[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	First-tier Tribunal (General Regulatory Chamber)
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Howat v Information Commissioner [2024] UKFTT 109 (GRC) (07 February 2024) URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2024/109.html Cite as: [2024] UKFTT 109 (GRC)

[New search] [Printable PDF version] [Help]

First-tier Tribunal
General Regulatory Chamber
Information Rights

		Heard: On the papers Heard on: 15 January 2024
		Decision Given On: 7 February 2024

Decision:

1. The appeal is dismissed.

REASONS

Introduction

1. This is an appeal against the Commissioner's decision notice IC-225278-X5D4 of 21 June 2023 which held that Network Rail was entitled to rely on regulation 12(5)(e) of the Environmental Information Regulations 2004 (EIR) to refuse to confirm or deny that it held the information.
2. The Commissioner did not require Network Rail to take any steps.
3. There is a short closed annex to this decision. It is necessary to withhold this annex to avoid defeating the purposes of the appeal.

Factual background to the appeal

4. Between Stromeferry and Duncraig station on the south side of Loch Carron, the Inverness to Kyle of Lochalsh railway line runs over a bridge known as Port Chullain or Portchullin Bridge ('the Bridge'). In late 2019 and early 2020 Network Rail carried out repair works to the Bridge.
5. There is a small crofting community in the area made up of six properties. In the early 1970s the community, with the financial assistance of the Crofting Commission, built a road which runs alongside the railway between the highway and the Bridge (the road). Along the road there are also a small number of private households. The land is owned by two private individuals ('the Landlords'). The crofters are their tenants.
6. Network Rail used the road to access repair works to the Bridge with the consent of the Landlords. The existence of some sort of contract between Network Rail and the Landlords is already publicly known (since the work could not have proceeded without an agreement of some variety). More granular details around the cost, duration, terms, etc. are not in the public domain.
7. The appellant asserts that the use of the road by Network Rail has left it damaged, to the extent that none of the households living along the road have had mail delivered since and other carriers will no longer drive along it. Although some emergency services were already unable to use the road due to a low bridge, those that used to be able to use the road can no longer do so.
8. Network Rail's position is that that no damage was caused to the road as a result of their works access and that there were visible and documented signs of damage before they used it.
9. The Scottish Crofting Federation defines a crofter as follows:

"A crofter is the person who occupies and works a small landholding known as a croft. A crofter is normally the tenant of the croft, paying rent to the landlord of the croft."^[1]

10. According to the website of the Scottish Crofting Federation, 'The rent paid by the tenant crofter, except in fairly rare circumstances, is only for the bare land of the croft, for the house and agricultural buildings, road and fences are provided by the crofter himself.'^[2]
11. For the purposes of this appeal, we presume without deciding that the appellant is correct that the legal position is that the road belongs to the crofters, and that the obligation to maintain the road lies with the crofters.

Requests and response

12. This appeal concerns a request made by Ms. Iseabail Howat on 15 September 2022 for the following information:

"Any document that shows the consent that was obtained agreeing HGV vehicle access along the road and by who

…

…what amount was paid to only my landlords on the extension part of the contract please?"

13. Network Rail replied on 21 December 2021. Network Rail stated that they had held no further information, in addition to what they had already provided, in relation to part 1 of the request. In relation to part 2 Network Rail neither confirmed nor denied that they held the requested information under regulation 13(5) EIR, because it would amount to a disclosure of personal information which was inconsistent with the data protection principles.
14. The appellant applied for an internal review. On 7 February 2023 Network Rail upheld its decision.
15. The appellant complained to the Commissioner on 3 March 2023.

Decision Notice

16. In a decision notice dated 21 June 2023 the Commissioner decided that Network Rail was entitled to rely on regulation 13(5) EIR as the basis for neither confirming nor denying whether it held the requested information.
17. The Commissioner noted contextual details connected to individuals were provided by the appellant to Network Rail in order to make the request. The Commissioner concluded that if Network Rail were to confirm or deny whether it held information on the amount paid to a particular landlord it would, in effect, be confirming whether or not it had paid that landlord. The Commissioner accepted that confirmation or denial would constitute disclosure of a third party's personal data.
18. The Commissioner concluded that the appellant had a legitimate interest in disclosure of the information. The Commissioner concluded that the requirements of article 6(1)(f) UKGDRPR were not met.

The grounds of appeal

19. The appellant appealed the decision on the following grounds:

Ground 1 – personal data

20. The appellant asks the tribunal to consider if the requested information is or is not personal data given landlord/crofter duties and responsibilities and as the appellant should have been invited to be one of the parties to a contractual agreement.

Ground 2 – balance of interests

21. The appellant submits that the Commissioner did not give sufficient weight to the evidence supporting the legitimate interest. There is a plausible suspicion of wrongdoing and a wider public interest than the Commissioner determined.
22. The appellant submits that rhe information is not 'clear-cut' personal data given the Landlords' role as a croft landlord. The Commissioner was wrong to conclude that there was an expectation of privacy.

The Commissioner's response

Ground 1

23. Whilst the email in which the request is made does not identify the appellant's landlords by name, the Landlords can be identified from other information in that email, namely that it is the appellant's landlords, known to the appellant and others living nearby, and the reference to location (Portchullin Bridge).

Ground 2

24. The Commissioner accepted in his decision notice that the appellant has a legitimate interest in confirmation or denial that the requested information is held and did not dispute Network Rail's acceptance that confirming whether it holds the information in question is necessary to meet a legitimate interest. The Commissioner accepts that there are no less intrusive means of the appellant obtaining confirmation or denial that the information in issue is held.
25. The appellant argues that when balancing the legitimate interests, the Commissioner should have weighed into the balance "…actual wrongdoing when Network Rail contracted only with the landlords and not all the lawful owners which would have included the crofters. Network Rail failed to get lawful permission to use the road".
26. The Tribunal is not able to decide upon whether there has or has not been any wrongdoing on the part of Network Rail. In any event, a simple confirmation or denial that the disputed information is held would not meet such a legitimate interest.
27. The appellant further argues that: "When a publicly funded company fails to take account of primary legislation which resulted in a group of people being denied the rights the legislation was put in place to protect and caused them losses it is more likely than not to be a matter of public interest. Positive changes could result from this to ensure other crofting communities…are protected from the same thing happening to them".
28. The Commissioner maintains that whilst there may be a legitimate interest of the appellant and a small number of others living nearby in confirmation or denial that the disputed information is held there is not a sufficiently wider interest in such a confirmation or denial to outweigh the interference with the data subject(s)' interests or fundamental rights and freedoms. The Commissioner considers that it would be disproportionately intrusive to reveal personal data by confirming or denying to the public as a whole whether the disputed information is held.

The appellant's reply

29. The appellant states that complaints have also been made to Network Rail and the Landlords by non-crofting households. None of the households along the road have had mail delivered since the road was damaged. Access time to a defibrillator has been extended. Emergency response times (for vehicles that can get under a low bridge) will be delayed. This is of concern to the whole community. All residents are happy to contribute towards repairing the road with an appropriate financial contribution from those who gained financially or from those responsible for the condition the road was left in.
30. The appellant submits that no-one who lives along the road was asked about the state the road was being left in when the contract with the Landlords was signed off. It was signed off only with the agreement of those who stood to gain financially from public funds at the expense of the crofters and their neighbours. Network Rail used the private road to access the Bridge without obtaining the consent of the crofters whose consent they required specifically. Network failed to engage with the crofters and all those who need to use the private road to access their property to discuss the weights they intended to carry over it contrary to their own published policy.
31. It is submitted that the road is a piece of infrastructure (like outbuildings and fencing) which was built by the crofters in the early 1970's with financial assistance from the then Crofters Commission (now the Crofting Commission). At this time the then landlord agreed to the road being laid over the common grazing that was owned by him and is now owned by the Landlords. A basic interpretation of the legislation by crofters is that they own what is built on the common grazing (unless the landowners built it), they just do not own the land it sits on. The appellant submits that this shows that in not involving the crofters in what should have been a new tri-party contract as opposed to an extension to an existing contract with the landowners only that this would meet a 'suspected wrongdoing' test.
32. It is submitted that the appellant received an email from the Landlords indicating repairs were to be done by Network Rail who subsequently said their contract and business relationship with the Landlords ended 3 months before the date of this email (Appendix 5). This appears to show monies had been allocated either by Network Rail or the Landlords towards repairs to the road (Network Rail did say that there was nothing specific in the contract relating to the road). The appellant submits this is further evidence of 'plausible wrongdoing'.
33. The appellant submits that the existence of a contract extension has been shared with the appellant by both Network Rail and the Landlords. It is reasonable to assume a payment was made given the contract extension. The amount paid was not shared. It seems clear that a financial contribution towards road repairs is somewhere, just not with the crofters or their neighbours.
34. The appellant submits that the crofters had a legal right to have been party to any contract concerning using their road and therefore they as well as the Landlords would have been provided the value of any proposed contract. This is further evidence supporting a suspicion of wrongdoing.
35. The appellant submits that the intent behind the Agricultural Holdings (Scotland) Act 1991 cannot be that Landlords would obtain payment from public funds for allowing, without the crofters' consent, work to be undertaken by a third party which then caused significant damage to the infrastructure. Infrastructure that the burden of repair falls on the crofters (with support in the case of Portchullin from the non-crofting households). The road provides access to homes, was relied on for health and postal services and by the crofters to carry out their crofting duties.
36. It is acknowledged that the community is small, but it is an entire crofting community at Portchullin, plus the other crofting communities living on the final 15 miles of the Inverness to Kyle of Lochalsh railway line (at Strathcarron, Ardnaff, Portchullin, Plockton, Duirnish, Erbusaig and Badicaul), and any crofting communities between Inverness and Strathcarron or any crofting communities on the West Highland or North Highland railway. This would meet a wider public interest test.
37. The appellant submits that providing the information will allow the appellant to hopefully negotiate with the Landlords an appropriate amount of the public funds they are likely to have received as a contribution to the road repair.

Legal framework

38. The Environmental Information Regulations 2004 were original derived from European law and applied the provisions of Directive 2003/4/EC of the European Parliament and the Council on public access to environmental information.^[3] The relevant parts of reg.13 are:

Regulation 13 Personal data

(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if—

(a)the first condition is satisfied, or

(b)the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—

(a)would contravene any of the data protection principles, or…

39. Regulation 13(5) EIR materially provides that:-

"(5A) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that –

(a) The condition in paragraph (5B)(a) is satisfied or …

(5B) The conditions mentioned in paragraph (5A) are –

(a) Giving a member of the public the confirmation or denial –

(i) Would (apart from these Regulations) contravene any of the data protection principles , …"

40. A response neither confirming nor denying whether such information exists is referred to in this decision as a NCND response.
41. There is a presumption in favour of disclosure under the EIR under reg. 12(2). The result is that the threshold to justify non- disclosure is a high one.

Personal data

42. Personal data is defined in s 3(2) of the Data Protection Act 2018 (DPA) as:

Any information relating to an identified or identifiable living individual

43. The definition of "personal data" consists of two limbs:

i) Whether the data in question "relate to" a living individual and

ii) Whether the individual is identified or identifiable, directly or indirectly, from those data.

44. 'Identifiable' means a living individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data (NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192 (AAC)).
45. The tribunal is assisted in identifying 'personal data' by the cases of Ittadieh v Cheyne Gardens Ltd [2017] EWCA Civ 121; Durant v FSA [2003] EWCA Civ 1746 and Edem v Information Commissioner [2014] EWCA Civ 92. Although these relate to the previous iteration of the DPA, we conclude the following principles are still of assistance.
46. In Durant, Auld LJ, giving the leading judgment said at [28]:

"Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated."

47. In Edem Moses LJ held that it was not necessary to apply the notions of biographical significance where the information was plainly concerned with or obviously about the individual, approving the following statement in the Information Commissioner's Guidance:

"It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him."

48. The High Court in R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) & Northumbria Police [2013] EWHC 2575 held, whilst acknowledging the Durant test, that a Court should also consider:

"(2) Does the data "relate" to an individual in the sense that it is "about" that individual because of its:

(i) "Content" in referring to the identity, characteristics or behaviour of the individual?

(ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?

(iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)?

(3) Are any of the 8 questions provided by the TGN applicable?

These questions are as follows:

(i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller?

(ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession?

(iii) Is the data 'obviously about' a particular individual?

(iv) Is the data 'linked to' an individual so that it provides particular information about that individual?

(v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?

(vi) Does the data have any biographical significance in relation to the individual?

(vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?

(viii) Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)?

(4) Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?"

49. Article 5(1) UKGDPR provides that personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation');

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');

…

50. In order to be lawful, one of the lawful bases of processing in article 6(1) UKGDPR must apply. The only potentially relevant basis here is article 6(1)(f):

Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.

51. The case law on article 6(1)(f)'s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:

1. Is the data controller or a third party pursuing a legitimate interest or interests?

2. Is the processing involved necessary for the purposes of those interests?

3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

Evidence

52. We read an open and a closed bundle. The closed bundle contains information that would undermine the Council's NCND response and therefore it is necessary for this information to be withheld from the appellant otherwise the purpose of the appeal would be defeated.

Issues

53. The issues under regulation 13 are:

53.1. Would confirming or denying that the information was held disclose personal information?

53.2. Would confirming or denying that the information was held be lawful and fair?

53.3. Are the conditions in 6(1)(f) met i.e.

53.3.1. Is the data controller or the third party or parties to whom the confirmation or denial would be made pursuing a legitimate interest or interests?

53.3.2. Is the processing involved necessary for the purposes of those interests?

53.3.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

The role of the tribunal

54. The tribunal's remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner's decision involved exercising discretion, whether he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Discussion and conclusions

55. It is not in dispute that the EIR is the appropriate regime, and that would have been our conclusion in any event.

Personal data

56. When considering what information would be revealed by an NCND response, we must take account of information that would be revealed either by a confirmation or by a denial.
57. The request is for the amount that was paid to only the Landlords on the 'extension part of the contract'. We find that the information that would have been revealed by a confirmation that the requested information was held ('the revealed information') would have been:

57.1. That an amount was paid to the Landlords in relation to the extension part of the relevant contract.

58. We should note here that Network Rail may have issued a denial, but we have to take account of the consequences of either type of response. References below to the 'revealed information' should be read with that in mind, i.e. that it cannot be assumed on the basis of our decision that there was, in fact, any amount paid to the Landlords.
59. Although the existence of some sort of contract between Network Rail and the Landlords is already publicly known (since the work could not have proceeded without an agreement of some variety), we find that the revealed information is not in the public domain.
60. The appellant argues that the revealed information is not personal data given landlord/crofter duties and responsibilities and because the appellant should have been invited to be one of the parties to a contractual agreement. This argument is also relevant to the Landlord's reasonable expectations of privacy, and we deal with it below.
61. The question of whether or not the revealed information is personal data is determined by asking if the information relates to an identified or identifiable living individual.
62. Data can 'relate to' the identifiable living individual, whether in personal or family life, business or profession. We do not accept that the statutory background of landlord/crofter duties and whether the appellant should have been a party to the contract are relevant to whether or not the revealed information is personal data. In our view the question of whether or not an amount was paid to the Landlords is clearly about the individual landlords.
63. The Landlords would, in our view, be identifiable from contextual information in the request, information publicly known by the local community and information released to the world by Network Rail in response to other freedom of information requests by the appellant.
64. For those reasons we find that the revealed information would be personal data.

Legitimate interests

65. When we consider the question of the legitimate interest in confirmation or denial, we accept that confirmation or denial acts as a gateway to the information itself, if held. For those reasons we consider it is also legitimate to take account of the legitimate interests in the information itself, if held.
66. The appellant submits that there is a legitimate interest in knowing the fee that was paid to the Landlords because:

66.1. The crofters could seek a fair percentage of this from their Landlords to help with repairing the crofter's road properly and not have to consider taking on additional expense in seeking a legal remedy.

66.2. The road needs to be repaired to re-establish access for essential services (emergency and postal).

66.3. There is evidence of wrongdoing by Network Rail:

66.3.1. they did not identity correctly who owned the road,

66.3.2. they did not consider crofting legislation,

66.3.3. they did not have the correct planning consent,

66.3.4. they accepted a 'sign off' by parties who stood to gain financially from public funds but did not include the owners of or the community served by the road,

66.3.5. the Landlords have stated in an email that Network Rail were going to contribute to repairs, but Network Rail have said that there was no specific mention of the road in the contract extension.

66.4. The wrongdoing is a matter of public interest and of wider consequence than just this crofting community.

67. We accept that all these amount to legitimate interests, without having to make any ruling on whether or not Network Rail were guilty of any wrongdoing, which is outside our jurisdiction.

Necessity

68. We can understand that the appellant would like to have the information to use as a 'negotiating lever' in her discussions with the Landlords, and it is understandable that the crofters do not wish to incur additional expense in seeking a legal remedy. We do not accept that it is reasonably necessary for the appellant to know if the Landlords received a fee, and if so, what that fee was, for the purposes of seeking or negotiating a fair contribution to the costs of repair. The crofters can do this without that knowledge. The fee for a contract is not the same as compensation for damage. We accept that knowing the fee might add to the crofters' ammunition, but it is not, in our view, reasonably necessary. For those reasons it is also not reasonably necessary to achieve the legitimate interests of getting the road repaired. The road can be repaired without this knowledge.
69. The crofters might wish to avoid the costs of legal proceedings, but if they are correct that their rights have been breached, then it is likely that legal avenues would be available to them. Those legal avenues a likely to include provision for disclosure of relevant documents whether pre-action or during the proceedings. The appellant or the crofting community are not prevented from enforcing their legal rights by not having access to the requested information.
70. Further, if there has been wrongdoing by Network Rail, they can be made accountable for this through other avenues.
71. For example, at the relevant time the appellant was pursuing a complaint to the independent complaints assessor who was able to consider whether Network Rail should review the relationship between crofting legislation and common law and the implications for any future works on land used by crofters. Although the outcome of that complaint was not available at the relevant time, we note that the assessor was also able to make a recommendation that Network Rail ask its own lawyers to undertake that review, and that Network Rail had confirmed that it would do so.
72. Another avenue pointed out to the appellant by Network Rail is that it is open to the crofters to make a claim for compensation against Network Rail, if they have damaged a road owned by the crofters. There are likely to be other legal avenues available if the crofters' legal rights have been breached.
73. In contrast, we find that revealing publicly whether or not Network Rail paid these particular Landlords a fee for this contract contributes very little, if anything, to Network Rail's accountability for any wrongdoing and contributes very little, if anything to transparency in relation to any wrongdoing. We find that disclosure would not be reasonably necessary for those purposes.
74. For those reasons, whilst we accept that there are a number of legitimate interests, we do not accept that disclosure is reasonably necessary for the purposes of those interests.
75. For that reason, subject to the next paragraph, confirming or denying that the information was held would have contravened one of the data protection principles.
76. We note that Network Rail accept that confirming whether or not they hold the requested information would be reasonably necessary for the specific narrow interest of the public investigating whether, if a fee was paid under this contract, that public money was spent responsibly. They accept that confirming or denying would be reasonably necessary for those purposes because there is no other means for the public in general to know whether a fee was paid and if so, what that fee was. This is not a legitimate interest relied on by the appellant. However, we accept that there is a legitimate interest in general transparency in relation to any spending of public money, and for that legitimate interest in relation to this specific expenditure we find that it is reasonably necessary to know whether that money was spent and how much money was spent.

Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

77. Because we have found that disclosure is not reasonably necessary for most purposes, we do not need for those purposes to go on to consider if the legitimate interests are overridden by the fundamental rights and freedoms of the data subjects. If we had had to consider this issue, we would have concluded that they were overridden. In summary, this would have been for the following reasons.
78. We note in particular the following:

78.1. The Landlords have objected to their personal information being made public.

78.2. We do accept that the statutory framework underpinning crofting and the duties and responsibilities placed on crofters and landlords does lends a public element to the relationship, that is not normally present in private landlord/tenant relationships.

78.3. However, whilst the information relates to a contract and the individuals are acting in the capacity of landlords, given the factual background the information is more closely related to their personal and private lives than to their professional or business lives than it would be, for example, for larger landlords with multiple properties who run it as their full-time occupation business.

79. Taking all that into account, we would have concluded that the Landlords would have had a reasonable expectation that their personal data would not have been made public. In addition, we find that there is some risk of distress for the reasons set out in the closed annex.
80. Given the limited value of the revealed information and the requested information, if held, in serving the legitimate interests, we would have found that those legitimate interests were overridden by the fundamental rights and freedoms of the data subjects.
81. We turn now to the general interest in transparency in relation to the spending of this particular amount of public money, in relation to which we have accepted that confirmation or denial is reasonably necessary. We take account of the limited impact of confirming or denying on the wider public interest issues. Further, we note that the public has the ability to scrutinise the spending of public money more broadly through Network Rail's Annual Report and Transparency pages and that Network Rail's spending is scrutinised by the Regulator.
82. Taking into account the factors set out above in paragraphs, we find that the legitimate interest in transparency in relation to the spending of an isolated sum of money in relation to one particular contract is overridden by the fundamental rights and freedoms of the data subjects.
83. For those reasons, we find that confirming or denying that the information was held would have contravened one of the data protection principles and we find that Network Rail was entitled to give an NCND response.

Signed Sophie Buckley

Judge of the First-tier Tribunal

Date: 5 February 2024

Note 1   https://www.crofting.org/about-scf/about-crofting/#     [Back]

Note 2   https://www.crofting.org/about-scf/about-crofting/#    [Back]

Note 3   The Environment Information (Scotland) Regulations 2004 only apply to Scottish Public Authorities and so the EIR are the appropriate regulations in this appeal.     [Back]