document belongs agree. (See further: Upper Tribunal ruling in DVLA v Information Commissioner and Williams (Rule 14 Order) [2020] UKUT 310 (AAC))

97. The Tribunal also make the following Rule 14 Directions;

Prevention of disclosure - sensitive personal data and disputed information:

98. The parties may also find it helpful to refer to the Practice Note on Closed Material available here: https://www.judiciary.gov.uk/publications/practice-note-closed-material-in-information-rights-cases/

99. In the course of this appeal the Tribunal has both been made aware of and received sensitive information from all parties, which includes, but is not exclusive to the withheld Information, the subject of the appeal. Any such sensitive information, personal data or disputed information will be held, pursuant to rule 14(6), on the basis that it will not be disclosed to anyone except the Tribunal Panel. To do otherwise would defeat the purpose of the proceedings and may be in contempt of court.

100. The above direction permits a party to edit a document to prevent disclosure of sensitive disputed information; it is however the Tribunal's decision whether a party may place documents before any other persons but withhold them from one of the parties. Should a party wish to disclose or share any of the content of the bundle for any reason, it is respectfully suggested that they apply to the Tribunal for permission before any proposed disclosure. Parties may of course decide if they wish to take their own legal advice on this point.

On-going duty under rule 14:

101. The duty to ensure fairness in dealing with sensitive, personal data or closed information in proceedings is a dynamic one. Nothing I am saying at this stage is intended to limit the ability of the Panel to act compliantly with Browning when considering the appeal.

102. The Parties are at liberty to apply. Any application in respect of Rule 14 should be made promptly.

Brian Kennedy KC 14 May 2024

Amended under the slip rule to correct typing errors on 13 June 2024.

Amended under the slip rule to correct typing error on 21 August 2024.

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	First-tier Tribunal (General Regulatory Chamber)
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Ryland v The Information Commissioner & Anor [2024] UKFTT 396 (GRC) (21 May 2024) URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2024/396.html Cite as: [2024] UKFTT 396 (GRC)

First-tier Tribunal (General Regulatory Chamber)