Charity Commissioner for England and Wales v The Information Commissioner

Introduction

1. On the 27 November 2023 the Charity Commission received a request to disclose “ a list of charities that have a dispensation where the names of all of their trustees are withheld from the public register of charities ”. This request was refused on the grounds of the exemptions found in section 40(2) (personal information) and section 38 (health and safety) of FOIA.

2. Ultimately this was then referred to the Commissioner. This is an appeal against the Commissioner’s decision notice in this case. Namely, IC-289653-J1Y0 of 16 September 2024 (“DN”).

3. Both the Charity Commission and the Commissioner considered at the previous hearing that the appeal could be appropriately dealt with on the papers and so did not attend, instead relying on the contents of the written representations included in the bundles and addendums. The Tribunal met remotely and was satisfied that it was fair and just to conduct the hearing in this way. Background

4. The DN issued on 16 September 2024 held that section 40 of FOIA applies to the requested information for Charitable Companies. However, for Charitable Incorporated Organisations (CIOs), Charitable Trusts and Unincorporated Charitable Associations, both sections 38 and 40 of FOIA are not engaged (and so the list of such charities with dispensations should be published).

5. The positions of the parties in this case have significantly developed and changed over time, such that the Commissioner does not now seek to argue to uphold the DN in exactly the terms it was issued. Equally the Charity Commission now seeks to rely on the s.41 exemption for information provided in confidence in addition to the s.38 and s.40 exemptions relied on previously. The details of the evolving positions of both parties are set out in full in the various bundles and submissions, however summarised below are the relevant points in the history of this matter as well as the key positions of the parties at the time of the hearing.

6. In the written submissions of the Commissioner of 15 April 2025 the Tribunal was invited to dismiss the appeal save to the extent that: a. “...w here information has been intentionally published by the charities or trustees, in departure from the DN, the Commissioner considers that the interests in favour of disclosure would override the interests or rights of the data subjects. Accordingly, the disclosure of the personal data would not breach Article 5(1)(a) UK GDPR and would be lawful for the purposes of Article 6(1) UK GDPR such that section 40(2) FOIA is not engaged .” (Paragraph 16) b. “. ..the Commissioner now accepts that the disclosure of the Dispensation List in respect of these categories of charities [i.e Charitable Incorporated Organisations (“CIOs”), Charitable Trusts and Unincorporated Charitable Associations] , where their trustees are identifiable from information in the public domain at the relevant time, represents a disclosure of personal data for the purposes of section 3(2) DPA .” (Paragraph 19) c. “ where the only information naming trustees is that published by the Appellant in error, the Commissioner accepts that the name of the relevant charity is exempt from disclosure on the Dispensation List under section 40(2) FOIA ” (Paragraph 20) d. “ ... the name of a corporate trustee does not ‘relate to’ a living individual (natural person) who can be identified. Accordingly the name of a corporate trustee does not constitute personal data within the meaning in section 3(2) DPA. Accordingly section 40(2) FOIA is not engaged in respect of any charities on the Dispensation List that have a corporate trustee ” (Paragraph 23) e. The previous points relate to s.40 but in relation to s. 38 “ ... the Commissioner acknowledges that to the extent that any trustees of these categories of charities were identified in the public domain either by the trustee or charity freely publishing the trustees identities themselves or the Appellant publishing such information on its website, the Dispensation List could be used at the relevant time to identify those trustees with a dispensation contrary to the Commissioner’s position in the DN §70. The Commissioner submits that any information published in error on the Appellant’s website should be taken into account in assessing the engagement of the exemption and the public interest test, even if the Appellant will seek to remove such information .” (Paragraph 26)

7. In the Commissioner’s final written submissions of 5 June 2025 it is confirmed that the Commissioner “ maintains his position as per his submissions dated 15 April 2025 ” (paragraph 2). In summary the Commissioner's position on this matter before the tribunal is as follows: a. As regards Charitable Companies where a dispensation has been granted, contrary to the DN not all such bodies are exempted under s.40. Rather where there is other information identifying the relevant trustees for such bodies then s.40 is engaged. Whether the exemption applies will depend on the public interest test and the Commissioner’s view is that if the other identifying information has been intentionally published then the public interest in disclosure outweighs the public interest in retention, but the opposite is true where that information was published in error etc. b. In the DN the position had been that neither s.40 nor s.38 applied to any of the bodies on the list of dispensations as far as that related to Charitable Incorporated Organisations (“CIOs”), Charitable Trusts and Unincorporated Charitable Associations. The Commissioner now takes the view that this was incorrect. As per the previous paragraph the position taken now is that as regards these types of charity “ the disclosure of the Dispensation List in respect of these categories of charities, where their trustees are identifiable from information in the public domain at the relevant time, represents a disclosure of personal data ... Further, the Dispensation List could be used to identify those trustees with a dispensation for the purposes of section 38(1) FOIA ”. The Commissioner goes on to set out that consequently where the relevant identifying information was intentionally published then the public interest in disclosure outweighs the public interest in retention and so the material should be published. But that where the identifying information was published in error then the public interest in disclosure is outweighed by the public interest in retention and so the material should be exempt under s.40(2). Additionally the Commissioner is clear that in their view “ the Appellant has not evidenced a causal relationship between disclosure of the Dispensation List, which does not name any trustees, and harm, endangerment (which is real, actual or of substance) that ‘would be likely’ to endanger the safety of any specific individual or groups such that section 38(1) FOIA is not engaged”. c. That where no trustee identifying information is in the public domain at the relevant time, neither section 40(2) nor section 38(1) FOIA are engaged. d. That as regards Corporate Trustees “ section 40(2) FOIA is not engaged in respect of any charities on the Dispensation List that have a corporate trustee ”. e. That in relation to s.41 “ the Commissioner does not consider that the Appellant has evidenced that the exemption in section 41 FOIA is engaged. The Commissioner doubts that the information has the necessary quality of confidence, in circumstances where the identities of relevant trustees have intentionally been placed into the public domain by the charity or trustees. ”

8. The Commissioner therefore takes the position that: a. None of the bodies named on the dispensation list are exempt under the s.41 for information provided in confidence. b. None of the bodies named on the dispensation list are exempt under the s.38 exemption for health and safety. This is because the Appellant has not evidenced a causal relationship between disclosure of the Dispensation List (which does not name any trustees), and a harm (which is real, actual or of substance) that ‘would be likely’ to endanger the safety of any specific individual or groups. c. No corporate trustees that relate to a body on the dispensation list would provide a basis under s.40 for that body to be exempt. d. Where there is no additional identifying information available in the public domain as regards a body on the dispensation list then there is no prospect that such a body could be exempt from disclosure on the basis of either s.40(2) or s.38. e. As regards Charitable Companies, CIOs, Charitable Trusts and Unincorporated Charitable Associations that are named on the dispensation list these bodies may benefit from an exemption under s.40(2) where there is additional identifying information available in the public domain and this information was not intentionally published by (or with the agreement of) the trustees. f. In light of all of the above, the Charity Commission therefore now would only be required to publish a smaller subset of the total dispensation list that was required under the terms of the original DN. This is because the ICO accepts that the s.40 exemption does apply at least as regards the subset of charities on the dispensation list where there is additional identifying information available that was not intentionally published by the trustees.

9. In light of the developing position of the Commissioner, the Charity Commission has adapted their stance accordingly as evidenced in the responses and submissions set out in detail the closed and open bundles. At the date of the hearing the Charity Commission’s key points can be summarised as: a. S. 40 i. That it agrees with the Commissioner’s position that charities that are on the dispensation list where there is known to be specific public domain information that identifies the relevant trustees, engage the s.40 exemption. ii. However, the Charity Commission argues this does not go far enough, and that all the Dispensation List Charities should engage the exemption. The basis for this argument being that given a simple analysis identified a significant number of charities with relevant public domain information, then it is reasonable to infer that a motivated third party with access to increasingly sophisticated tools and techniques would be able to identify all of the dispensation list charities. iii. However, whilst the Charity Commission argues that s.40 should be engaged in all cases, they do not seek to argue that the exemption will apply in every case given the factual context of each case will affect the public interest test. Again, the Charity Commission agrees with the Commissioner in relation to the cases it has identified as being exempt under s.40, but again argues that that position does not go far enough. This is because it is not always reasonably possible to ascertain with reasonable certainty as to whether any particular publicly available information was published intentionally i.e. with the person’s consent and agreement. This remains the case even where the publication is seemingly done by the Charity itself. Making assumptions of the individual trustee’s or charity’s intentions, purely from the fact that some information is available online is inherently risky given the many ways such information can end up being published (from media articles and podcasts through to accidental official publications either internally by the charity or by an external body). Therefore, the position should be that an “ Erroneous disclosure (which the individual may well not have known about) cannot undermine a data subject’s reasonable expectation of privacy in circumstances where a Dispensation has been granted ”. This could also include scenarios where information was originally intentionally published (by either the trustees or charities) but since then they had unsuccessfully tried to remove the information from the public domain. b. s.38 i. That the Commissioner’s conclusion that the “ disclosure of the Dispensation List would not be likely (a ‘very significant and weighty chance’) to endanger any individual’s safety due to other means of identifying trustees of controversial charities ” is directly contrary to the specific statutory basis on which the Charity Commission is empowered to award a dispensation. Under the powers in Regulation 40(4) of the Charities (Accounts and Reports) Regulations 2008 a dispensation from the requirement to publish a name of a trustee may be granted when such a publication “could lead to that person being placed in any personal danger ”. This power is exercised by the Charity Commission in line with the Trustee Dispensation Casework Guidance Charity Commission for England and Wales – Trustee Dispensation Casework Guidance : updated 06/09/24 which covers substantially the same considerations as those required by s.38 of FOIA and requires a causal link between the disclosure and the risk arising. The Guidance also specifically acknowledges that in situations where a dispensation is sought but there is already information about the Trustee and the Charity in the public domain, it may be more difficult to allow a dispensation as it will be harder to conclude that it is the publication by the Charity Commission that could lead to the personal danger. But it goes on to clarify that even where data is publicly available from other sources, if it can be demonstrated that publication by the Charity Commission nonetheless “ caus[es] the potential for harm” then the dispensation should still be granted. See p.21-22 ibid ii. Neither in these proceedings nor otherwise, has there been any challenge relating to the correctness of the Charity Commission’s exercise of its statutory power. Therefore it should be taken as read that for each individual charity on the dispensation list (that is the subject of this request) that their dispensation was a “ a lawful/correct exercise of the statutory power ” and implicitly that there is a requisite risk of personal danger to all the relevant persons in spite of whatever information may also be in the public domain. iii. The Commissioner’s suggestion that disclosure of the information sought would not significantly increase risk to trustees or assist anyone seeking to target individuals/groups associated with a charity is “vague and unevidenced”. c. Charitable Companies i. That the Commissioner should not be allowed to substantially alter their position as regards Charitable Companies from that set out in the DN. ii. In any event the asserted new position of the Commissioner that even in relation to Charitable Companies, the public interest in disclosure will outweigh the interests of the data subject when there is other information publicly available that was intentionally published by the trustees or others, is unsustainable. This is because “Publication of such information by a third-party (such as another trustee or the charity) –which the data subject may or may not know about—is not an indication that the subject is content for that information to be published.” iii. Reasoning that differentiates whether an exemption does or does not apply based on assumptions about the intentionality of disclosure by the data subject is not coherent, especially when those disclosures can be made by third parties other than the trustee themselves. d. s.41 i. That the requested information has the necessary quality of confidence by virtue of the fact that the dispensations were granted, as this creates an expectation the information will remain confidential. ii. The public interest balance is overwhelmingly in favour of maintaining the confidentiality because of the risk to personal safety, as well as the risk of undermining the confidence in the Charity Commission’s ability to provide protection to trustees and thereby their effectiveness in their public duties. The relevant law

10. The relevant provisions of FOIA are set out below: 1 General right of access to information held by public authorities (1) Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him. (2) Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14. ... 38 Health and safety. (1) Information is exempt information if its disclosure under this Act would, or would be likely to— (a)endanger the physical or mental health of any individual, or (b)endanger the safety of any individual. (2) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would, or would be likely to, have either of the effects mentioned in subsection (1). ... 40 Personal information. (1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information if— (a)it constitutes personal data which [ does ] not fall within subsection (1), and (b) [ the first, second or third ] condition below is satisfied. [ (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a)would contravene any of the data protection principles, or (b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the [ UK GDPR ] (general processing: right to object to processing). ] [ (4A)The third condition is that— (a)on a request under Article 15(1) of the [ UK GDPR ] (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018 , or (b)on a request under section 45(1) (b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section. ] [ (5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1). (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i)would (apart from this Act ) contravene any of the data protection principles, or (ii)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1) (a) would (apart from this Act ) contravene Article 21 of the [ UK GDPR ] (general processing: right to object to processing); (c)on a request under Article 15(1) of the [ UK GDPR ] (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a); (d)on a request under section 45(1) (a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section. ] (6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [ (7) In this section— “the data protection principles” means the principles set out in— (a) Article 5(1) of the [ UK GDPR ] , and (b) section 34(1) of the Data Protection Act 2018 ; “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act ); [ “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) , (4) and (14) of that Act ); “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act ). ] (8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the [ UK GDPR ] would be contravened by the disclosure of information, Article 6(1) of the [ UK GDPR ] (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted. ] 41 Information provided in confidence. (1) Information is exempt information if— (a)it was obtained by the public authority from any other person (including another public authority), and (b)the disclosure of the information to the public (otherwise than under this Act ) by the public authority holding it would constitute a breach of confidence actionable by that or any other person. (2) The duty to confirm or deny does not arise if, or to the extent that, the confirmation or denial that would have to be given to comply with section 1(1) (a) would (apart from this Act ) constitute an actionable breach of confidence. ... 58 Determination of appeals (1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

11. Regulation 40(4) of the Charities ((Accounts and Reports) Regulations 2008 provides We note that Regulation 41(4) makes near identical provision as regards qualifying parent charities. : The Commission may, where it is satisfied that, in the case of a particular charity or class of charities, or in the case of a particular financial year of a charity or class of charities— (a)the disclosure of the name of any person whose name is required by any of sub-paragraphs (d), (e), (f), (g) and (i) of paragraph (3) to be contained in the annual report of a charity could lead to that person being placed in any personal danger, dispense with the requirement in any of those sub-paragraphs so far as it applies to the name of such person; (b)the disclosure of the principal address of the charity in accordance with paragraph (3)(c) above could lead to any such person being placed in any personal danger, dispense with that requirement.

12. In Liverpool City Council v IC and Animal Wardens Ltd FTT 1 December 2022 EA-2021-0040P at 52. the First Tier Tribunal held that in relation to Section 38 the disclosure of information that may endanger the health and safety of an individual can be caused either directly by the disclosure itself, or indirectly in that the harm will not be realised without a further step being necessary by a human agent in addition to the disclosure. Stating at paragraph 52: “... disclosure of the withheld information may - albeit indirectly - endanger the health or safety of an individual (who has been identified to the Tribunal) because of the likely use that will be made of the disclosed information. On the usual principles of causation, the Panel considers that the evidence in this case shows it is readily predictable that the withheld information, once disclosed, will be used in such a way as would risk harming the health and safety of an individual.”

13. In the case of Markey v IC and Staffordshire Police FTT 20 December 2019 EA/2007/0081 at paragraph 47. the First Tier Tribunal held that: “Section 38 includes endangerment to mental health and is widely drawn. We are satisfied that emotional and psychological wellbeing including the causation of significant distress is included within the ordinary meaning of the term.”

14. In Lawton v IC and NHS Direct Information Tribunal 5 March 2008, EA/2007/0081 in particular paragraph 28 . the Information Tribunal dealt with the application of Section 38 in relation to a request to disclose the local telephone numbers for each of the NHS Direct Call Centres, thereby enabling persons to skip the automatic routing system that applied to single national telephone number. In that case it was argued that disclosing the information sought would prejudice the operation of the system designed to minimise call waiting times, and ensure matters were dealt with as locally and as effectively as possible. It was argued that disclosure posed a real risk to the health and safety of some unidentified individuals who as a consequence would have delayed access to medical advice with adverse clinical consequences. It was held that Section 38 did apply even where the endangerment existed in relation to a small group of unidentified individuals who formed a potential class.

15. In the case of the British Union for the Abolition of Vivisection v IC and Newcastle University FTT 11 November 2011 EA/2010/0064 at paragraph 18 the First Tier Tribunal held that “ The public interest in maintaining the s38(1) exemption, where it is engaged, is also strong. Self-evidently, there would need to be very weighty countervailing considerations to outweigh a risk to health or safety which was of sufficient severity to engage s38(1)”.

16. The Tribunal’s remit is governed by s.58 FOIA. This requires the Tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner's decision involved exercising discretion, whether he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner. Issues and evidence

17. The tribunal has to determine whether the Commissioner's decision was in accordance with the law, and to the extent that they exercised a discretion, was that was done properly as regards the following issues: a. In relation to section 38: i. Would the disclosure of the requested information actually (or be likely to) endanger the safety or the physical/mental health of any individual?

1. In that there can be identified an increased risk of the adverse consequence with a causal relationship between the disclosure and that endangerment.

2. That the risk is of real and not insignificant harm.

3. With a specific risk to at least one individual being discerned. ii. If so, does the public interest in disclosure outweigh the public interest in maintaining the exemption in the specific context of the case at hand. b. In relation to Section 40: i. Though it is common ground between the parties that the name of a charity that is on the dispensation list would itself amount to Personal Data where it is the case that there is additional identifying information publicly available that makes individuals indirectly identifiable. What is the position in relation to charities on the dispensation list where it is unknown whether there is any additional identifying information that is publicly available? Is the mere suspicion that there might be additional identifying information sufficient to qualify the publishing of the names of such dispensation list charities as the processing of personal data? ii. Where it is established that publishing the name of a specific charity on the dispensation list is the processing of personal data, in approaching the public interest test is it sufficient to consider that the public interest in disclosure will always outweigh the public interest in maintaining the exemption if the additional identifying information that is publicly available was intentionally published (whether by the data subject or not and whether it was with their consent or not)? c. In relation to Section 41: i. Does the fact that a charity has applied and successfully obtained a dispensation from publication of trustees names by the Charity Commission mean that that information has the necessary quality of confidence?

18. The Tribunal took account of the entirety of both the open and closed bundles of documents as well as the various additional submissions and addendums entered into the file (including the decision notice, the appeal, and responses amongst other items) when making our decision. Discussion and conclusions Findings of fact

19. We make the following findings of fact based on the evidence before us on the balance of probabilities: a. Whilst the public register of charities provides considerable information about charities and their trustees, it is not possible even with an exhaustive analysis of that public document to determine definitively which charities have dispensations. Where an entry does not feature trustee information the record simply states “there is no trustee information available for this charity”. There could be multiple reasons for this stated position, including (but not limited to) the granting of a dispensation. In contrast, if allowed in full, the request would definitively publicly identify the existence of each current dispensation and the charity it relates to. b. That given the statutory test See for example Regulation 40(4) of the Charities ((Accounts and Reports) Regulations 2008 . that applies, combined with the significant research evidence before us, and the fact that no challenge has been made to the legitimacy of the dispensations awarded. We are satisfied that it is more likely than not that the disclosure of the name of any of those dispensation list charities would at least be likely to endanger the physical health or the mental health or the safety of an individual (or individuals). The specific nature of the risk will likely vary from case to case and individual to individual, reflecting the unique reason the dispensation was applied for in each case. But the fact that the dispensation can only be granted where there is a risk of personal danger of some kind is the common factor that applies to every charity on the dispensation list. c. We note the evidence before us of the Charity Commission’s work to scrutinise applications for dispensations, the dispensations themselves and to check the ongoing currency of the need for an existing dispensation. The make-up of the dispensation list will therefore necessarily ebb and flow over time. We therefore find as fact that even though there is the potential with the passage of time for circumstances to change between the date a dispensation is granted and the date a request for disclosure of dispensation list charities is received, it remains more likely than not that the disclosure of the name those specific charities on the dispensation list at the time of the request would at least be likely to endanger either the physical health or the mental health or the safety of an individual (or individuals). d. Further we find as fact that even in cases where there is no additional identifying material that is publicly available to link the named charity to specific individuals, the mere disclosure of the fact that a particular charity has obtained a dispensation still would be likely to pose a risk of real and insignificant harm. i. We have been provided with ample evidence that charities and those associated with them can be (and are) targeted in a blanket and indiscriminate fashion by persons who object to their purposes, activities or even existence. ii. It is just as possible for trustees (and others associated with a specific charity) to be endangered in an unidentified collective way (such as by targeting the corporate address of the charity Noting that Regulation 40(4)(b) of the Charities (Accounts and Reports) Regulations 2008 provides an ability to prevent disclosure of the principal address of a charity presumably at least in part for this reason. or a specific event) as it would be on an identified individual basis. iii. Motivated and unscrupulous individuals would likely see the dispensation as sign that those unidentified trustees of that specific charity are concerned about others knowing their details and so are likely to consequently be more susceptible to intimidation, threats, harassment (or worse) than others in other similar charities. iv. Even in cases where the dispensation exists for personal reasons relating to the trustee rather than the charity, there remains the potential for the disclosure to pose an endangerment risk. Such as for example where an individual is known to be a committed volunteer in a particular charitable area, then motivated malicious individuals could seek to reverse engineer a means of locating that person by obtaining a list of charities in that sector with dispensations as a first step. v. In those circumstances we find that the disclosure of the specific charity as a recipient of a dispensation would create a risk of endangerment that likely would not otherwise have existed. e. It is now known that a significant number of the total charities on the dispensation list are charities where there is publicly available additional identifying material At the time of the request it was unknown how many of the dispensation list charities were ones where there was additional identifying material so as to render the disclosure of the name of the charity itself (in the context of having a dispensation) information that amounts to the processing of the personal data of the relevant trustees. However, we do not find that the evidence before us supports the position that the names of dispensation list charities will always in every case amount to personal data. Whilst knowledge of what other information is publicly available is necessarily imperfect (and will vary depending on skills, resources and access), it is implausible that in the case of every single charity on the dispensation list there will always be additional publicly available identifying information (or at least sufficient such information to indirectly identify a person).Which in turn means the charity names in this context cannot always amount to personal data because they will not always indirectly identify a person. f. That it cannot be legitimately inferred that simply because some information relating to a person is publicly available in some form, somewhere, that the individual it relates to has consented, approved or otherwise allowed this publication. The depth and persistence of digital records as well as the increasing complexity in terms of tiered access that blurs the traditional line between private communications and a publication to the world, both mean that any assumption as to intent will be purely speculative and unreliable. Section 38

20. We considered the specific circumstances of the request to release the names of all the charities that feature on the dispensation list. Such a release would not directly itself feature or reveal identifying details of individuals. However, given the test required for a dispensation, Regulation 40(4) of the Charities (Accounts and Reports) Regulations 2008 . the release of these details in this context would indirectly reveal that a person or persons could ”be placed in personal danger” if the dispensation had not been given.

21. Taking account of the evidence and our findings of fact, we are satisfied that there can be identified an increased risk of endangerment with a causal relationship between the disclosure and the endangerment. It is readily predictable that the withheld information, once made public, may indirectly endanger the health or safety of an individual or individuals. This is because of the likely use that will be made of the disclosed information in this specific context where there is an extant dispensation restricting identifying disclosures precisely because of the risk of placing persons in personal danger otherwise.

22. We are also satisfied, based on the evidence and reasoning above, that the risk posed in this case is of real and not insignificant harm. The reasons for the dispensation will vary substantially from case to case as will the nature of the risks posed but we are satisfied on the evidence before us that at the very least the risk posed here is of the causing of significant distress to the emotional and psychological wellbeing of an individual, and unfortunately at worst is a risk to the lives of individuals.

23. Penultimately, we are satisfied that at least a specific risk to at least one individual can be identified in relation to this disclosure. As set out above the disclosure would be likely to endanger a class of persons who are associated with the relevant charities and the specific nature of that risk is that those persons may be placed at risk of personal danger as a consequence of the disclosure. The precise form of that risk will vary between cases from intimidation and harassment to physical violence. There is no certainty that such risks will materialise, but that is not a requirement. It is sufficient that an ascertainable risk of this nature can be identified as arising to at least one individual. In this case we are satisfied that given the nature of the dispensation process and the underlying factual context that must exist, there is at least such a risk that can be identified in relation to each relevant trustee.

24. Lastly, in considering the public interest balancing exercise we note that there must be very weighty countervailing considerations supporting disclosure in order for the identified risk to the health and safety of individuals to be outweighed. Having considered the evidence, and the case in the round, we have been unable to identify any such considerations sufficient to displace the very significant public interest in maintaining the exemption in this case.

25. Our decision that all the material sought is exempt under section 38 effectively disposes of the whole of the appeal as the information can be withheld . However, as section 40 and section 41 were considered by both parties in their representations, we consider that we should also briefly record our thoughts in relation to those sections as well. Section 40 - a. Given our finding of facts in relation to the identifiability of trustees, it is impossible for s.40 to successfully apply on a blanket basis to this request. b. This is because the generic nature of the request for all charities that feature on the dispensation list is not in itself alone sufficient to engage the s.40 exemption given the withheld material will not itself directly identify a person. c. The fact that a charity has a dispensation is clearly information that relates to a person given it is necessarily implicit that a person was at risk of personal danger in order for the dispensation to exist. d. However, as shown by the significant evolution of the parties’ positions in this case, whether the person or persons that information relates to is identifiable in each case, is far from certain and variable in nature. e. We have no doubt that s.40 could apply in relation to many of the charities on the dispensation list, but consideration will always have to be on a case by case basis and it will have to be established each time that in addition to disclosure of the dispensation status of the charity there actually is other additional information available such that there is an identifiable person or persons for the dispensation list information to relate to. f. Similarly, we do not think that a blanket approach can be adopted to the public interest balancing test in cases where the fact that a charity has a dispensation does amount to personal data. Both parties by the time of the hearing agreed that the mere fact that there is additional identifying material publicly available is not in itself sufficient to always tip the public interest balance in favour of disclosure. We also doubt that any blanket approach that seeks to establish that the public interest in disclosure will always triumph whenever the additional material appears to have been previously intentionally published with the consent or agreement of the data subject or the organisations they are associated with. This too will also have to necessarily be a case-by-case consideration based on the specific context of each case and the relevant additional publications. In some situations, the deliberate and un-retracted publication by the data subject may sufficiently tip the balance to disclosure. However, it is equally clear to us that in other cases historic intentional publications or disclosures by persons/organisations other than the data subject themselves are unlikely to have the same effect. Section 41- We share the Commissioner's doubts about whether the simple fact that a charity has successfully applied for a dispensation from publication on the register is such that the withheld information has the necessary quality of confidence. It certainly can be inferred that such information should not feature on the public register but a requirement of confidentiality must go further and wider than that. Indeed in some cases the purpose behind the application is not because the protected trustee wants their name to be withheld from every person, they might in fact actively consent to the majority of persons knowing just so long as the individual or individuals that pose a risk to them does not know. Conclusion

26. Consequently, we find that for the above reasons, section 38 applies to the information sought and that the public interest balance lies in withholding the information. We allow the appeal and substitute the decision notice accordingly. The decision of the Tribunal is unanimous. Signed T Barrett Date: 28/7/25