Shibu Gangadharan v The Information Commissioner

A tribunal determining an appeal under Freedom of Information Act 2000 must determine each distinct part of the original information request. It errs in law if it overlooks a request for aggregated percentage data and gives reasons directed only to requests for individual-level data.

For personal-data exemption purposes, disclosure under Article 6(1)(f) of the UK GDPR is not necessary merely because it may assist an identified legitimate interest. A tribunal may conclude, on the evidence, that existing non-personal statistical analysis sufficiently serves that interest. The judgment also doubts, obiter, whether guidance on balancing mixed personal data under the former data-protection regime transfers to the different balance required by section 40(2) FOIA.

The appellant sought GCSE grading and ethnicity information from a school. The school refused disclosure under section 40(2) of the Freedom of Information Act 2000. The Information Commissioner upheld that refusal in Decision Notice IC-179205-F3M4, and the First-tier Tribunal dismissed the appellant’s appeal on 31 October 2023.

On appeal, the appellant contended that the First-tier Tribunal had failed to address his fourth request, which sought percentage comparisons between groups rather than individual pupils’ results. He also challenged its conclusion that disclosure of the information in requests 1 to 3 was unnecessary for the legitimate interest relied on under Article 6(1)(f) of the UK GDPR.

1. Appeal allowed in part. The First-tier Tribunal erred in law by failing to decide Request 4. That request sought aggregated percentage data for specified grade levels and ethnic groupings. It was materially different from Requests 1 to 3, which sought individual students’ results and ethnicity. The tribunal’s reasoning on possible identification by cross-referencing individual results could not be read as addressing Request 4.
2. The error required the First-tier Tribunal’s decision to be set aside only insofar as it concerned Request 4. The case was remitted to the same tribunal for rehearing on Request 4 as originally made. Any proposed amendment to the request had to be made afresh to the school; tribunal proceedings could not be used to negotiate or explore evolving requests.
3. Ground 2 failed. In respect of Requests 1 to 3, the First-tier Tribunal had identified the relevant legitimate interest under Article 6(1)(f) of the UK GDPR. Read fairly and as a whole, its reasons showed that it had reached its own conclusion that disclosure was not necessary. It was entitled to place weight on the school’s published statistical analysis and its conclusion that the relevant ethnicity groups were too small for statistical significance. Those were relevant factors, and their weight could not be revisited absent perversity.
4. It was unnecessary for the First-tier Tribunal, in this FOIA appeal, to investigate whether the material might be disclosable in a differently framed claim under the Equality Act 2010. The issue was necessity for the identified legitimate interest in the particular request.
5. Obiter, the judge doubted whether the Court of Appeal’s guidance in DB v General Medical Council [2018] EWCA Civ 1497 on the former mixed-data subject-access regime could be carried across to section 40(2) of the Freedom of Information Act 2000 and Article 6(1)(f). The judgment did not determine that question.

• Upper Tribunal (Administrative Appeals Chamber): Allowed the appeal in part, set aside the First-tier Tribunal’s decision only in respect of Request 4, and remitted that request for rehearing.
• First-tier Tribunal (Information Rights): On 31 October 2023, dismissed the appellant’s appeal against the Information Commissioner’s Decision Notice.
• Information Commissioner: Decision Notice IC-179205-F3M4, dated 3 March 2023, upheld the school’s refusal under section 40(2) of the Freedom of Information Act 2000.