Dhanwantee Hooper v The Information Commissioner

Introduction

1. This is an appeal against the Information Commissioner’s decision notice IC-364850-D0M6 dated 5 September 2025 which held that the Department for Work and Pensions ("DWP") was entitled to rely on section 21 (Information accessible to applicant by other means)) to refuse to disclose some of the information requested by the Appellant (“DH”).

2. The parties agreed to the Tribunal deciding this appeal on the papers rather than requiring an oral hearing. The Tribunal was satisfied, in accordance with Rule 32 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended) ("GRC Rules"), that it could properly determine the issues in this case without an oral hearing. Background

3. The request relates to remuneration and responsibilities of senior civil servants ("SCS") within DWP and its Child Maintenance Service ("CMS"). The request for information, internal review and responses

4. On 16 December 2024, DH emailed DWP as follows: “I am writing to request information under the Freedom of Information Act 2000 regarding the salaries and responsibilities of senior civil servants at the Department for Work and Pensions. Could you please provide the following details: 1) The salary ranges for senior civil servants at the DWP. 2) The names and positions of the senior civil servants. 3) Any additional allowances or bonuses they receive. 4) Further, please specify the names, positions, and salary details of the senior civil servants responsible for overseeing the Child Maintenance Service. 5) The specific responsibilities of these senior civil servants within their roles. 6) Information on how the performance of these senior civil servants is evaluated.”

5. On 17 January 2025, DWP responded. In response to questions 1-4 (inclusive), it cited section 21 Freedom of Information Act 200 ("FOIA") and provided a link to the Civil Service Pay Framework and DWP's organogram. It also provided the name of the Director of the Child Maintenance Service ("CMS"). It declined to provide the names of other staff on the basis of the exemption for personal data in section 40(2) FOIA.

6. In response to question 5, DWP provided the candidate packs outlining the responsibilities of grade one and two SCS.

7. In response to question 7, DWP again cited s. 21 FOIA and provided a link to the Civil Service's Performance Management Framework.

8. Following DH's request for an internal review, DWP emailed DH on 17 February 2025. In response to question 4, DWP further provided the names of the deputy directors within CMS and in response to question 5, further candidate packs for deputy directors within DWP. Otherwise, it maintained its position. The Commissioner’s investigation and Decision Notice

9. On 20 February 2025, DH complained to the Commissioner about DWP's handling of her request for information.

10. DH complained that DWP had not provided a full list of staff members with oversight for CMS and argued that DWP should have provided more detailed information about who within CMS is currently receiving bonuses and how performance is evaluated within DWP.

11. The Commissioner considered that the scope of his investigation was to determine whether DWP had provided all information within scope of the request apart from that which DH accepted engaged s.40(2) FOIA.

12. Having investigated the case, including raising questions of both DWP and DH, on 5 September 2025, the Commissioner issued decision notice IC-364850-D0M6. Appeal to the Tribunal

13. On 7 September 2025, DH sent a Notice of Appeal to the Tribunal challenging the Commissioner’s Decision Notice ("DN") .

14. The grounds of appeal, in summary are that: (a) Ground 1 - The Commissioner was mistaken in finding DWP could rely on s.21 FOIA because DWP had confirmed that it held information within the scope of the request and was therefore under a duty to disclose it unless a valid exemption applied. (b) Ground 2 - The Commissioner should not have concluded that s. 21 FOIA was engaged in respect of Part 4 of the request because that information is not reasonably accessible: it requires the requester to collate, infer or interpret disparate sources. DWP holds the specific information sought and should disclose it. (c) Ground 3 - The Commissioner wrongly interpreted the scope of Part 3 of the request (about allowances and bonuses) by allowing DWP to supply only broad frameworks rather than provide the specific, recorded information in relation to named Senior Civil Servants as requested. (d) Ground 4 - The Commissioner was wrong to conclude that DWP had complied with Part 6 of the request by providing DH with a copy of the Performance Management Framework. The request was not for the personal data of individual post-holders but for the documented evaluation process . The Framework to which a link was provided is high-level and does not explain how the performance of these specific SCS is evaluated in practice. (e) Ground 5 - The Commissioner failed in his statutory duty under s. 50 FOIA (Application for decision by Commissioner) due to procedural failings in his investigation: the Commissioner's Lead Case Officer wrote to DH stating that if DH believed that DWP held further information within the scope of her request, she could write to the DWP. Otherwise, the case would be closed. Making the Commissioner's further enquiries conditional upon DH's provision of additional evidence was contrary to the Commissioner's own statutory duty to determine independently whether DWP had complied with the request. (f) Ground 6 - The Commissioner did not take account of the compelling public interest in transparency which clearly outweighs the application of the exemptions: the public has a legitimate right to know how public funds are being used to compensate and incentivise senior officials. There is also a significant public interest in understanding the accountability structures and performance evaluation processes for those responsible in overseeing vital public services, including CMS. By upholding DWP's refusal to disclose the requested information, the Commissioner has endorsed a culture of secrecy that undermines the very principles of openness and accountability which FOIA was enacted to protect.

15. DH asks the Tribunal to review the DN, join DWP as a respondent party to the appeal, and order DWP to release the full and complete information it holds as sought by the original request. The Law Section 1(1) FOIA: general right of access to information held by public authorities Any person making a request to a public authority is entitled – (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if this is the case, to have that information communicated to him… Section 2 FOIA: Effect of the exemptions in Part II … (3) For the purposes of this section, the following provisions of Part II…are to be regarded as conferring absolute exemption — (a) section 21,… Section 21 FOIA: Information accessible to applicant by other means (1) Information which is reasonably accessible to the applicant otherwise than under section 1 is exempt information. (2) For the purposes of subsection (1)— (a)… ( b ) information is taken to be reasonably accessible to the application if it is information which the public authority ….is obliged by or under any enactment to communicate…to members of the public on request.

16. The Commissioner's guidance on s.21 FOIA states specifically that "To rely on section 21, you must first establish if you hold for the purposes of FOIA the information as described in the request".

17. Even if information is available elsewhere, a public authority needs to consider whether it is actually "reasonably accessible" to the requester before it can apply s.21 FOIA. For example, the authority may still need to direct the requester to the whereabouts in the public domain that the information can be found.

18. The Commissioner's guidance states that: (a) if the information is realistically accessible to a hypothetical member of the general public via sources in the public domain, the public authority can normally assume that the requester - as a member of the general public - can also reasonably access the information; (b) the "directions" to the requester must be sufficiently precise to enable them to find it without difficulty and without a great deal of searching to locate the information; (c) the public authority must also consider if the particular circumstances of the requester mean they have reasonable access: for example, where the information is available on the internet, the authority must consider if the requester has reasonable access to the internet or whether there are other personal circumstances which make the information not reasonably accessible to them.

19. In Ames v. Information Commissioner and the Cabinet Office (EA/2007/0110) ("Ames"), the Tribunal doubted that an authority could simply tell the requester that the information can be found on a large website: the authority would be expected to provide a link or some other reference as to where the information could actually be found.

20. S.21 FOIA is an "absolute" exemption under s.2(3) FOIA so it is not subject to the public interest balancing test under s. 2(2)(b) FOIA. Section 40(2) FOIA: Personal information

21. Section 40(2) FOIA renders information exempt from disclosure to the extent it constitutes personal data of a third party, and its disclosure would contravene any of the data protection principles (‘DP principles’) relating to the processing of personal data as set out in Article 5 UK GDPR.

22. The first question is whether the withheld information constitutes personal data under DPA. ‘ Personal data’ is defined by s.3(2) DPA as: ‘…any information relating to an identified or identifiable living individual’.

23. Information relates to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

24. If the information is personal data, the second question is whether its disclosure would breach any of the DP principles.

25. Article 5(1)(a) UK GDPR provides that personal data shall be processed ‘lawfully, fairly and in a transparent manner in relation to the data subject’ .

26. ‘ Processing’ of personal data includes its disclosure in response to a FOIA request: thus information can only be so disclosed if to do so would be lawful, fair and transparent.

27. Article 6(1) UK GDPR provides that where a public authority is holding personal information as part of its general processing, such processing will be ‘ lawful’ if and to the extent that at least one of six conditions applies. These conditions include (most relevantly for the present case): ‘(f) The processing is necessary for the purposes of legitimate interests pursued by…a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...’ . Sections 57 and 58 FOIA: The role of the Tribunal

28. Section 57 FOIA entitles either the requester or the relevant public authority to appeal to this Tribunal against the Commissioner’s decision notice.

29. Under s. 58 FOIA, if the Tribunal considers that the decision notice was either wrong in law or, to the extent that the notice involved an exercise of discretion by the Commissioner he ought to have exercised it differently, the Tribunal shall either allow the appeal (or substitute the decision notice) or dismiss the appeal.

30. The Tribunal can also review any finding of fact on which the decision notice was based. Evidence

31. Prior to the hearing the parties had submitted written evidence and submissions. These were set out in an Open Bundle of 130 pages (including indices).

32. There is no Closed Bundle (of withheld information) in this case. Submissions Summary of submissions on behalf of the Commissioner

33. The burden is upon DH, as the appellant, to demonstrate that the DN involved an error of law ( Forstater v Information Commissioner & Ministry of Justice & Judicial College [2023] UKUT 303 at §§ 37-38).

34. The Commissioner relies on the DN but sets out his response to each of the appeal grounds in summary as follows: Ground 1 - application of s.21 FOIA

35. DH is misguided in arguing that s.21 FOIA "cannot be invoked to withhold information that the authority itself acknowledges is held in its records while directing the request to external sources".

36. On the contrary, a public authority is obliged under s.1(1)(a) FOIA to confirm that requested information is held before relying on an exemption such as s.21 FOIA. The purpose of that exemption is to remove recorded information which is held by a public authority from the requirement of disclosure under FOIA if the applicant can access that information via another route.

37. Ground 1 must therefore fail. Ground 2 - application of s.21FOIA to information held within the scope of Part 4 of the request

38. DH states that "A simple internet search does not provide a definitive, authoritative link between a specific Director General or Permanent Secretary and this direct oversights of the CMS". However, Part 4 of the request did not ask for this; simply "names, positions and salary details of the senior civil servants responsible for the CMS". The Commissioner remains of the view that this latter information was reasonably accessible to DH from the links DWP provided.

39. To the extent that DH is arguing DWP holds more information in scope than contained in the links provided, the Commissioner is satisfied on the balance of probabilities that DWP hold no further information in scope. Ground 3 - The Commissioner erroneously interpreted Part 3 of the request about allowances and bonuses

40. DWP relied on s.21 FOIA in response to Part 3 of the request and provided DH with a link to DWP's non-consolidated performance-related pay data.

41. DH argues that DWP "...offered only generic policy documents..." rather than provide information on "any additional allowances or bonuses" of named senior civil servants.

42. However, a public authority is not obliged to create new information to respond to a FOIA request, only that recorded information it holds in scope subject to any applicable exemptions. As DWP stated that FOIA requires them only to provide "recorded information that best answers the question", this suggests that it holds no further information in scope.

43. The Commissioner remains satisfied that DWP correctly relied upon s.21 FOIA and has provided links to all the information held within the scope of Part 3 of the request.

44. To the extent the Tribunal may require further information and evidence on this, it could join the DWP as a party to the proceedings and direct DWP to provide any evidence and submissions. Ground 4 - The Commissioner erred in finding DWP complied with Part 6 of the request by providing a link to the Performance Management Framework

45. DWP relied on s.21 FOIA in response to Part 6 of the request and provided DH with a link to the Performance Management Framework. DH in her review request clarified that she was seeking "details regarding their performance evaluations".

46. DWP interpreted this as meaning the performance evaluations of the individual SCS who were the subject of the request. This, however, would constitute personal data which is why DWP considered that s.40(2) FOIA would be engaged.

47. However, it is clear from DH's communication with the Commissioner that she was seeking information about the evaluation process for SCS in general, and therefore the request was not for personal data.

48. On this basis, the DN made no decision on s.40(2) FOIA in respect of this part of the request, concluding that s.21 FOIA was correctly engaged as the information in scope was readily accessible from the Performance Management Framework to which DWP had provided a link.

49. DH argues that the Framework is "...high level and does not explain how the performance of these specific senior civil servants is evaluated in practice." However, as stated above, DWP is required only to provide information held within the scope of the request, and if DWP hold no other information than the information provided, it is not required under FOIA to create it in order to comply with a request.

50. Again, if the Tribunal requires more evidence and submissions on this, it could join DWP as a party to the appeal for DWP to confirm the position. Ground 5 - the Commissioner failed to fulfil his statutory duty under s.50 FOIA due to procedural failings in his investigation

51. This ground of appeal concerns the way in which the Information Commissioner's Office ("ICO") investigated the complaint as opposed to the decision made in the DN. However, the Tribunal only has jurisdiction under s.58FOIA to consider whether the Commissioner's decision notice is in accordance with the law, not how the ICO investigated the complaint.

52. As an appeal to the Tribunal is a fresh consideration of the appellant's request, not a review of the ICO's process to investigate the complaint, if there were any procedural defects, they will be cured by the "full merits" appeal conducted by the Tribunal. Ground 6 - Public interest balance

53. This ground is misguided. The Commissioner in his DN did not rely on s.40(2) FOIA and the exemption in s.21 FOIA is absolute and therefore not subject to the public interest balancing test under s.2(2) FOIA. Summary of submissions by DH, the appellant Rebuttal to s.21 FOIA (information reasonably accessible)

54. DWP's reliance on s.21 FOIA fails because the publicly available links were generic (Senior Civil Service pay framework and organisational chart). They do not lead the requester directly to the specific recorded information sought which includes: (a) Any additional allowances or bonuses. (b) The names, positions and salary details of all senior civil servants specifically overseeing CMS. (c) Information on how the performance of these specific individuals is evaluated.

55. The Ames decision requires that the information can be obtained without substantial and burdensome effort. Finding the specific, disaggregated information sought across multiple public sources, or requiring the request to cross-reference multiple documents to reconstruct the answer constitutes burdensome effort.

56. The exemption fails since the specific information is not reasonably accessible via the provided links and therefore DWP is obliged to disclose the information it confirmed it holds. Disagreement on information held

57. The Commissioner's defence of DWP's position on Parts 3, 4 and 6 of the request relies on unverified assertions from DWP that it holds no further information in scope.

58. It is highly improbable that a large public body like DWP holds no recorded information detailing the full pay structure or performance metrics for senior civil servants responsible for CMS.

59. DWP has provided no evidence of the searches it conducted (e.g. search terms used, systems searched, or who conducted the search) to support its claim of "no information held".

60. Without such evidence, the Tribunal cannot discharge its duty to assess the lawfulness of the DN based solely on DWP's unverified word. Application to join DWP to the appeal

61. DH notes the Commissioner's response suggests the need to join DWP as a party to the proceedings in relation to DWP's search for information. DH agrees and formally requests this because: (a) it is the only way for the Tribunal to compel DWP to provide credible, verifiable evidence regarding the scope of information it holds and the extent of the searches it conducted to confirm its claim of "no further information. (b) DWP's core failing relates to its application of s.21 FOIA and its blanket assertion regarding non-existence of information on Parts 3, 4 and 6 of the request. Rebuttal to public interest ground

62. If the Tribunal finds that the information is not reasonably accessible, meaning s.21 FOIA fails, the Tribunal needs to consider a qualified exemption like s.40(2). DH firmly maintains that the strong public interest in the transparency and accountability of senior officials overseeing the CMS outweighs any private interest in withholding their performance evaluations and specific remuneration details. DN is legally unsound

63. The Commissioner failed correctly to apply the law relating to "reasonable accessibility" and failed to challenge DWP's unsupported claim that it held no further information in scope. Discussion and decision The facts

64. The panel first considered the relevant facts of this case. Based on the evidence the panel has seen, the panel has made the following findings of fact based on "the balance of probabilities" (that is, what is more likely than not): (a) Information was provided by DWP in response to all parts of DH's request. (b) In response to the request Part 1 (salary ranges for SCS at DWP), Part 2 (names and positions of the SCS) and Part 4 (names, positions and salary details of SCS who oversee CMS) of the request: i. for Part 1, a link was provided to the SCS Pay Framework, showing SCS pay ranges with effect from 1 April 2023 at paragraph 7; ii. for Part 2, a link was provided to an organogram of staff roles and salaries updated on 25 October 2024; and iii. for Part 4, "to be helpful" DWP stated that the SCS (SCS2) responsible for overseeing the Child Maintenance Service is Director Simon Hunter. (c) In response to Part 3 (additional allowances and bonuses), DWP provided a link to the SCS Pay Framework explaining that pay arrangements for SCS across the Civil Service are set centrally by the Cabinet Office which Departments must follow. The link shows for DWP not only the annual payroll and headcount for the Department but also for SCS on both standard contracts and non-standard terms the maximum and median value of in-year "non-consolidated performance related pay" (i.e. bonuses) as well as the maximum and median values at the end of year. (d) In response to Part 5 (specific responsibilities), DWP provided SCS1 and SCS2 candidate packs which outline the responsibilities of SCS in the CMS. (e) The response to Part 6 (information on how the performance of these SCS is evaluated), a link to the Performance Management Framework ("PMF") for SCS 2024-2025. DWP explained that SCS performance is reviewed regularly under arrangements set out in the Framework which also states what should happen if SCS are not performing to the standards expected of them. (f) The panel finds it more likely than not that, as regards the evaluation process engaged for CMS SCS, PMF is used and that CMS does not hold any other process-related evaluation information. (g) DH has clarified in her correspondence that she does not seek evaluation information on any individuals. (h) Section 21 FOIA was applied to all Parts of the request (apart from Part 5 where candidate packs were provided). (i) DH complained by her email to DWP dated 20 January 2025 that the information provided was general rather than specific. DH requested an internal review of DWP's response. She said that she sought by her original information request to: i. "identify senior civil servants who exercise oversight over CMS "beyond Director Simon Hunter"; ii. "obtain a clear understanding of the specific responsibilities and duties of these individuals"; and iii. "gain access to details regarding their performance evaluations." (j) The panel considers that DH extended her original request by her review request on 20 January 2025. (k) DWP also regarded DH's original request as extended by her review request but nevertheless replied on 17 February 2025 that DH's complaint was partially upheld because additional information regarding CMS SCS had been identified as part of the review. This information was provided alongside additional information "requested as part of this internal review." (emphasis added) (l) With its review response, DWP provided the names of three SCS1 Deputy Directors in the CMS (in response to Part 4); three further Candidate packs for SCS2 and two specific SCS1 roles within CMS (in response to Part 5); and (in response to Part 6) a statement that performance evaluations for individuals is third-party personal data exempt from disclosure under s.40(2) FOIA. (m) Further, "to be helpful", DWP confirmed that all SCS are eligible for bonuses: as shown in the Framework, bonuses range from £0-7,100 for an SCS1 and £0-9,400 for an SCS2. DWP disclosed that none of those SCS responsible for overseeing CMS are currently receiving allowances. (n) More likely than not, DWP does not hold information within scope of the request which it has not already disclosed: indeed, "to be helpful", DWP has gone beyond its obligations under FOIA and voluntarily provided additional information. Error of law or wrongful exercise of discretion in balancing the public interest Is there an error of law in the Commissioner’s Decision Notice?

66. Having made the above findings of fact, the remaining issues for the panel in this case are (a) whether the Commissioner made any error of law in his decision and (b) whether the Commissioner ought to have exercised his discretion differently. Error of law?

67. The first issue is whether the Commissioner erred in law in finding that s. 21 FOIA is engaged.

68. Having carefully considered all the evidence and the parties' submissions, the panel considered the each of the elements required for engagement of s. 21 FOIA as set out in paragraph 18 above: Is the information realistically accessible to a hypothetical member of the general public via sources in the public domain?

69. As DWP's responses show, most of the information DH requested is published on various government websites. This information is openly available within the public domain without recourse to passwords, encryption keys and the like. The panel therefore considers that such information is realistically accessible to a hypothetical member of the general public. The panel concludes that the answer to the above question is yes as regards all but Part 5 of the request (the response to which did not rely on the s.21 FOIA exemption).

70. The panel therefore concludes that this first element is met. Did DWP give sufficient "directions" to the requester?

71. The panel notes that DWP not only provided hyperlinks to the various parts of the government websites which contained the information requested, but also directed DH to specific parts of them (e.g. in response to Part 1, referring her to paragraph 7 for the SCS pay ranges; and the names and salaries in response to Part 2 within the organogram, apart from those for SCS1 staff as personal data - though even these names were later supplied; for Part 3, paragraphs 26 and 27 of the SCS Pay Framework were specifically mentioned for allowances, and paragraphs 15-19 for bonuses).

72. In response to Part 6, DWP provided a link to the Performance Management Framework which sets out in considerable detail the stages of the evaluation process; the behaviours, minimum standards and objectives expected; the descriptors (with additional guidance) of performance ratings from Exceeding expectations to Partially Met; regular performance conversations; underperformance; and performance assessment. The panel considers this comprehensive information on the process of how the performance of SCSs in CMS, and indeed elsewhere in the civil service, is evaluated.

73. For its response to Part 5, DWP responded directly by providing a total of five candidate packs for various SCS roles within CMS.

74. The panel therefore concludes that DWP did give sufficient directions to DH as to where to find the requested information (apart from Part 5 which DWP provided separately) so the second element for application of s.21 FOIA is met. Do the particular circumstances of the requester mean they have reasonable access?

75. There is no suggestion in this case that DH does not have access to the internet or was unable to use the links DWP provided in this case, nor that her particular circumstances mean that the information was inaccessible to her. On the contrary, it is clear from her complaint to the ICO that DH was able to access the links - her complaint to the Tribunal that the information to which DWP directed her was too general rather than specific.

76. While the panel accepts that DH may have hoped for more specific information, that does not undermine the accessibility of the information to which links were provided in answer to her request, so this element too is met.

77. Since the panel concludes that the three elements for the application of s.21 FOIA according to the Commissioner's guidance are met, the panel is satisfied that the Commissioner did not make an error of law in the DN by finding that exemption applied. Public interest balance

78. As the exemption in s.21 FOIA is an absolute one, as the panel finds that exemption is applicable, no public interest balancing test applies.

79. Consequently, there was no question of the Commissioner having to exercise his discretion in weighing the public interest in disclosure against the public interest in maintaining the exemption. There is therefore no basis in this case on which the Tribunal can overturn the DN for wrongly applying the public interest test. Other issues

80. Although DWP cited s. 40(2) FOIA as an exemption upon which it relied, the Commissioner in his DN did not. As the panel's jurisdiction is limited to consideration of the lawfulness of the DN, not the public authority's response to the request, the panel did not consider whether or not s. 40(2) FOIA is applicable in this case.

81. FOIA only covers recorded information actually held by public authorities. There is no obligation to answer a question or find out information from elsewhere if the public authority does not already have the relevant information in recorded form. As DWP explained to DH, FOIA does not oblige a public authority to create new information and if a requester asks a question rather than requesting recorded information "we will provide...the recorded information that best answers the question."

82. In this case, DWP has confirmed that it holds the information, and it has already provided it or links to it in the public domain. While it is possible that DWP holds information about the individual CMS SCSs' salaries, bonuses and performance evaluations, DH's correspondence indicates that she did not expect to receive such personal data.

83. The panel does not have jurisdiction under FOIA to consider or determine procedural complaints about the way in which the Commissioner conducted his investigation following a complaint about a public authority's response (or failure to respond) to a FOIA request.

84. However, for its own part, the Tribunal does not consider it necessary or appropriate to insist upon on DWP providing evidence of the search terms, system searches or other investigations it may have carried out to "find" the information it holds: DWP from the outset confirmed that it held the information - a necessary pre-requisite to the application of the exemption in s.21 FOIA - which the panel has, for the reasons explained above, upheld.

85. Similarly, while the Tribunal invited DWP to become a party to this appeal, the Tribunal determined not to force DWP to join these proceedings when DWP failed to respond. Even had DWP been a party to this appeal, the Tribunal would not have required DWP, or indeed any public authority, to carry out a "search" for information which it has already confirmed it holds but has either already disclosed; or is accessible within the public domain; or would comprise personal data which the requester claims through her correspondence she does not seek. Conclusion

86. For the reasons set out above, the panel finds that the Commissioner’s DN was neither wrong in law nor did he have any basis on which to exercise any discretion as regards the balance of the public interest.

87. The appeal is therefore dismissed.