ICO FOIA Decision Notice FS50216168 against HM Revenue and Customs ordering disclosure of tax record Special Categories

Reference FS50216168

Freedom of Information Act 2000 (Section 50)

Decision Notice

Date: 25 January 2010

Public Authority: HM Revenue and Customs

Address: 100 Parliament Street
London
SW1A
2BQ

Complainant: [redacted]
Address: [censored]

Summary

---

The complainant requested information from HM Revenue and Customs (HMRC) about the tax categories of people for whom security is a higher priority. HMRC refused the request citing the exemptions at sections 23 (information supplied by, or relating to, bodies dealing with security matters), 36 (prejudice to effective conduct of public affairs) and 38 (health and safety). During the course of the Commissioner's investigation, HMRC additionally cited sections 40 (personal information) and 44 (prohibitions on disclosure) in relation to some of the withheld information.

The Commissioner has investigated and found that the exemptions at sections 23 and 44 are engaged in relation to some of the withheld information. As the information withheld under section 40 was also withheld under section 44, having found section 44 engaged, the Commissioner has not considered the application of section 40, The Commissioner does not find the exemptions at sections 36 and 38 engaged and therefore orders release of the information withheld only under these exemptions. The Commissioner has also identified a series of procedural shortcomings on the part of the public authority relating to delay (sections 10(1) and 17(1)).

The Commissioner's Role

---

1.The Commissioner's duty is to decide whether a request for information made to a public authority has been dealt with in accordance with the requirements of Part 1 of the Freedom of Information Act 2000 (the 'Act"). This Notice sets out his decision.

Background

---

2. During Treasury Oral Answers on 24 January 2008, in relation to a question
about the filing of tax returns online, the Financial Secretary to the Treasury said 'There are categories of individual for whom security is a higher priority. Not just Members of Parliament - there are several categories of people in that position and HMRC does not have the facilities for them to file online.

3. An article was published in the Daily Telegraph on 26 January 2008 entitled 'Online tax system "too risky" for the famous'. This quoted the above comment made by the Financial Secretary to the Treasury.

4. HM Revenue & Customs (HMRC) is a non-ministerial department, making it different from most other government departments, which work under the direct day-to-day control of a minister. The Queen appoints Commissioners of HMRC who have responsibility for handling individual taxpayers' affairs impartially, providing leadership to the Department, managing its resources and delivering the objectives and targets set by the Chancellor of the Exchequer.

5. The Commissioners for Revenue and Customs Act 2005 Act (CRCA) is the Act of Parliament that created HM Revenue and Customs in April 2005. The legislation applies to all HMRC officers, whether they were former Inland Revenue or former Customs and Excise staff. The CRCA replaces former legislation on information sharing between the two predecessor departments such as section 127 of the Finance Act 1972. It also applies to all information in the new department, even information gathered prior to April 2005. The CRCA sets out what use HMRC may make of its information and the specific circumstances when it may disclose the information.

The Request

---

6. The complainant wrote to HM Revenue and Customs (HMRC) on 28 January 2008 requesting information about the tax categories of individuals for whom security is a higher priority.

'Regarding the story in the Daily Telegraph newspaper of Saturday 26 January 2008 about the security, privacy and confidentiality of tax returns and the Parliamentary Oral Answer given by the Financial Secretary to HM Treasury

1) Please list these special "categories of individual for whom security is a higher priority"
2) Approximately how many people are in each special category?
3)Who exactly makes the decision to to put someone into one of these special categories ?
4) When, if ever, is an individual removed from such a special category? 5) Does a special category extend to an individual's family as well?
6) How long has this policy of special categories been in place ?
7) Who exactly authorised this special category policy?
8) How exactly does adding an extra digit to a tax code or other special markings to a paper tax return, make it less of a target for human snooping or electronic sniffing of the data once it is in digital form? Surely this contravenes the well established security principles for handling 'sensitive' data whilst it is sharing common office or electronic network infrastructure ie that it should be indistinguishable from the rest of the data or documents, to reduce the temptation to casual snoopers ?
9) What about the previous 24 year tax record history of an individual before they become a 'celebrity' or politician etc?
10) Are these special category tax records included in the datasets handed over, through the statutory gateway, to the DWP Longitudinal Study? http://www.dwp.gov.uk/asd/longitudinal_study/ic_longitudinal_study.asp
11) What is the approximate annual cost of the extra infrastructure and personnel resources needed to handle these special categories?'

7. HMRC responded on 6 March 2008. In relation to items 1, 2, 3, 4, 5 and 9, the information was refused on the basis that it was exempt from disclosure by virtue of the exemptions at sections 23, 36(2)(c) and 38(1 )(a) and (b) of the Act. Different exemptions applied to different elements of the withheld information. HMRC provided responses to items 8, 10 and 11 and advised the complainant that it did not hold information in relation to items 6 and 7.

8. Having conducted an internal review, HMRC upheld its decision on 29 September 2008, confirming that the withheld information remains exempt by virtue of sections 23, 36(2)(c) and 38(1 )(a) and (b) of the Act.

The Investigation

---

Scope of the case

9. On 29 September 2008 the complainant contacted the Commissioner to complain about the way his request for information had been handled. In his correspondence, the complainant specifically requested the Commissioner to examine HMRC's use of the exemptions. The Commissioner has therefore focussed his investigation on those elements of the request to which exemptions have been applied, namely items 1, 2, 3, 4, 5 and 9.

Chronology

10. Unfortunately, due to a backlog of complaints at the Commissioner's office about compliance with the Act, there was a delay of almost ten months before his investigation into this complaint got underway. The Commissioner wrote to HMRC on 27 July 2009 asking it to clarify which exemptions it was applying to which elements of the requested information. He also asked HMRC to provide further information about its decision to cite the exemptions and how it conducted the public interest test.

11. HMRC responded on 23 September 2009, confirming its application of the exemptions in sections 23, 36, and 38 of the Act in relation to items 1, 2, 3, 4, 5 and 9 of the requested information. Different exemptions applied to different elements of the withheld information

12. HMRC provided the Commissioner with further evidence in support of its argument that the requested information is exempt from disclosure on 9 October 2009.

13. On 25 November 2009 HMRC wrote to the Commissioner additionally citing section 44(1 )(a) and section 40(2) in relation to some of the withheld information.

Analysis

---

Exemptions

Section 23 Information supplied by or relating to bodies dealing with security matters

14 In this case, HMRC is citing section 23(1) in relation to some of the requested information. Section 23(1) states:

'Information hold by a public authority is exempt information if it was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).'

15. Having viewed the information withheld under this exemption, the Commissioner is satisfied that it is likely to have been supplied by, or relate to, bodies dealing with security matters. The Commissioner is prepared, in limited circumstances, to accept the assurance of a senior official that information withheld under section 23(1) has indeed been supplied by or is related to security bodies specified in section 23(3). He will only do so where the official occupies a position in relation to the security bodies which allows them genuinely to validate the provenance of the information, and where the official is independent of the public authority's process for dealing with freedom of information requests.

16. The Commissioner is satisfied that the Director General Personal Tax in HMRC occupied such a position in this case. Accordingly he has concluded in the light of the representations made about the information, his own inspection of it and all the circumstances of the case that the information withheld by HMRC under section 23(1) engages the exemption.

17. Since section 23(1) is an absolute exemption no public interest test applies and the Commissioner has therefore concluded that it is appropriate for HMRC to withhold the information to which this exemption has been applied.

Section 44 Prohibitions on disclosure

18. The Commissioner has next considered the information which HMCS considers exempt by virtue of section 44 (1). This section of the Act provides that:

'Information is exempt information if its disclosure (otherwise than under this Act) by the public authority holding it-fa) is prohibited by or under any enactment,

(b) is incompatible with any Community obligation, or

(c) would constitute or be punishable as a contempt of court.'

19. In relation to some of the withheld information relating to parts of the request in this case. HMRC is arguing that disclosure is prohibited under enactments, namely the Commissioners for Revenue and Customs Act 2005 (CRCA) and the European Convention of Human Rights. In other words, that some of the information referred to in the request is exempt from disclosure by virtue of section 44(1 )(a).

20. The Commissioner has first considered the argument put forward by HMRC that the information withheld under this exemption is prohibited from disclosure by virtue of section 18(1) and section 23 of the Commissioners for Revenue and Customs Act 2005 (CRCA).

21. Section 18(1) of the CRCA states that:

'Revenue and Customs officials may not disclose information which is held by the Revenue and Customs in connection with a function of the Revenue and Customs'.

Section 18 (2) sets out some exceptions to the prohibition on disclosure at section 18(1) as follows:

'But subsection (1) does not apply to a disclosure --

(a) which -

(I) is made for the purposes of a function of the Revenue and Customs, and

(ii) does not contravene any restriction imposed by the
Commissioners,

(b) which is made in accordance with section 20 or 21,

(c) which is made for the purposes of civil proceedings (whether or not within the United Kingdom) relating to a matter in respect of which the Revenue and Customs have functions,

(d) which is made for the purposes of a criminal investigation or criminal proceedings (whether or not within the United Kingdom) relating to a matter in respect of which the Revenue and Customs have functions,

(e) which is made in pursuance of an order of a court,

(f) which is made to Her Majesty's Inspectors of Constabulary, the Scottish inspectors or the Northern Ireland inspectors for the purpose of an inspection by virtue of section 27,

(g) which is made to the Independent Police Complaints Commission, or a person acting on its behalf, for the purpose of the exercise of a function by virtue of section 28, or

(h) which is made with the consent of each person to whom the information relates'.

Section 18(3) states that:

'Subsection (1) is subject to any other enactment permitting disclosure'.

22. The Commissioner considers that subsections (a) and (h) are the potentially relevant subsections in this case.

23. With reference to section 18(2) of the CRCA, the Commissioner does not consider that complying with the Freedom of Information Act is a function. Although there is no evidence that consent has been sought in this case, the Commissioner notes that there is no obligation upon the public authority to seek consent for the release of the information.

24. With reference to HMRC's citing of section 44(1) of the Act, section 23 of the CRCA is also relevant as it makes specific reference to the Freedom of Information Act. Section 23 of the CRCA states that:

'(1) Revenue and customs information relating to a person, the disclosure of which is prohibited by section 18(1), is exempt information by virtue of section 44(1 )(a) of the Freedom of Information Act 2000 (prohibitions on disclosure) if its disclosure -

(a) would specify the identity of the person to whom the information relates, or

(b) would enable the identity of such a person to be deduced.

(2) Except as specified in subsection (1), information the disclosure of which is Prohibited by section 18(1) is not exempt information for the purposes of section 44(1 )(a) of the Freedom of Information Act 2000.

(3) In subsection (1) "revenue and customs information relating to a person" has the same meaning as in section 19'.

25. It follows that on order for the public body to rely on the statutory prohibition, it would need to demonstrate that the requested .information is held in connection with a function of Revenue and Customs and that disclosure of the information would reveal the identity of the person(s) to which the information relates.

26. In this case the Commissioner is satisfied that the information is held by Revenue and Customs, that the exemption is being claimed by a Revenue and Customs official and that it is held in connection with a function of the Revenue and Customs.

27. HMRC has argued that disclosure of the information withheld under section 44(1) of the Act would specify the identity of the person to whom the information relates or would enable the identity to be deduced. Having viewed the withheld information, the Commissioner accepts HMRC's argument in this regard.

28. Since section 44 is an absolute exemption no public interest test applies. The Commissioner has therefore concluded that it is appropriate for HMRC to withhold information to which the exemption has been applied.

Section 40 Personal Information

29. In this case, HMRC is also citing section 40(2) by virtue of section 40(3)(a)(i) in relation to the same Information it considered exempt by virtue of section 44(1). As the Commissioner has found the exemption at section 44 engaged in respect of this information, he has not gone on to consider the application of the exemption in section 40.

Section 36 Prejudice to effective conduct of public affairs

30. HMRC has cited both section 36 and 38 in relation to the remaining withheld information The Commissioner has first considered HMRC's arguments in relation to section 36.

31. Section 36(1) states:

' This section applies to -

(a) information which is held by a government department or by the Welsh Assembly Government and is not exempt information by virtue of section 35, and

(b) information which is held by any other public authority.'

Section 36(2) states:

'Information to which this section applies is exempt information if, in the reasonable opinion of a qualified person, disclosure of the information under this Act-

(a) would, or would be likely to, prejudice -

(i) the maintenance of the convention of the collective responsibility of Ministers of the Crown, or
(iI) the work of the Executive Committee of the Northern Ireland Assembly, or

(iii) the work of the executive committee of the Welsh Assembly Government,

(b) would, or would he likely to, inhibit

(i) the free and frank provision of advice, or
(ii) the free and frank exchange of views for the purposes of deliberation, or

(c) would otherwise prejudice, or would be likely otherwise to prejudice, the effective conduct of public affairs'.

32. While section 36(2)(a) and (b) provide for exemption on specific grounds, paragraph (c) takes a more general form, referring to prejudice to 'the effective conduct of public affairs'. The Act does not define 'effective conduct' or 'public affairs'

33. In Mclntyre v The Information Commissioner & the Ministry of Defence
(EA/2007/0068) the Tribunal expressed its view about the intention behind the section 36(2 )(c) exemption:

'this category of exemption is intended to apply to those cases where it would be necessary in the interest of good government to withhold information, but which are not covered by another exemption, and where disclosure would prejudice the public authority's ability to offer an effective public service or to meet its wider objectives or purposes due to the disruption caused by the disclosure or the diversion of resources in managing the impact of the disclosure'.

34. In this case, HMRC is citing section 36(2)(c) in relation to the information not withheld by virtue of sections 23 or 44. In other words, HMRC is claiming that, in the reasonable opinion of a qualified person, disclosure would otherwise prejudice, or would be likely otherwise to prejudice, the effective conduct of public affairs. In this case, the prejudice claimed is in relation to HMRC's operational arrangements for specific individual customers.

The opinion of the qualified person

35. The first condition for the application of the exemption Is the qualified person's reasonable opinion. Therefore, when considering whether or not section 36 is engaged, the Commissioner will first consider whether the opinion of an appropriate qualified person that the prejudice described in the exemption would, or would be likely to, occur has been obtained.

36. When considering whether section 36(2)(c) is engaged, the Commissioner has taken Into account:

• whether an opinion was given;
• whether the person who gave that opinion is the qualified person for the public authority in question;
• when the opinion was given; and
• whether the opinion is reasonable.

37. In England, for government departments, the qualified person is either any Minister of the Crown or, for departments which are not headed by a minister, the commissioners or other person in charge of the department. HMRC, the public authority in this case, is a non-ministerial department with its commissioners being designated the qualified persons with regard to the Act.

38. HMRC has confirmed to the Commissioner that the opinion that disclosure would, or would be likely to, prejudice the effective conduct of public affairs was given by two of the Commissioners for HM Revenue and Customs, namely Mr Mike Eland and Mr Dave Harnett. The Commissioner is satisfied that these were appropriate 'qualified persons' as laid down in section 36(5) of the Act. HMRC also confirmed that the opinion was sought on 21 February 2008 and given on 22 and 26 February 2008 respectively.

39. It has been established, therefore, that an opinion was given, that this opinion was given by qualified persons for HMRC and that this opinion was given on 22 and 26 February 2008. The next step is to consider whether the opinion is reasonable.

What is a reasonable opinion?

40. In determining whether or not the opinion is reasonable, the Commissioner will consider the extent to which the opinion is both reasonable in substance and reasonably arrived at. (The Commissioner will generally take into account two main factors here: what the qualified person took into account when forming his opinion and the content of the withheld information itself).

41. Regarding whether or not the process of arriving at the decision was reasonable, the Commissioner will take into account what the qualified person had in front of him when forming his opinion. In this respect, he will consider to what extent all the relevant factors were taken into account.

42. In this case, the Commissioner notes that the two HMRC Commissioners were provided with a submission at the time the initial response to the complainant's request was being prepared. When providing the Commissioner with a copy of the submission for the purposes of his investigation, HMRC advised that, in this case, the submission also covered other requests made in a similar timescale. In this respect, the Commissioner notes that a minor part of the content of the submission is not relevant to this case.

43. The Commissioner is aware that the submission refers to the requests it relates to as being attached as an annex. From the evidence he has seen, the withheld information is not referred to as being attached in the same way. However, HMRC has provided the Commissioner with evidence that the withheld information was going to be compiled for the qualified persons. The Commissioner also notes that HMRC advised the complainant that 'two Commissioners of HM Revenue and Customs have considered your request alongside the information held...'.

44. This being the case, the Commissioner accepts, on the balance of probabilities, that the qualified persons had a written submission and the withheld information available to them when arriving at their opinion.

45. With respect to the internal review, HMRC has told the Commissioner that:

'The Commissioners were informed verbally that a review had been requested. The internal reviewer concluded that the arguments on which the Commissioners had reached their decision were sound and were not affected by the additional points raised by the Requestor'.

46. In support of its citing of this exemption, HMRC told the complainant:

'It is absolutely necessary for HMRC to have in place operational arrangements that adequately take account of additional risk factors facing specific individual customers because of their circumstances. We have given very careful consideration to making a partial disclosure of some of the information requested but in our view, to release any information describing these arrangements would diminish the protection afforded by them as it would provide details that would or could be of use to someone intent on undermining or circumventing those arrangements. Therefore, disclosure of this information would prejudice our ability to operate these arrangements effectively'.

47. During the course of his investigation, HMRC again considered 'whether it might be possible to disclose some high level information'. However, no agreement to make a disclosure was reached.

48. It is the Commissioner's role to determine whether HMRC has dealt with the complainant's request in accordance with the Act. As stated above, and in light of the Information Tribunal's considerations, the Commissioner takes the view that section 36(2)(c) is only available in cases where disclosure would prejudice a public authority's ability to offer an effective public service, or to meet its wider objectives or purpose, due to the disruption caused by the disclosure and the diversion of resources in managing the impact of disclosure.

49. As previously stated, in this case HMRC is claiming prejudice in relation to its operational arrangements for specific individual customers. Having considered the arguments put forward by HMRC in support of its decision to withhold the requested information, and with due regard to the information actually requested, it is the Commissioner's view that many of HMRC's arguments are of little or no relevance to the specific information actually requested.

50. Although the arguments advanced in the submission are not unreasonable, they do not relate sufficiently to the information requested to satisfy the Commissioner that the criteria in section 36 have been met. Accordingly, the Commissioner does not con'.idor that disclosing the requested information would have an impact so wide-ranging as to prejudice the public authority's ability to deliver an effective public service or meet its wider purpose.

51. Therefore, in this case, having due regard to the withheld information and to the arguments put forward by HMRC, the Commissioner does not find that the opinion of the qualified persons was reasonable in substance and he therefore does riot find the exemption engaged.

52. As the Commissioner's conclusion is that this exemption is not engaged, It has not been necessary to go on to consider the balance of the public interest.

53. In this case, HMRC is also citing section 38 in relation to the information it considered exempt by virtue of section 36(2)(c). The Commissioner has therefore gone on to consider its application of the exemption in section 38.

Section 38 Health and Safety

54. Section 38(1) provides that:

'Information is exempt information if its disclosure under this Act would, or would be likely to -

(a) endanger the physical or mental health of any individual, or

(b) endanger the safety of any individual.'

55. The Commissioner takes the view that the phrase 'would or would be likely to endanger' means that there should be evidence of a significant risk to the physical or mental health or the safety of any individual.

56. With regard to section 38(1)(a), the Commissioner considers that the endangerment of mental health implies that disclosure might lead to, or exacerbate an existing, mental illness or psychological disorder. It does not include a risk of distress. With regard to the endangerment of physical health, he considers this implies a link to medical matters.

57. With regard to section 38(1)(b), he considers the endangerment of safety relate to the risk of accident and the security of individuals.

58. In order for the Commissioner to conclude that endangerment would be likely to result, the possibility of endangerment must be real and significant, rather than hypothetical or remote. This is in line with the direction provided by the Information Tribunal in the case John Connor Press Associates Limited v The Information Commissioner (EA/2005/0005) in which it stated:

'Likely connotes a degree of probability that there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there 'may very well' be prejudice to those interests, even if the risk falls short of being more probable than not'.

59. In order for the Commissioner to conclude that endangerment would occur, the possibility of this must be at least more probable than not. This follows the approach of the Information Tribunal in the case of Hogan v Oxford City Council & The Information Commissioner (EA/2005/006 & EA/2005/0030) in which it found that the 'prejudice test is not restricted to "would be likely to prejudice". It provides an alternative limb of 'would prejudice'. Clearly this second limb of the test places a much stronger evidential burden on the public authority to discharge'.

60. Although these two cases both concerned the prejudice test rather than the section 38 endangerment test, the Tribunal's interpretation of "would" and "would be likely to" is equally applicable.

61. In this case, HMRC has confirmed it is citing both 38(1 )(a) and (b) and that disclosure 'would endanger' in relation to some of the withheld information and 'would be likely to endanger' in relation to the remainder. It has also confirmed that the 'endangered' individuals are both HMRC customers and HMRC staff.

HMRC customers

62. In relation to the information withheld under this exemption, HMRC has argued that disclosure would, or would be likely to, result in endangerment to its customers because the information:

'relates to the nature of additional safeguards that HMRC puts in place to protect information relating to certain individual customers and releasing it could provide details of use to someone seeking to target those individuals. Those additional safeguards are put in place where disclosure of the information, or of the arrangements for handling information, relating to those individuals, would put the individual at increased personal risk and / or would present a security risk.'

63. HMRC has explained that its policy of restricting knowledge about how it provides additional protection to certain customers 'makes it more difficult for those who seek inappropriately to gain access to information about additionally protected customers.'

64. In respect of the argument that disclosure could provide details of use to someone 'seeking to target those individuals', the Commissioner notes that the complainant made it clear that he was not requesting information about specific individuals.

65. At the internal review stage, the complainant said:

'As I was only asking for approximate figures, what justification can there be for withholding such figures for the Special Categories not covered by the claimed exemption under Section 23? ... If there are Special Categories with only a very few individuals in them then the usual FOIA [Freedom of Information Act] and Written Parliamentary Answers practice is to aggregate the totals of several small groups together into a sub-total which obscures the identity of individuals.'

66 The complainant told the Commissioner that:

'I made it clear that I was not asking tor any information which might identify any individuals whatsoever, only the broad special Category items and the approximate number of people in each Special Category'

67. HMRC has argued that

'It is also our view that releasing this information could lead them [the customers with additional safeguards] to believe that their personal safety is bang compromised by the disclosure'.

68 In this respect the complainant has argued:

'I find it impossible to envisage how, for example. naming a Special Category such as 'Members of Parliament' in any way puts the health and safety of an
individual MP at any risk whatsoever'.

69 The Commissioner notes the Financial Secretary to the Treasury's statement on 4 January 2008 that 'there are categories of individual for whom security is a higher priority. Not just Members of Parliament - there are several categories of people in that position' He therefore considers that some, at least, of the requested information is in the public domain. He also notes the media interest following this exchange which added to the debate on this topic and the amount information in the public domain.

70 HMRC hat not developed its argument further on the point that disclosure could lead individuals to believe that their safety is compromised. However, in relation to the general point that disclosure 'would increase the risk of those safeguards being undermined so that information about individuals was accessed inappropriately' . It has brought newspaper articles to the Commissioner's attention that it considers lend weight to its argument

71. The Commissioner notes that, when requesting an internal review, the
complainant expressed dissatisfaction with the application of the exemption, arguing that it appeared to have bean applied on the assumption 'that somehow "individual" in the Special Categories could be personally identified if general details about the Special Categories themselves, and the Special Category Policy were made public'.

72. At the internal review stage. HMRC explained to the complainant that the consequences of disclosure of 'information about numbers, nature and procedures' was one of 'heightening the risk of exposure of those customers that are additionally protected'.

73. As a further consideration in relation to section 38, HMRC has raised the issue of the endangerment to the physical and mental health of its customers if HMRC is seen to disclose information 'that they perceive will increase the risk that the safeguards applied to their records could be undermined'.

74. The Commissioner considers that this statement does not demonstrate a risk of any harm in releasing the information, but rather a perception in relation to an existing risk. In any event, the Commissioner fails to see how any such perception could amount to an endangerment of the physical or mental health of individual customers.

HMRC members of staff

75. HMRC has told the Commissioner that 'the health and safety of our own staff.... would be put at risk if attention were drawn to the nature of their work'. It has also argued in relation to disclosure of any of the information requested at questions 1,2,3,4,5 and 9 that 'more broadly, any of or customer-facing staff could find themselves being put under pressure'.

76. In support of this argument, HMRC has provided the Commissioner with examples of scenarios which it considers give rise to the risk of its staff being put under pressure.

77. With regard to its withholding of the requested information, the Commissioner accepts that HMRC has also brought other matters to his attention. The Commissioner is unable to provide further detail of these arguments, as to do so would, in itself, draw attention to the information held by HMRC. However, in his view, whilst such comments can be beneficial when considering the public interest factors for or against disclosure, they are not relevant when considering the likelihood of endangerment to the health and safety of any individual. He has not therefore considered such arguments here.

Conclusion

78. In reaching his conclusion in this case, as noted above, the Commissioner has considered the directions provided by the Information Tribunal regarding the likelihood of endangerment. He has also taken account of the Information Tribunal's comments in the case of Guardian & Brooke v The Information Commissioner & the BBC (EA/2006/0011 and EA/2006/0013) in which the Information Tribunal accepted that 'the "default setting" in the Act is in favour of disclosure'.

79.HMRC has argued that there is a 'very large market for personal information with private sector investigation agencies and credit reference agencies. HMRC, along with all other major organisations which hold personal information is subject to attack by these and similar agencies'.

80. In this case, having due regard to the withheld information, the Commissioner does not consider, either with regard to its customers or to its staff, that HMRC has put forward sufficient evidence to demonstrate evidence of additional endangerment to their physical or mental health or their safety over and above any which may already be present.

81. As noted above, for the exemption to be engaged on the basis that
endangerment would occur the possibility of endangerment must be at least more probable than not. On the basis of the arguments advanced here, the possibility of endangerment to physical or mental health, or to an individual's safety, resulting from disclosure of the information in question is not more probable than not. The Commissioner further notes that the test for whether endangerment is likely, which is that the possibility of endangerment must be real and significant and certainly more than hypothetical or remote, is also not satisfied here on the basis of the arguments advanced by the public authority. The conclusion of the Commissioner therefore is that neither section 38(1)(a) nor (b) is engaged.

82. As the conclusion is that this exemption is not engaged, it has not been necessary to go on to consider the balance of the public interest.

Procedural Requirements

General right of access

83. Section 1(1) states:

'Any person making a request for information to a public authority is entitled -

a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

b) if that is the case, to have that information communicated to him'.

84. As the Commissioner considers that some of the withheld information should have been disclosed, he finds HMRC in breach of section 1(1)(b) of the Act in that it failed to provide this information.

Time for compliance

85. Section 10(1) of the Act provides that:

'Subject to subsections (2) and (3), a public authority must comply with section 1(1) promptly and in any event not later than the twentieth working day following the date of receipt.'

86. In this case, since HMRC failed to provide some of the requested information within 20 working days, it breached section 10(1) of the Act. In addition, the complainant made his request for information on 28 January 2008 but HMRC did not issue its refusal notice until 6 March 2008. In failing to confirm to the complainant that it held information falling within the request within the statutory timescale, the Commissioner finds the Home Office [sic] in breach of section 10(1) of the Act.

Refusal of request

87. Section 17( 1) of the Act provides that:

'A public authority which, in relation to any request for information, is to any extent relying on a claim that any provision of Part II relating to the duty to confirm or deny is relevant to the request or on a claim that information is exempt information must, within the time for complying with section 1(1), give the applicant a notice which -

(a) states that fact,

(b) specifies the exemption in question, and
(c) states (if that would not otherwise be apparent) why the exemption
applies'.

88. The Commissioner notes that, in taking more than 20 working days to issue its refusal notice, HMRC was in breach of the statutory timescale for providing these elements of explanation and therefore breached section 17(1).

89. In addition, in Bowbrick v the ICO the Information Tribunal stated that 'If a public authority does not raise an exemption until after the s17(1) time period, it is in breach of the provisions of the Act in respect to giving a proper notice because, in effect it is giving part of its notice too late'. In this case, the HMRC failed to specify in its refusal notice exemptions, namely sections 40 and 44, on which it relied during the course of the Commissioner's investigation.

90. The Commissioner has therefore concluded that HMRC breached sections 17(1)(b) and 17(1)(c) of the Act in failing to supply a notice compliant with the requirements of that section within 20 working days.

The Decision

91. The Commissioner's decision is that the public authority did not deal with the request for information in accordance with the Act:
• it breached section 1 (1 )(b) by not providing the complainant with the requested information wrongly withheld under sections 36 and 38;
• it breached section 10(1) by not confirming to the complainant within the statutory timescale that it held the requested information;
• it breached section 10(1) by not providing the complainant with information within the statutory timescale;
• it breached section 17(1) by not providing the complainant with a valid refusal notice within the statutory timescale; and
• it breached section 17(1)(b) and (c) by failing to specify and explain exemptions it later relied on.

Steps Required

---

92 The Commissioner requires the public authority to take the following steps to ensure compliance with the Act:

• disclose the list of special categories not exempt by virtue of section 23 or 44;
• disclose the number of people in each special category not exempt by virtue of section 23 or 44:
• disclose the name of the decision maker who makes the decision to put someone in one of the special categories; and
• disclose the information withheld in relation to questions 4, 5 and 9.

93. The public authority must take the steps required by this notice within 35 calendar days of the date of this notice.

Failure to comply

---

94. Failure to comply with the steps described above may result in the Commissioner making written certification of this fact to the High Court (or the Court of Session in Scotland) pursuant to section 54 of the Act and may be dealt with as a contempt of court.

Other matters

---

95. Although they do not form part of this Decision Notice the Commissioner wishes to highlight the following matters of concern.

96. Part VI of the section 45 Code of Practice (the 'Code') makes it desirable practice that a public authority should have a procedure in place for dealing with complaints about its handling of requests for information, and that the procedure should encourage a prompt determination of the complaint. As he has made clear in his 'Good Practice Guidance No 5', published in February 2007, the Commissioner considers that these internal reviews should be completed as promptly as possible. While no explicit timescale is laid down by the Act, the Commissioner has decided that a reasonable time for completing an internal review is 20 working days from the date of the request for review. In exceptional circumstances it may be reasonable to take longer but in no case should the time taken exceed 40 working days. The Commissioner is concerned that in this case, it took over 40 working days for an internal review to be completed, despite the publication of his guidance on the matter.

Right of Appeal

97 Either party has the right to appeal against this Decision Notice to the Information Tribunal. Information about the appeals process may be obtained from:

First-tier Tribunal (Information Rights)
Arnhem House Support Centre
PO Box 6987
Leicester LE16ZX

Tel: 0845 600 0877
Fax: 01162494253
Email: informationtribunal(q)tribunals.qsi.gov.uk.
Website: www.informationtribunal.gov.uk

If you wish to appeal against a decision notice, you can obtain information on how to appeal along with the relevant forms from the Information Tribunal website.

Any Notice of Appeal should be served on the Tribunal within 28 calendar days of the date on which this Decision Notice is served.

Dated the 25™ day of January 2010

Signed ............................

Graham Smith
Deputy Commissioner and Director of Freedom of Information

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Legal Annex

Section 23 Information supplied by, or relating to, bodies dealing with security matters

Section 23(1) provides that -

'Information held by a public authority is exempt information if it was directly or indirectly supplied to the public authority by, or relates to, any of the bodies specified in subsection (3).'

Section 23(2) provides that -

'A certificate signed by a Minister of the Crown certifying that the information to which it applies was directly or indirectly supplied by, or relates to, any of the bodies specified in subsection (3) shall, subject to section 60, be conclusive evidence of that fact.'

Section 23(3) provides that -

'The bodies referred to in subsections (1) and (2) are-

(a) the Security Service,

(b) the Secret Intelligence Service,

(c) the Government Communications Headquarters,

(d) the special forces,

(e) the Tribunal established under section 65 of the Regulation of Investigatory Powers Act 2000,

(f) the Tribunal established under section 7 of the Interception of Communications Act 1985,

(g) the Tribunal established under section 5 of the Security Service Act 1989,

(h) the Tribunal established under section 9 of the Intelligence Services Act 1994,

(i) the Security Vetting Appeals Panel,

(j) the Security Commission,

(k) the National Criminal Intelligence Service, and

(I) the Service Authority for the National Criminal Intelligence Service.'

UPDATE: Tuesday 23rd February 2010:

From: casework@ico.gsi.gov.uk
To: [email address]
Date: Tue, 23 Feb 2010 18:11:50 +0100
T
23rd February 2010
CASE REFERENCE NUMBER FS50216168
Dear [name]
I am writing in relation to the Decision Notice (DN) recently issued
to you and further to correspondence received today from HMRC on this
matter, specifically in relation to point 3 of your request. At point
3 you asked "Who exactly makes the decision to put someone into one
of these special categories?"

In this case, rather than provide the Commissioner with a copy of the
withheld information, HMRC required that it be viewed on its premises.
As a result, the DN was written without the benefit of being able to
refer back to the withheld information.

Unfortunately, in relation to question 3 of the request, this has
resulted in the DN ordering disclosure of the name of the decision
maker. However, the DN having been issued, HMRC has advised that the
withheld information, while describing the process, did not include
individuals' names. I apologise for any confusion arising from this.

I am aware from your correspondence with HMRC, copies of which you
provided to this office, that you had indicated that you were looking
for an indication of how the decision to put someone in a special
category was made rather than for the names of individual civil
servants. However, I wanted to ensure that you were aware of the
circumstances as soon as HMRC brought it to the attention of this
office.

Yours sincerely

{name of ICO civil servant]
Senior Complaints Officer

FOI Team 2 – Police, Justice and Taxation

What, if anything, will actually be disclosed, by Monday 8th March 2010, as ordered in this Decision Notice ?