Lynn Wyeth discusses the key takeaways from some recent FOI and Data Protection cases.
This month, I’m looking at a FOI decision notice on Aggregation and whether we can look at the cumulative effect of exemptions in a Public Interest test. For Data Protection, when can a public authority keep someone’s data against their wishes?
FOI Aggregation of Exemptions in a Public Interest Test… Can we add exemptions together to push us over the threshold?
In the Court of Appeal judgment in Dept for Business and Trade v IC and Montague [2023] EWCA Civ 1378 we may find some answers.
Under FOIA, some exemptions are absolute and some are qualified. Qualified exemptions require us to undertake a public interest test (PIT) under s.2(2)(b). We have to decide whether, “in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosure.” Until recently, there was uncertainty about whether this balancing exercise must be done for each exemption separately, or whether multiple exemptions can be aggregated and effectively added together.
The Montague case above concerned information about Brexit trade working groups. The Department relied on two qualified exemptions:
o s.27 (international relations)
o s.35 (formulation of government policy)
The Information Commissioner argued that the test must be done exemption-by-exemption. The Department argued the public interest could be considered cumulatively across both e.g. adding the public interest arguments of each exemption together to achieve a stronger argument in total for withholding.
The Court of Appeal decision concluded that aggregation IS permitted because “The public interest in maintaining the exemption” means “the exemption of the information from disclosure”, not one statutory provision. This also aligns FOIA with the approach under the EIR.
Public Authorities may now aggregate the public interests for different exemptions when applying s.2(2)(b). This simplifies decision-making where multiple exemptions apply, avoiding repetitive public interest tests.
It is unlikely to change many outcomes in practice, but it means that when applying more than one qualified exemption, you may:
o Set out the harm/public interest factors under each exemption;
o Then weigh all those factors against the public interest in disclosure in total.
o There is no need to conduct a separate public interest test for each exemption individually.
Data protection – When is it justified for a public authority to keep a data subject’s records against the data subject’s wishes?
In 2024, a former patient brought a claim for damages against an NHS Trust, alleging unlawful processing and retention of his personal data (YSL v. Surrey and Borders Partnership NHS Foundation Trust [2024] EWHC 391 (KB).
He argued that his records had been improperly shared with his GP, family and school without consent, that some information was inaccurate, and that the Trust should not retain records for 20 years (which was in line with its retention policy).
The court said that the NHS Trust’s provision of health services was a public function carried out in the public interest, thereby giving it a lawful basis to process and share personal data. The claimant was found not to have a right to erasure, as long-term retention was necessary for public health purposes and the 20-year period for mental health records was lawful.
Applying the proportionality test from Bank Mellat v. HM Treasury (No. 2) [2014] AC 700, the court ruled that a fair balance had been achieved between individual rights and community interests.
The 20-year period was based on expert judgment, and the NHS was entitled to a “significant margin of discretion” in setting retention policies. Retention was also considered to be in the claimant’s own interests, ensuring accurate records for any future treatment, and necessary to enable the Trust to defend itself in potential litigation.
Check out our on demand webinars for more guidance and best practice.
