When to refuse to confirm or deny holding information

Example

In Haywood v Information Commissioner (EA/2021/0031P, 22 April 2021), the First-tier Tribunal said that the authority should have responded to the request by applying the neither confirm nor deny exemption of section 40(5A) of FOIA (personal information).

The applicant had submitted a request to the Department for Work and Pension (‘DWP’) about surveillance he said had been carried out on him.

The DWP had originally confirmed holding some information but refused to provide it, stating it was exempt under section 40(1) of FOIA.

At para. 23, the First-tier Tribunal said:

“[t]he DWP should have dealt with this matter under s40(5A) [of] FOIA and neither confirmed nor denied whether it held the information requested, as the fact that the DWP does hold information is in itself a disclosure of the Appellant’s personal information.”

Example

In Commissioner of the Police of the Metropolis v Information Commissioner (EA/2010/0008, 23 May 2010), the First-tier Tribunal explained the purpose of an NCND response as follows:

“Part 2 of FOIA provides exemptions from the duty to confirm or deny (s.1(1)(a)) in almost all cases where there is an exemption from the duty to supply information (s.1(1)(b)). The object of such a refusal is, of course, to protect the public authority from the drawing of inferences, whether from a confirmation or a denial, which might cause the same kind of prejudice as disclosure of the exempt information. The fact that exempt information is or is not held may often be a clue as to all or some of its content, or, where such information is protected, its origin. A denial in response to one request will enable a later requester to draw the obvious conclusion, if no denial is then forthcoming” [para. 4].

Example

In APPGER v Information Commissioner and FCO (EA/2011/0049-0051, 12 April 2012), the First-tier Tribunal noted:

“It is in the nature of NCND that it covers circumstances in which information is not held, as well as circumstances in which information is held. It can be used to protect sources, and to avoid inferences being drawn from acknowledgement of the fact that certain information is not held. Moreover if NCND could not be used in circumstances in which information was not held, there would be little point in it, as it would then amount to an acknowledgement that information was held” [para. 104].

Example

In Donnie Mackenzie v Information Commissioner (EA/2013/0251, 7 July 2014), the First-tier Tribunal decided that the Information Commissioner’s decision notice had correctly found that the authority was entitled to rely on section 26(3) because confirmation or denial would prejudice the capability effectiveness of British forces (section 26(1)(b)).

The applicant had submitted a request for information to the Ministry of Defence (MoD), asking for a detailed list of technologically advanced weapons the authority might or might not have.

The MoD responded by refusing to confirm or deny whether it held any information by relying on section 26(3).

The Information Commissioner found that the authority had correctly applied the exemption because a confirmation or denial could allow enemy forces to glean information about the capability of British armed forces to identify any potential weaknesses. The Commissioner also found that – although there was a public interest in the public being informed about the potential use of such weapons – the public interest balance strongly favoured maintaining the exclusion of the duty to confirm or deny under section 26(3).

The First-tier Tribunal decided that the decision notice was correct in law. At para. 10, the Tribunal concluded:

“Details of any UK capability in this area or the absence of capability in this area would be of considerable interest to any hostile power and would assist that power in devising counter-measures or give it reassurance that no counter measures were necessary. It would remove uncertainty and assist in the planning or execution of any hostile action. This would therefore prejudice the capability effectiveness and security of British forces.”

The Tribunal also accepted the Commissioner’s findings about the public interest balance.

Example

In Decision Notice FS50836455, the Information Commissioner found that the authority was entitled to rely on section 38(2) by virtue of section 38(1)(b) to refuse to confirm or deny holding the requested information. The Commissioner also concluded that the public interest favoured maintaining the exclusion from the duty to confirm or deny.

The applicant had submitted a request for information to the Greater London Authority (GLA), asking whether the Mayor of London Sadiq Khan had an official car and the cost of providing it.

The GLA refused to confirm or deny holding the requested information. During the Commissioner’s investigation, the authority further argued that the GLA had a consistent and well-established policy of neither confirming nor denying holding this type of information. This was based on the fact that confirmation or denial could provide valuable intelligence about the Mayor’s travel arrangements. This, in turn, could potentially compromise the effectiveness of the security measures around those arrangements and, consequently, endanger the Mayor’s safety.

At para. 25, the Commissioner decided:

“There is a causal link between confirming whether or not the GLA holds the requested information and harm occurring to the Mayor’s safety. This is because the Commissioner accepts a statement confirming or denying whether the requested information was held is likely to be taken to imply whether or not the Mayor uses a vehicle. Moreover, the Commissioner agrees with the GLA’s argument that any such information would be a potentially valuable piece of intelligence to those looking to harm the Mayor. (…) the Commissioner notes that the threats to the Mayor are clearly ones that are actual and real. In her view, given the potential insight complying with section 1(1)(a) of FOIA would provide to any would be attackers, the Commissioner accepts that the risk of harm occurring is clearly one that is more than hypothetical. Furthermore, the Commissioner agrees with the GLA that it is necessary to adopt a consistent NCND approach given the wording of this request.”

When considering the public interest balance, the Commissioner accepted that there was some public interest in the public authority confirming whether it holds information about the travel arrangements of Sadiq Khan. However, at para. 31, the Commissioner concluded:

“There is a very strong public interest in ensuring the safety of individuals. In the circumstances of this case, given the real and present threat to the safety of the Mayor she is firmly of the view that the balance of the public interest favours maintaining the exemption contained at section 38(2).”

Example

In Decision Notice IC-46074-B721, the Information Commissioner decided that the public authority was entitled to rely on section 24(2) for the purpose of safeguarding national security.

The applicant had submitted a request for information to the Cabinet Office about climate change. The Cabinet Office identified that the information might be held by the National Resilience Capabilities Programme or the National Security Council.

The authority responded by refusing to confirm or deny holding the requested information. It relied on both section 24(2) and its EIR equivalent (reg. 12(6) by virtue of reg. 12(5)(a)).

The Cabinet Office explained that a confirmation or denial that information was held could give rise to inferences being drawn about the level of importance assigned to climate change in the context of the development of the UK’s national security strategy, ie any priority contingency planning in the event of a national emergency. The Cabinet Office argued that this intelligence could prove valuable to ‘hostile actors’ and enable them to “build a picture of potential weaknesses in the UK’s national security strategy. This could put the general public at risk, and also hamper any government response to an emergency.” [para. 23].

The Commissioner accepted the authority’s line of argument as valid and was satisfied that the exemption from the duty to confirm or deny was reasonably necessary for the purpose of safeguarding national security.

The Commissioner also found that the public interest in maintaining the exemption from the duty to confirm or deny outweighed the public interest in confirming information was held. At para. 30–31, the Commissioner argued that:

“Climate change may result in extreme weather events which would have practical negative consequences for the country which may be short or long term. There is a strong public interest in knowing whether this has been considered as a matter of national security as well as, for example, an economic issue. However, the Commissioner recognises that confirmation or denial would create a potential for bad actors to exploit knowledge of the UK’s national security priorities. This is contrary to the public interest such that it outweighs the public interest in providing that confirmation or denial.”

Example

In Decision Notice IC-50103-M2K3, the Information Commissioner decided that the authority was not entitled to rely on section 44(2) to refuse to confirm or deny holding information relevant to the request.

The applicant had submitted a request for information to the Financial Conduct Authority (FCA) and asked for copies of correspondence it had sent to a particular company.

Among other exemptions, the FCA relied on section 44(2) and issued an NCND response. The authority identified as the relevant limb of the exemption section 44(1)(a) – ie the exemption from the duty to confirm or deny arose because compliance with section 1(1)(a) would involve a disclosure prohibited under another Act. In this case, the relevant piece of legislation was the Financial Services and Markets Act 2000 (FSMA), which the FCA stated prohibits disclosure of information classed as ‘confidential’.

The Commissioner agreed with the FCA that the FSMA was the relevant piece of legislation setting forth a statutory bar on disclosure of certain type of information.

However, at para. 46, the Commissioner explained:

“When determining whether a statutory bar requires a neither confirm nor deny response, the Commissioner is not required to consider what the hypothetical contents of any information that existed might be (if in fact the information existed). Her role is to determine whether the mere act of issuing a confirmation or a denial that information is held would in itself result in the disclosure of information that would engage the statutory bar.”

In this case, the Commissioner found that a confirmation or denial would not reveal anything about the nature of instructions issued by the FCA to the company nor about any information classed as ‘confidential’ which the FCA might have received by a third party [para. 50].

Consequently, the Commissioner decided that the statutory bar was not engaged and the FCA was not entitled to rely on section 44(2) as a result [para. 55].

Example

In Maurizi v Information Commissioner and the Crown Prosecution Service (EA/2017/0041, 12 December 2017), the First-tier Tribunal decided that the authority was entitled to rely on section 30(3) because – if it were to hold any information relevant to the request – this information was likely to be exempt information by virtue of section 30(1)(c). That is, criminal proceedings the authority has the power to conduct. The Tribunal also decided that the public interest balance lay in maintaining the exemption from the duty to confirm or deny.

The applicant had submitted a request for information to the Crown Prosecution Service (CPS). The request concerned the case of Julian Assange who was the subject of extradition proceedings conducted by the CPS on behalf of the Swedish Prosecution Authority. At the time, Mr Assange was under the protection of the Ecuadorean embassy in London. The applicant had requested a copy of correspondence on the case between the CPS, the Ecuadorean authorities and the US authorities.

The authority explained that the CPS had a long-standing policy of neither confirming nor denying holding information about extradition proceedings until the person to extradite is arrested. The CPS argued the aim of the policy was to avoid ‘tip-offs’ and “prevent the subject of a request learning about it in advance, and giving them the opportunity to evade justice by leaving the jurisdiction or otherwise seeking to avoid arrest” [para. 77]. The authority also stressed the importance of applying this policy consistently.

The Tribunal accepted the CPS’s arguments and found that section 30(3) was engaged. It concluded that – if the CPS held any information on the case – this would likely be about extradition. At para. 50, the Tribunal noted that “[E]xtradition proceedings are a form of criminal proceedings which the CPS has power to conduct”. Consequently, it found that the CPS was entitled to rely on section 30(3) to refuse to confirm or deny holding information which, if held, would be exempt by virtue of section 30(1)(c).

The Upper Tribunal upheld the decision of the First-tier Tribunal.

Example

In The Commissioner of the Police of the Metropolis v Information Commissioner & Rosenbaum ([2021] UKUT 5 AAC, 7 January 2021), the Upper Tribunal (‘UT’) concluded that a confirmation or denial would reveal information ‘relating to’ the Security Service, which is a body listed in section 23(3). As a result, the UT found that the authority was entitled to rely on section 23(5) to refuse to confirm or deny holding any information within scope.

The applicant had submitted a request for information to the Commissioner of the Police of the Metropolis (MPS), asking for all information held by the previously named Special Branch about a far-right political party in the years 1974, 1975 and 1983.

In 2006, the functions of the Special Branch had been incorporated within a police unit called Counter Terrorism Command. One of the most important intelligence partners of this unit was the Security Service.

On appeal, the UT decided that the First-tier Tribunal had correctly found that the MPS’ confirmation or denial would reveal information ‘relating to’ the Security Service. As this information is exempt from disclosure, the UT found that section 23(5) was engaged. Therefore, it decided that the MPS was entitled to refuse to confirm or deny holding the information.

Example

In Decision Notice IC-39648-L7Y3, the Information Commissioner decided that the authority was entitled to cite section 40(5B)(a)(i) to refuse to confirm or deny holding the information because doing so would breach the data protection principles.

The applicant had submitted a request for information to the Department for Education (DfE) asking for information about complaints made against Dominic Cummings while he was working as a special adviser in the Department.

In reaching a decision about whether 40(5B)(a)(i) was engaged, the Information Commissioner first considered whether the DfE’s confirmation or denial would reveal any third party’s personal information.

At para. 20, the Commissioner said that to be “satisfied that confirming or denying whether the information is held would result in the disclosure of a third party’s personal data because the request clearly names an identifiable living individual, Dominic Cummings. (…) If the DfE confirmed that it did hold information then that would confirm that Dominic Cummings had been the subject of complaint. If the DfE denied that it held any information falling within scope, that would mean that he had not been the subject of a complaint. Either response reveals personal biographical details and is therefore personal data.”

It was only after addressing this preliminary point that the Commissioner moved on to consider whether providing confirmation or denial would contravene the data protection principles, in line with section 40(5B)(a)(i) of FOIA. In this case, the Commissioner found that the exemption was engaged.

Example

In Savic v Information Commissioner, Attorney General’s Office and Cabinet Office ([2016] UKUT 535 (AAC), 30 November 2016), the Upper Tribunal (UT) decided that the Cabinet Office was not entitled to rely on section 35(3) to refuse to confirm or deny holding the information. The UT made this finding on the basis that the authority carried out the public interest test incorrectly because it assessed competing public interest arguments by reference to the contents of the information and the consequences of its disclosure.

Building on the First-tier Tribunal’s decision in APPGER, the UT noted [para. 46–47]:

“the test set by section 2(1)(b), which relates to NCND, is significantly different to that set by section 2(2)(b), which arises only when the public authority has confirmed that it holds information and claims that the information requested should not be provided because an exemption that is not an absolute exemption applies (…)

“the statute clearly provides that:
an approach to the public interest arguments on NCND that fails to properly recognise that they are different to those relating to disclosure of the contents of the information of the statutory description in respect of which an NCND response has been given is incorrect.”

In this case, the UT decided that the Cabinet Office introduced an “impermissible contents argument” [para. 70] at the NCND stage. This was because it based the public interest considerations on the effects of disclosing the information and on reliance on the principle of collective responsibility.

At para. 71, the UT concluded that this was impermissible “because both are founded on harm arising from disclosure of the contents of Cabinet discussions and not on simply whether a topic or topics was or was not discussed at Cabinet”.

Consequently, the UT decided that the authority had not applied the public interest test as defined by section 2(1)(b). It found that the Cabinet Office was not entitled to rely on section 35(3) because the public interest in maintaining the NCND exclusion did not outweigh the public interest in disclosing whether the authority held the information.

Example

In the Decision Notice IC-46074-B721 examined above, the Information Commissioner noted:

“The information described in the requests could well include both environmental and non-environmental information and therefore, regardless of whether it is actually held or not, the Cabinet Office should consider the requests under both pieces of legislation.” [para. 11]

Therefore, the Commissioner focused the investigation on whether the authority was entitled to refuse to confirm or deny on the basis of the NCND provisions in both FOIA and the EIR, ie section 24(2) and its EIR equivalent reg 12(6) by virtue of reg. 12(5)(a).

Example

The Financial Services Authority receives a request for information:

Example

In the Savic case examined above, the Upper Tribunal noted that, although framed in wide terms, the request was seeking information about a “defined decision” [para. 7] as recorded in Cabinet minutes.

At para. 28–29, the Tribunal commented:

“it seems to us that the terms of the CO Request for Cabinet records, and so expressly of a level of decision-making, for the announced decision to commence a military air campaign has given rise to some of the problems that have arisen in the way in which the NCND response has been advanced in respect of the Cabinet minutes.

“It seems to us that in many cases when reliance is placed on section 35(1)(a) or (b) in respect of a request for information about either (a) a decision that has been announced by a Secretary of State or his Department, or (b) a decision with which a Department has an obvious connection and responsibility, that the connection between the decision and the public authority is such that an initial response of NCND would be unreal and so an NCND argument based on section 35(3) would be rare.”

Example

In the Rosenbaum example cited above, the Upper Tribunal concluded that – although there was already information in the public domain – the authority’s official confirmation would allow the public to draw inferences about the Special Branch’s interest in a far-right political party. As a result, the Tribunal decided that the authority was entitled to respond by refusing to confirm or deny holding the information.

The applicant had challenged the authority’s response on the basis that what would be revealed by a confirmation or denial was already in the public domain. The applicant pointed to the existence of a BBC documentary that contained interviews with former Special Branch’s officers about using Security Service agents to infiltrate the party.

The Upper Tribunal rejected this argument. It stated that:

“there is a qualitative difference between credible third party information and official confirmation of that information. (…) The provision of official confirmation by means of a ‘yes’ or ‘no’ answer that that information was held would provide a qualitatively different foundation for the drawing of inferences from that provided by the unconfirmed information contained in the TV programme.” [para. 57].

Example

In the Maurizi example cited above, the authority had a longstanding policy of neither confirming nor denying holding information about extraditions which it consistently applied over time regardless of whether or not information was, in fact, held or not held.

At para. 84–85, the First-tier Tribunal stated:

“It is plain that the public purposes of the power to bring extradition proceedings would be undermined if there were not a generally consistent NCND policy so as to prevent express or implied tip-offs. In the present context the relevant purpose of the statutory exemption in s30(3) is to enable such a policy to be followed.

“In [the] Manzarpour [case] at [10] it was said: ‘Unless the same answer – neither confirm nor deny (NCND) – is given in every case then an inference will inevitably be drawn by the questioner in a given case from a refusal to answer’”.

On appeal, the Upper Tribunal also endorsed the importance of maintaining a consistent approach when dealing with information requests about extradition.

Example

In Decision Notice FS50225088, the Information Commissioner found that the authority was correct to confirm it held some information while citing section 35(3) to refuse to confirm or deny holding other information relevant to the request.

The applicant had submitted a request to the Ministry of Justice (MoJ), asking for information about the legal interpretation of the 1949 Marriage Act and of the Human Rights Act. The request was submitted at the time of the impending marriage of the Prince of Wales and Camilla Parker-Bowles.

The MoJ had issued a ministerial statement on the marriage, saying it was lawful for the Prince of Wales and Mrs Parker-Bowles to marry by a civil ceremony. The version of the Ministerial Code existing at the time stated that the Government had to consult the Law Officers before making critical decisions involving legal considerations.

The MoJ responded to the request by confirming it held some information relevant to the request, although it relied on section 42(1) [legal professional privilege] to withhold it. Regarding the provision of the Law Officers’ advice, the authority cited section 35(3) to refuse to confirm or deny holding the information.

The Commissioner found that the MoJ dealt appropriately with the request.

Example

In the Maurizi case, the Upper Tribunal (UT) decided that the First-tier Tribunal was entitled to find that – were the CPS to hold any information – this would likely be extradition-related correspondence. Based on this, the UT held it was correct to limit the scope of the NCND public interest balancing exercise by reference to this hypothetical information.

The First-tier Tribunal had looked at what correspondence – based on the balance of probabilities – the CPS was likely to hold in light of its ‘proper role’. On appeal, the applicant had challenged this approach and argued that the First-tier Tribunal had applied a flawed hypothesis. In the applicant’s view, this had resulted in a higher likelihood of section 30(3) being engaged.

The Upper Tribunal rejected the applicant’s appeal. In reaching this finding, the UT relied on the oral evidence presented by the CPS. The authority submitted that the only correspondence it was likely to receive from a foreign state would be correspondence about extradition. As a result, the UT concluded that the First-tier Tribunal was right to find that – were any correspondence held by the CPS – this would necessarily be about extradition. The UT also decided that the First-tier Tribunal was correct to find that, based on that supposition, the authority was correct to cite section 30(3) to refuse to confirm or deny holding the information.