Here’s a phrase you won’t hear very often: the Information Tribunal has recently issued an interesting decision. (I of course use the word “interesting” the way all lawyers use it, which is to say quite wrongly. I also use the term “Information Tribunal” quite wrongly, as it is of course now the First-Tier Tribunal (Information Rights).)
The decision, involving the Financial Services Authority, concerns personal data – that most vexing of subjects – and in particular the interaction between Freedom of Information and the Data Protection Act. In this case, the Tribunal overturned a decision of the (UK) Information Commissioner, who had decided that the names of junior members of FSA staff could be withheld under section 40 of the (UK) Freedom of Information Act 2000 (the personal data exemption, equivalent to section 38 of FOISA) because the names were personal data and their disclosure would not be compatible with the data protection principles. The Tribunal decided that the names were not in fact personal data, relying on the 2003 Court of Appeal decision in Durant v FSA to conclude that the information was not “biographical in any significant sense”, and that the individuals were not the “focus of the information”. The Tribunal then seemed to add a new test of its own, explaining that it did not consider that the information “adversely affects the individual’s’ privacy, whether in their personal or family life, business or professional capacity” (an inaccurate paraphrase of Auld LJ’s decision in Durant, adding the word “adversely” in a way that dramatically changes the test he set out).
No doubt this outcome will surprise FOI and Data Protection practitioners, not to mention make them question the expensive training they received from their expensive lawyers, since the message (from us and others) has consistently been that Durant is of limited value in light of subsequent decisions such as the House of Lords’ 2008 decision in Common Services Agency v Scottish Information Commissioner (in which we acted for the Commissioner). While the Lords did not expressly disapprove Durant, they did choose to depart from it and approach the issue from an entirely different angle.
Indeed, it would seem that the limited value of Durant in cases like this was so well-established that the Information Commissioner felt no need to address it in this case – paragraph 31 of the Tribunal’s decision is below, with some… er… respectful observations interspersed:
“Durant is a decision of the Court of Appeal and the Tribunal is bound by it [unless a higher court has taken a different approach, such as in the CSA case], although we would acknowledge that there has been some variation in exactly how it has been applied in different cases that have come before the Tribunal [not to mention the Court of Session, High Court, Court of Appeal, House of Lords…]. Curiously, the Decision Notice is entirely silent about the application of Durant to the present case, and the Commissioner has also been silent about his own guidelines contained in the “Data Protection Technical Guidance Determining What Is Personal Data” [a 2007 document which pre-dates the Lords’ CSA decision and begins “We have been aware for some time of the need to replace our guidance on the implications of the Durant judgement.”].”
As David Frost used to say, the clues are there.
In its defence, the Tribunal does not seem to have been referred to the Common Services Agency decision or addressed on why Durant might no longer be useful authority. We would nevertheless be surprised if the Information Commissioner does not appeal this decision, so its ultimate effect may be that the question of defining “personal data” makes it back to the Court of Appeal, or even that Durant is finally tackled head-on by the Supreme Court. Either way, it will hopefully result in a more helpful approach to the issue than Durant did.
In the meantime, Scottish public authorities should keep in mind that Tribunal decisions are not binding on them or on the Scottish Information Commissioner. The Commissioner is therefore unlikely to change her approach from that set out in her helpful guidance on the personal information exemption, which is helpful largely because it ignores Durant in favour of the more authoritative Common Services Agency decision, and thus vindicates that expensive training I mentioned earlier…
On April 26, 2012