Information Rights Tribunal dismisses appeal over council decision to withhold confidential report prepared by independent monitoring officer on governance deficiencies

The First-tier Tribunal (FTT) has dismissed an appeal by an appellant who sought the disclosure of a confidential report detailing governance woes at Thanet District Council.

In Driver v Information Commissioner & Anor [2025] UKFTT 61 (GRC), the FTT concluded that an already-published public summary of the report sufficiently addressed transparency concerns and that disclosure of the report, even if partly-redacted, could infringe upon the privacy of individuals involved.

The report, compiled by an independent monitoring officer and dated April 2022, concerned matters relating to the conduct of certain senior executives from around 2019.

A summary of the report, rather than the full document, was published by the council, which revealed deficiencies in governance in the council in dealing with grievances, whistle-blower complaints and disciplinary proceedings.

It also described the emergence in 2019 of a serious breakdown in the relationships between the four senior officers – who were named in the summary – comprising the council's Corporate Management team.

A member of the public requested a copy of the full report, but the council withheld the full report under section 40(2) of the Freedom of Information Act 2000 (FOIA) over concerns that disclosure would involve disclosing the personal data of those mentioned in the document.

An appeal was then made to the Information Commissioner’s Office about the decision to withhold.

However, the Commissioner upheld the council's decision, finding that the information requested both related to and identified either current or former employees of the council or third parties and constituted personal data within the meaning of section 3(2) of the Data Protection Act 2018.

The ICO also found that it was not necessary to publish the full report to fulfil the purpose of holding senior staff in public office to account and that disclosure of all the personal data in the report – relating to both former and current officers of the council – went beyond what was necessary to meet any public interest argument.

The Commissioner ultimately concluded that the council was entitled to rely on s40(2) FOIA to avoid publishing the report and that the public summary and accompanying recommendations were sufficient.

The appellant then appealed the Commissioner's decision to the FTT in May 2023, submitting that the ICO had:

1. failed to give sufficient weight to a pressing social need for transparency, accountability, value for money and democracy, which would be met by disclosure of the report;
2. failed to conclude that disclosure of the report was a proportionate interference with the relevant data subjects' rights to privacy and protection of their personal data in the circumstances;
3. wrongly taken into account the distress likely to be felt by officials who had been found to engage in misconduct and wrongly concluded that they had a reasonable expectation of privacy in relation to the report;
4. failed to take into account information already in the public domain about alleged and proven wrongdoing of a serious nature by senior council officials.

The FTT noted that the "substantive arguments" in the appeal focussed on the application of Article 6(1)(f) UK GDPR.

Article 6(1)(f) provides a lawful basis for processing personal data if "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".

The tribunal said to determine the application of Article 6(1)(f), it was necessary to determine:

1. the legitimate interest of the request,
2. whether disclosure of the report (including the personal data in it) was necessary for the purposes of meeting that interest, and
3. (assuming that disclosure of the report was necessary for the purposes of meeting that interest) whether that interest outweighed the interests or rights of the affected data subjects.

On this point, the appellant submitted that there was a pressing social need for disclosure of the report in the interests of transparency, accountability, value for money and the health of democracy, which effectively outweighed the rights and freedoms of individuals whose personal data would, by disclosure of the report, be published.

Considering the arguments, the tribunal acknowledged that it was satisfied there was a "broad legitimate interest in transparency, accountability, value for money and the health of democracy, as the Appellant put it, in relation to the discharge of the Council's functions".

It then turned to the question of whether disclosure of the report was necessary to meet the legitimate interest of the request.

In considering this, the tribunal compared the full report to the public summary, finding that the latter document represented a "generous replication of the report, indeed in our view, strikingly so".

The tribunal decision read: "The Public Summary, in extracting as fulsomely as it did from the report, was no less damning in its thrust or detail than the report.

"We are confirmed in that view both by our close comparison of individual sections of the two documents, and by our 'stand-back' impression of them."

It added: "Looking at matters in the round, we are satisfied that the council was entitled to conclude that disclosure of the Report including personal data was not necessary to meet the legitimate interests of the Request, including that of holding senior employees to account, when the Public Summary had been published in such detail as it had, including the names of the four most senior employees in the CMT."

On that basis, the tribunal concluded it was not necessary to determine whether the legitimate interest pursued by the request outweighed the interests or rights of the affected data subjects.

However, the tribunal addressed the issue of the interests and rights of individuals in broad terms for completeness.

The appellant had voiced an interest in disclosing the names of council staff named in the report other than the four most senior council officers named.

One of those personnel - who gave evidence during the hearing - reported that they had not expected to be named in the report and were not shown a copy of the document or given a chance to comment before publication.

"They were most concerned that if the Report were to be published, the Appellant would use it to attack and attempt to discredit them (as well as others referred to in the Report), damaging their professional profile, well-being and happiness," the tribunal noted.

The tribunal later found: "We do not consider that disclosure of that witness' personal data by publication of the report would have been a proportionate interference with their rights.

"Although the Appellant sought by his submissions and cross-examination of the witness to diminish the feared impact on the witness of disclosure of their personal data, it was clear that the witness believed, we consider justifiably, that disclosure might be damaging to them.

"We do not accept that disclosure of their personal data in May 2022 could have been justified to meet the broad legitimate interest of the Request."

Elsewhere, the tribunal concluded that it was not satisfied that redacting personal data from the report would be effective in shielding the identities of some individuals named in the report.

Ultimately, it concluded that s40(3A) FOIA "was appropriately considered to be engaged because disclosure of the personal data would contravene Article 5(1)(a) GDPR; the processing of the personal data would not be lawful under Article 6(1)(f) in the circumstances of this case".

It also dismissed an argument concerning Article 6(1)(c) GDPR, which provides that processing of personal data is lawful if it is necessary for compliance with a legal obligation to which the controller, in this case, the council, is subject.

"For all the reasons we have given, we find that the council was entitled to refuse disclosure of the report in reliance on s40(2) FOIA.

"We find that the Decision Notice was in accordance with the law."

The appeal was dismissed.

Adam Carey