The requester (anonymised for the purposes of the decision) in Mr A v IC and The Health Professions Council (EA/2011/0223) asked for information about the response given by a named registrant to an investigation allegedly being carried out by the HPC into that registrant’s fitness to practice. The IC found that a ‘neither confirm nor deny’ response was appropriate, given that to confirm or deny (NCND) whether or not the HPC held the information requested would in and of itself disclose to the public whether there a complaint as to the registrant’s fitness to practise had been made. This would breach the first data protection principle. Section 40(5)(b)(i) FOIA therefore applied.
The Tribunal agreed. Curiously, it approached its task under section 58 FOIA thus: “The Tribunal does not take the IC’s decision again, rather its task is to consider the Decision Notice and to consider whether it can be impugned on legal grounds.”
Its decision turned largely on the usual features of a request for personal data: privacy implications, reasonable expectations and so on. The Tribunal’s decision does, however, contain a number of points of interest concerning the correct approach to section 40.
First, when judging whether, for section 40(5) purposes, confirmation or denial would breach any of the data protection principles, the appropriate reference point was disclosure to the public, not disclosure to the individual requester, given the overall wording of section 40 and the ‘motive blind’ approach to FOIA. The Upper Tribunal in All Party Parliamentary Group on Extraordinary Rendition v Information Commissioner [2011] UKUT 153 (AAC) appeared to think otherwise, but its observation was obiter, and the Tribunal in the present case declined to follow it.
Secondly, it followed that for the purposes of condition 6(1) of Schedule 2 to the DPA (which refers to the “legitimate interests of the … third party or parties to whom the data are disclosed”), the appropriate reference point was again the public. Public rather than private interests are what count for condition 6(1) purposes.
Finally, the NCND provisions of section 40(5) do not appear in the list of absolute exemptions at section 2(3)(f) of FOIA. Does this mean the public interest test must be applied, even where – as the Tribunal had found – disclosure would breach the first data protection principle? The Tribunal agreed with the IC and the HPC that the answer is ‘no’. It followed Heath v IC (EA/2009/0020) in finding that the word ‘provision’ at section 2(1) FOIA is sufficiently ambiguous (as to whether it means a section of FOIA as a whole, or rather subsections) to admit of a purposive interpretation. In these circumstances, this allowed for data protection principles to be given primacy; no public interest question under section 2(2) of FOIA arose.
Robin Hopkins