Oliver Price v The Information Commissioner & Anor

1. This decision relates to an appeal brought by the Appellant pursuant to section 57 Freedom of Information Act 2000 . It is in respect of a decision notice issued by the Information Commissioner on 22 November 2023 with reference IC-256195-V9J0.

2. It concerns a request for information made to the 2nd Respondent on 18 May 2023 in which the Appellant asked "I am writing this FOI request to request any documents and communications within the council’s leadership (both senior staff and elected officers) related to a project named ‘Project Burlington’" and the 2nd Respondent's reliance, in its response, on section 41(1) Freedom of Information Act 2000 to which section 40(1) was later added.

3. In this decision the following definitions are used:- Freedom of Information Act 2000 FOIA Data Protection Act 2018 DPA The UK General Data Protection Regulation UKGDPR The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 2009 Rules the Appellant's request for information the Request the Information Commissioner the IC the IC's decision notice the DN Birmingham City Council BCC John Preston of BCC Mr Preston a person who raised allegations with BCC that led to Project Burlington the Whistleblower Report dated 8 March 2022 (but should be 2023) the Report Upper Tribunal and First -tier Tribunal UT and FtT Annex of confidential reasons the Annex

4. In this decision page numbers indicated by their inclusion in brackets refer to pages of the open bundle. If reference is made to the closed bundle or supplemental bundle then "CB" or "SB" is added. Annex

5. The Annex is to remain closed for 35 days after this decision is provided to the parties because it contains information derived from and which refers to the content of the Report and to preserve effective appeal rights.

6. The Annex is split in 4 sections namely:- (a) a list of those parts of the Report where we concluded that section 40(2) FOIA applied but where we concluded the relevant redactions could be reduced while still preventing the disclosure of personal data. (b) a list of those parts of the Report where we concluded that section 41(1) (a) FOIA did not apply because the information did not come from another person. (c) certain additional reasons that derive from and refer to closed material as to why we concluded BCC would have a public interest defence to the unauthorised disclosure of confidential information in the Report. (d) a table showing where BCC would not have a public interest defence for the purposes of section 41 . Background in summary

7. From the open material it appears that in 2022 the Whistleblower alleged to BCC that suppliers to BCC of certain transport services had been overcharging by submitting erroneous or false invoices and there had been a lack of appropriate governance at BCC about these issues. These allegations were called Project Burlington by BCC and were referred by BCC's Whistleblowing Team to the Corporate Fraud Team in August 2022. BCC c onducted an investigation. Mr Preston, in his open statement, set out his understanding of the investigative process and progress of Project Burlington which culminated in the Report dated 8 March 2022 which Mr Preston explains at para. 21 of his statement should say 8 March 2023 . We also saw in the supplemental bundle that there appears to be an email from the whistleblowing team at BCC to the Whistleblower in which they thanked that person for the information, said the investigation has concluded and said:- "...a number of issues you raised were already well established and well known to the directorate and action has been taken to improve the situation and strengthen the payment process for pupil guide providers. As a result recommendations have been made. The report has been shared with the Directorate and the recommendations have been accepted..."

8. In the appeal (14) the Appellant said " I am a journalist who has been investigating allegations over funding concerns at one of the bankrupt local authorities key services and one of my reports into this troubling matter is in the link below..." The link provided is to a Daily Mail article by the Appellant published on 30 July 2023. This referred to allegations that BCC had been accused of "overpaying taxi firms by £14m" and said for example:- " Allegations from a whistleblower that staff may have 'knowingly enabled or allowed overcharges to occur' spurred the more than £3billion-a-year authority to launch an internal investigation...The council claimed an internal audit found 'no evidence' that an employee or employees may have knowingly enabled or allowed overcharges to occur. But they have refused to release this report citing 'commercial sensitivity'."

9. The Appellant also said, for example:- "2. The appellant was informed by a whistleblower...of the existence of “Project Burlington” (“the report”), an internal audit into allegations of corruption they made, which he has reported on." "6. The appellant has written several reports on the alleged corruption in Birmingham Council’s home to school transport department, which is likely to be worth tens of millions of pounds.

7. Analysis and investigation suggest that in in 2023, the council paid around £11million more to Green Destinations Ltd than competitors for the equivalent amount of work. Allegations suggested that staff “knowingly enabled or allowed overcharges to occur”.

8. Further investigations by the appellant also revealed apparent collusion between staff and Green Destinations Ltd. with members of staff working from the same small office." "14. Therefore, releasing the Burlington Report, to the greatest extent possible, must be in the public interest, and is arguably required due to the council’s failures to have accurate public accounts." Evidence and matters considered

10. For this appeal we had an open folder of papers including a bundle of 106 pdf pages and other items not in the bundle such as:- (a) a 4 page supplemental open bundle ("SB") provided by the Appellant which consisted of emails to and from the Whistleblower with that person's personal data redacted. (b) Mr Preston's partially redacted statement dated 24 December 2025 (but placed in the closed folder). (c) the Appellant's statement provided on 15 January 2026. (d) a letter of 19 October 2023 from BCC to the IC. (e) various case management directions.

11. There was also a folder of closed material. This included:- (a) a closed bundle of 33 pages prepared by BCC which had:- (i) the Report in an unredacted form (ii) the Report in an unredacted form showing where BCC says it asserts section 41 FOIA applies but where, in our view, it meant to say section 40 FOIA applies because section 41 is relied on in respect of whole document and the item itself is called "..Report marked up with section 40 FOIA". (iii) an unredacted copy of BCC's response to the appeal. (b) a closed bundle of 19 pages prepared by the Appellant where the material would otherwise reveal the identity of the Whistleblower. (c) Mr Preston's unredacted statement with exhibits. (d) various case management directions including rule 14 2009 Rules Directions.

12. In dealing with this closed material we kept in mind that we had a continuing duty to ensure fairness with regard to it (B rowning -v- Information Commissioner [2014] EWCA civ 1050 ). However, we did not consider a gist was necessary because the Appellant had redacted copies of the closed material put forward by BCC and the parties are themselves aware of the identity of the Whistleblower. The Whistleblower

13. Nothing said in this decision and no part of the substituted decision notice is intended to identify the Whistleblower directly or by a process of investigation. We kept in mind the directions made in this appeal in which information identifying or likely to identify the Whistleblower was to be withheld and that the Whistleblower was not to be identified . Those directions are repeated .

14. An email that appears to be from the Whistleblower saying that this person agrees to the Report being published is not relevant to this appeal because the Appellant says in the SB that this was dated 28 November 2023 which was after BCC's response. Mr Preston

15. We had a statement from Mr Preston. We were able to see the full version but references here are only to the redacted version. As the hearing was on the papers his evidence was not challenged or tested by cross-examination, however the Appellant provided a statement in response in which various questions were raised.

16. Mr Preston has worked for BCC since 2007 and has been the Group Auditor within BCC's Internal audit department since 2021 and leads the corporate fraud team of BCC. From this we were satisfied that he had a good overview of the relevant issues but he may also have a degree of understandable bias towards the position taken by BCC in this matter. However, Mr Preston is careful to ensure the Tribunal is aware that he is not a qualified auditor and does not seek to provide expert evidence. He also makes clear that he is not the person who conducted the Project Burlington investigation but that he does have some knowledge of the case and has been able refer to the Report itself and to a former case management system. Mr Preston also confirms that he was not aware of the Request at the time it was delivered and he says that he understands it was dealt with by the then legal practise manager. He confirms that his evidence about how the Request was dealt with derives from his reading of the papers. He says that he cannot comment on the actual process that resulted in the decision to withhold the Report but he does however go on to say in effect, in paragraph 30 of his statement, that he also believes that it was right not to release the Report and why.

17. His evidence was useful for the Tribunal in particular when assessing questions such as how FOIA disclosure might impact employees and others coming forwards in future to make whistleblowing allegations. We were also careful to take note of his views (for example see para 35) because we concluded that he would understand the way in which BCC operates, its structures, team sizes and what type of disclosures could lead to conclusions being reached in particular about the Whistleblower and/or others who confided in BCC. However we did not simply accept his view. We were careful to ensure that when considering his evidence we had in mind our own analysis of the Report, sections 41 and 40 FOIA and the competing arguments presented for and against disclosure.

18. The Appellant says that the fact that Mr Preston was not personally involved in the Report or had dealt with the Request is a "34...startling admission given his evidence can only therefore assist the tribunal to a limited extent." It is fair to point out the evidential limitations caused by Mr Preston being "a step removed" from Project Burlington, the Report and the Request. In our view this is not a startling admission but Mr Preston rightly and carefully informing the Tribunal of the basis of his evidence, which we noted and kept in mind when considering it. Had the Tribunal (or the Appellant) considered it necessary for Mr Preston's evidence to be given in person and for him to be cross-examined we would not have allowed this matter to be decided on the papers as agreed by the parties. Role of the Tribunal

19. The Tribunal's role in an appeal by section 57 FOIA is set out in section 58 FOIA which provides that:- (1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

20. The Tribunal exercises a full merits appellate jurisdiction and so stands in the shoes of the IC and decides which (if any) exemptions apply ( NHS England -v- Information Commissioner and Dean [2019] UKUT 145 (ACC) para 10). In Peter Wilson -v- The Information Commissioner [2022] UKFTT 0149 the FtT said:- "...the Tribunal’s statutory role is to consider whether there is an error of law or inappropriate exercise of discretion in the Decision Notice. The Tribunal may not allow an appeal simply because it disagrees with the Information Commissioner’s Decision. It is also not the Tribunal’s role to conduct a procedural review of the Information Commissioner’s decision making process or to correct the drafting of the Decision Notice.”

21. On burden of proof in Forstater v Information Commissioner and others [2023] UKUT 303 (AAC) the UT at para 40 said:- (2) the “ordinary presumption” is that it is for an appellant to prove their case. The burden will rest with the appellant except where statute expressly or impliedly provides otherwise: Khan v Custom and Excise Commissioners [2006] EWCA Civ 89 ; [2006] STC 1167 at [73.7]. Neither FOIA nor the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2008 contain any express provision about the burden of proof and neither by implication remove the ‘ordinary presumption’ either; and (3) however, the concept of the burden of proof is of secondary importance in tribunal proceedings which involve a full merits review, since to apply strict burdens of proof may prevent the tribunal from properly discharging its responsibility to decide the facts for itself and/or exercise any discretion afresh:..." Request to appeal (summary)

22. On 18 May 2023 (65) the Appellant made the Request. On 22 May 2023 BCC replied saying they could find no reference to a Project Burlington and asked for clarification which was provided on the same day (66). On 14 July 2023 BCC provided its response (68). It said that it held the Report and communications with BCC's leadership but that it had concluded that section 41 FOIA applied to both. It provided its reasoning. The Appellant asked for an internal review on 18 July 2023 to which BCC replied on 25 August 2023 with an unchanged position (76).

23. The Appellant complained to the IC on 6 September 2023 (79). We noted the IC's correspondence with BCC in particular the letters of 19 October 2023, 23 October 2023, 31 October 2023 and 1 November 2023 (87-92). On 22 November 2023 the IC issued the DN. In summary this said " 2. The Commissioner’s decision is that the Council is entitled to rely on section 41(1) (information provided in confidence) to refuse to provide the withheld information."

24. On 5 December 2023 the Appellant commenced this appeal. The outcome sought (15) is "a full release of the information requested." The IC provided its response on 15 February 2024 (36-49).

25. BCC was joined as a party on 29 February 2024 and provided its response on 27 March 2024 (51- 62). In addition to setting out its case on section 41 FOIA it also made submissions on section 40 FOIA. The Appellant has replied to BCC's submissions. Summary of issues

26. In deciding whether the DN was in accordance with the law we had in mind these issues:- (a) does the exemption at section 41(1) FOIA apply to the Report? (b) does the exemption at section 40(2) FOIA apply to those parts of the Report identified in the closed bundle version provided? (c) was there material, other than the Report, in scope and in existence at the date the Request was received? FOIA

27. FOIA provides that any person making a request for information to a public authority is entitled to be informed in writing if that information is held (section 1(1) (a) FOIA) and if that is the case to be provided with that information (section 1 (1) (b) FOIA).

28. The IC in its response says (46/47):- "54 The Upper Tribunal has confirmed that exemptions under FOIA should be considered as at the time of the response to the Request – see Keighley v Information Commissioner & BBC [2023] UKUT 228 (AAC) at [29], applying the principles in Montague v IC and DIT [2022] UKUT 104 (AAC) at [47]-[90]." In Keighley the UT said:- "29. I agree with the ICO’s submission that the time to assess the application of the derogation should be based on the same principles as apply to the consideration of the applications of the exemptions under FOIA and the application of the public interest test under s.2.2 FOIA....the Upper Tribunal held:- “86... The public authority is not to be judged on the balance of the competing public interests on how matters stand other than at the time of the decision on the request which it is has been obliged by Part I of FOIA to make... "There is no obvious reason why the timing for considering the application of the derogation should be different from the timing when considering the other provisions under FOIA...."

29. Accordingly in our view, in this appeal, the relevant date is at the date of the response on 14 July 2023. However nothing in this decision would change if the relevant date was between the date of BCC's initial reply and the date of BCC's response after the internal review (22 May 2023 and 25 August 2023). Section 41 FOIA

30. Section 41(1) provides that information is exempt if:- (a)it was obtained by the public authority from any other person (including another public authority), and (b)the disclosure of the information to the public (otherwise than under this Act ) by the public authority holding it would constitute a breach of confidence actionable by that or any other person .

31. From legal authorities such as Coco -v- A N Clark (Engineers) Limited [1968] F.S.R.415 Megarry J the following test can be adopted:- (a) was the information obtained by the public authority from a third party, for the purposes of section 41(1) (a)? If it was then its disclosure would constitute an actionable breach of confidence where:- (i) the information has the necessary quality of confidence to justify the imposition of a contractual or equitable obligation of confidence (ii) the information was imparted in circumstances importing an obligation of confidence. (iii) disclosure is unauthorised and would be a breach of that obligation. (b) is the information "trivial" or would the public authority nevertheless have a defence to a claim for breach of confidence based on the public interest in the disclosure of the information?

32. Section 41(1) is an absolute exemption and this public interest defence element does not derive from section 2 FOIA. It is for the Appellant to show that any breach of confidence is in the public interest (see Evans v Information Commissioner [2012] UKUT 313 (AAC) at para 38)

33. Material may consist of a mixture of both confidential and non-confidential information. In such cases, by redaction, the non-confidential material should be disclosed while the section 41 exemption is only maintained for that which is properly confidential provided, that after redaction, what remains is of value.

34. It is also possible that disclosure of non-confidential information when seen together with other public information could lead to the confidential information being revealed. Where this "jigsaw" or "mosaic" effect is considered a risk the public authority may claim the benefit of section 41 for items which have the appearance of being non-confidential where that operates to prevent the jigsaw effect and the unintended inadvertent disclosure of confidential information.

35. Parts of the Report came from BCC's employees. In Egan -v- the Information Commissioner [2022]UKFTT 529 (GRC) the FtT decided (and we agree) that:- "51... We agree that the exemption can apply to personal judgments or opinions provided by employees during an investigation. The exemption would not apply to employees who disclose information in the course of their employment while acting in their capacity as an employee. On the facts of this case, it appears that the individuals who were interviewed were not providing information while acting solely in the course of their employment. They were providing personal statements including opinions as part of an investigation into patient safety, in accordance with their obligations as registered health professionals. We therefore find that section 41 is engaged by the information relating to interviews with staff members. We have gone on to consider the three elements of the test for breach of confidence."

36. Relevant also is the IC's Guidance that " Section 41(1) (a) can also cover information you produced internally if it is a record of confidential information given to you by another person." Also in our view section 41 FOIA will not be engaged as regards recommendations made and/or conclusions reached by a public authority, even where these are informed by or based on confidential information unless disclosure of this would itself reveal the confidential information. Section 40 FOIA

37. Section 40(2) provides that:- "Any information to which a request for information relates is also exempt information if (a) it constitutes personal data which does not fall within subsection (1), and (b)the first, second or third condition below is satisfied ."

38. Section 40 (3A)(a) FOIA sets out the first of these three conditions. This makes the provision of personal data exempt if “disclosure of this information to a member of the public otherwise than under this Act (a) would contravene any of the data protection principles…”

39. By Section 2(3)(fa) FOIA if this exemption is in relation to this first condition it is an absolute exemption.

40. Section 3(4)(d) DPA defines processing as “ disclosure by transmission, dissemination or otherwise making available.” It includes publication pursuant to a FOIA request which is "to the world" .

41. Personal data is defined in section 3(2) DPA as “any information relating to an identified or identifiable living individual...” Section 3(3) defines “Identifiable living individual” as "... a living individual who can be identified, directly or indirectly, in particular by reference to (a) an identifier such as a name, an identification number, location data or an online identifier, or (b)one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.” This includes where the personal data can be identified by the person whose data it is.

42. In Information Commissioner v Magherafelt District Council [2012] UKUT 263 (ACC) the UT referred to the “motivated intruder” test which is a person:- “….who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’. The question was then one of assessment by a public authority as to ‘… whether, taking account of the nature of the information, there would be likely to be a motivated intruder within the public at large who would be able to identify the individuals to whom the disclosed information relates.”

43. The data protection principles are those set out in section 34(1) DPA. They include Article 5(1)(a) UKGDPR which provides that personal data shall be processed “ lawfully, fairly and in a transparent manner as regards the data subject. ”

44. Article 6(1) UKGDPR provides that the processing of personal data shall only be lawful if, for example, the data subject has given consent or " (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child ."

45. T he Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 (29 July 2013) set out these three questions at para 18:- “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? ”

46. Interests to be legitimate have to be interests of more than just the requester (see the UT decision in Rodriquez Noza -v- the Information Commissioner & Nursing and Midwifery Council [2015]UKUT 0499 (ACC) at para 24).

47. The UT in Goldsmith International Business School -v- The Information Commissioner and the Home Office [2014] UKUT 0563 (ACC) provided a number of relevant propositions summarised as follows:- 2 the test for reasonable necessity comes before the consideration of the data subject's interests; 3 reasonable necessity means “ more than desirable but less than indispensable or absolute necessity”; 5 “ T he test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question.”

48. As well as lawfulness by Article 5 UKGDPR processing must be carried out "... fairly and in a transparent manner as regards the data subject. ” Not held

49. Information, for the purposes of a FOIA request, by section 1(4) FOIA:- "i s the information in question held at the time when the request is received, except that account may be taken of any amendment or deletion made between that time and the time when the information is to be communicated under subsection (1)(b), being an amendment or deletion that would have been made regardless of the receipt of the request."

50. Whether information is held is decided on the balance of probabilities. Additionally for example:- (a) in Jeremy Clyne v IC and London Borough of Lambeth EA/2011/0190 ( referred to by the UT at para 30 in A ndrew Preston -v- (1) The Information Commissioner (2) C.C. West Yorkshire Police [2022] UKUT 344 (AAC) it was held that the "38...issue for the Tribunal is not what should have been recorded and retained but what was recorded and retained." (b) in Oates v IC and Architects Registration Board EA/2011/0138 at para 11 it was said that "As a general principle, the IC was, in the Tribunal's view, entitled to accept the word of the public authority and not to investigate further in circumstances, where there was no evidence as to an inadequate search, any reluctance to carry out a proper search or as to motive to withhold information actually in its possession..." (c) in Linda Bromley v the Information Commissioner and the Environment Agency EA/2006/0072 (cited by the UT at para 29 in A ndrew Preston) the Tribunal said:- "There can seldom be absolute certainty that information relevant to a request does not remain undiscovered somewhere within a public authority's records...However, it argued... that the test to be applied was not certainty but the balance of probabilities....We think that its application requires us to consider a number of factors including the quality of the public authority's initial analysis of the request. the scope of the search that it decided to make on the basis of that analysis and the rigour and efficiency with which the search was then conducted. Other matters may affect our assessment at each stage, including, for example, the discovery of materials elsewhere whose existence or content point to the existence of further information within the public authority which had not been brought to light. Our task is to decide, on the basis of our review of all of these factors, whether the public authority is likely to be holding relevant information beyond that which has already been disclosed." Section 40(2) FOIA Position of the parties

51. In BCC's response it puts forward its case on section 40 FOIA (60) as an additional or alternative basis to withhold information in the Report. Reference is made to the existence of personal data in the form of names of people in the Report and the ability of a motivated intruder to identify personal data from material in the Report.

52. BCC's position is that there would be no lawful basis for disclosure (in the absence of consent) required by Article 6(1) UKGDPR for BCC to disclose the personal data in the Report and disclosure would be a disproportionate interference with those individuals’ rights, including their rights under Article 8 of ECHR.

53. In the reply (and response to the statement) the Appellant says that BCC has sought to use section 40 FOIA "without explaining how that could properly be regarded as personal data when it does not relate to any identifiable individual." He does say however that if the Tribunal does consider there is section 40 material it can be redacted. Tribunal's review

54. We reviewed the Report in the closed bundle (13-19CB) in its marked up version and have seen where section 40 FOIA is claimed (but called section 41 in error). For each proposed redaction we considered whether it contained personal data as defined in section 3 DPA, whether personal data could be identified including by a motivated intruder or the data subject themself and whether a lawful basis existed for disclosure in the absence of consent. As regards identification we took particular note of the evidence given by Mr Preston for example where he said:- "29...I can see from his annotations that he appeared to consider large parts of the report to contain information that would either reveal personal data, would allow the identification of the Whistleblower, and/or would reveal information provided in confidence to the investigation, potentially therefore identifying the sources."

55. In our view:- (a) each redaction sought by BCC does contain personal data although some may be more extensive than necessary; (b) the data subjects have not consented to the disclosure of their personal data; and (c) Article 6(1)(f) UKGDPR does not provide a lawful basis for the processing of this personal data because the Appellant's legitimate interest appears to be to have disclosure of the Report to see what became of the allegations and in particular to see what facts were established about the allegations and what BCC has done about them. In our view disclosure to the world of personal data for the pursuit of these legitimate interests is not necessary and the Appellant accepted there would be redactions for section 40(2) FOIA.

56. In our view a number of the section 40(2) redactions claimed by BCC appear to be more extensive than is necessary to protect personal data from disclosure or inadvertent disclosure. The redaction of the Report is to be amended in light of the decisions set out in section A of the Annex. Section 41 FOIA Position of the parties

57. The IC in the DN was satisfied that the information was obtained from another person because:- "10...the whistleblower’s allegations which are contained within the withheld report were provided to the Council by another person, that being the whistleblower. He also considers that as the report discusses the whistleblower’s allegations in detail, its disclosure would reveal the content of the whistleblower’s allegations. Therefore, the Commissioner considers the whole of the report to have been obtained from another individual and so this requirement of section 41(1) is met"

58. The IC was also satisfied that disclosure would constitute an actionable breach of confidence because:- (a) it has the necessary quality of confidence in that "it relates to allegations of misconduct made by a whistleblower. Furthermore, the Council has confirmed that only a limited number of people within the Council have access to the withheld information and so the withheld information is not otherwise accessible"; (b) the withheld information was provided in circumstances importing an obligation of confidence being information "provided to the Council by a whistleblower and would therefore be subject to the Council’s whistleblowing and serious misconduct policy. This policy states that “the Council will seek to treat all disclosures in confidence as a means of preventing victimisation and will endeavour to avoid disclosing information identifying any whistleblower” The Commissioner therefore considers that the whistleblower would reasonably expect their allegations to be kept in confidence by the Council and so he is satisfied that the withheld information was provided in circumstances importing an obligation of confidence"; and (c) unauthorised disclosure would cause detriment to either the party which provided it or any other party caused by " the nature of the allegations made and the fact that the Whistleblower could potentially be identified from the allegations ."

59. The IC also considered whether, if faced with an action for breach of confidence, BCC would have a public interest defence. The IC says that BCC accept that "the allegations made by the whistleblower are serious and would be of considerable interest to the public as they relate to maladministration and misconduct by individuals conducting Council business." However the IC also says that BCC: - (a) considers there to be a strong public interest in protecting (in this case the Whistleblower's) right to privacy and (b) considers that disclosure would have negative impact on the conduct of future investigations (against the public interest) because those potentially involved may be reluctant to take part if they think that the information provided by them might be put into the public domain.

60. The IC concludes that although the arguments are finely balanced the public interest in disclosure falls short of allowing BCC to defend a claim for breach of confidence.

61. The Appellant (who has not seen the Report) in the appeal (14) says that there is a clear "...public interest in giving proper journalistic scrutiny to an investigation concerning serious maladministration and misconduct allegations at a publicly funded authority already facing accusations of massive financial mismanagement." The Appellant also says that he is a "journalist who has been investigating allegations over funding concerns at one of the bankrupt local authorities key services..." The Appellant refers to page 14 of BCC's whistle blowing policy and says a key consideration should be that "the whistleblower who triggered the report would not object to its release." He adds:- "..I know who the whistleblower is, and I have attached an email from him where he says that he is happy for the report to be released to me even if it could lead to him being indirectly identified....Had the council asked the whistleblower if they could release it, it is clear from the evidence that he would have said yes."

62. BCC in its response sets out the basis on which its asserts section 41 FOIA applies. This is because:- (a) BCC was provided with the information in the Report from the Whistleblower and from other people spoken to by those dealing with Project Burlington. The report was therefore obtained from another person. (b) those who confided information to BCC would have an actionable breach of confidence claim against BCC because:- (i) the information is not public knowledge but the outcome of a confidential internal investigation and only " a limited number of people within the...Council have access to the information." It thus has the necessary quality of confidence; (ii) BCC was given the information in the context of an internal audit investigation "which is subject to specific policies requiring confidentiality." It was therefore imparted in circumstances importing an obligation of confidence; (iii) disclosure would be unauthorised because (at the relevant time) "none of the individuals who participated in the investigation authorised the Council to make use of the relevant information other than in connection with its own Project Burlington investigation"; and (iv) if necessary those impacted would be able to shown detriment because "The contents of the Report relate to sensitive matters which go to the performance and the conduct of the individuals involved. Given the evident media attention in these matters, the unauthorised disclosure by the Council of the relevant information could have caused unwanted attention, criticism and distress for those individuals." (c) there would be no defence to an action for breach of confidence on the basis that the information is just "trivial" and BCC would not have had a public interest defence because even though the Report is of interest that is balanced by the "powerful public interest" that, especially in the area of whistle blowing, confidences are preserved so "that individuals feel able to come forward with concerns without fear of their confidence being broken."

63. In its conclusion BCC says "39...it would not have been in the public interest for the Council to have breached the duty of confidence it owes to the confiders. In other words, it would have been no defence to a claim for breach of confidence brought against the Council by one of the confiders for the Council to have asserted that disclosure is in the public interest. As such, the confiders would each have had an actionable claim for breach of confidence against the Council if it had disclosed the Report publicly outside of the FOIA regime."

64. In the response to Mr Preston's statement the Appellant makes a number of submissions which go to the issue of whether there would be a public interest defence following an unauthorised disclosure the Report. Section 41 FOIA- Review by the Tribunal

65. We reviewed the Report in the closed bundle. Those about whom the allegations were made

66. In our view section 41 FOIA does apply to the names and/or identifying initials of those entities about which the Whistleblower raised concerns or material which could identify them. This is because their names were provided to BCC by the Whistleblower and others and that the information has the quality of confidence and was provided in a confidential setting. In our view also BCC would not have a public interest defence if the entities names were published without the authority of the confider. We take this view even though we are aware that the Appellant has shown links to media reports which provide certain names. This is because seeing names in the Report (which may or may not be the same as those which have appeared in the media) is something different to the press reporting. Accordingly this material should be redacted in any disclosure of the Report. Material not obtained from another person

67. We concluded that some of the information in the Report was not obtained from the Whistleblower or from others. Examples of where the content of Report did not derive from other people and publication would not in our view lead to the inadvertent disclosure of confidential information include (a) the cover sheet, headings and most sub-headings, (b) introductory paragraphs and (c) the Report writer's conclusions and recommendations. These parts of the Report have been identified in the Annex at section B and the exemption at section 41 FOIA does not apply them. They are to be disclosed to the Appellant, unless exempt from disclosure by another provision of FOIA. Material obtained from another person

68. We accept that apart from the above and as listed in the Annex the information in the Report was obtained from the Whistleblower and/or others. Would there be an actionable claim for breach of confidence?

69. Where information was obtained from the Whistleblower or others we concluded that they would have an actionable claim for breach of confidence against BCC in the event of an unauthorised publication (outside the ambit of FOIA) because:- (a) the information, as seen in the Report, was not in the public domain and involved serious allegations and therefore had the necessary quality of confidence; (b) the information in the Report came initially from a whistleblower and then from others who we accept will have fairly assumed that what they were saying to the Corporate Fraud Team was confidential. We accept that BCC's policy on misconduct and whistleblowing (30) does not provide a full legally binding guarantee of anonymity and confidentiality but in our view because of the context and circumstances in which information was being given an obligation of confidence was imported; (c) there was at the relevant time no actual authorisation for the confidential material provided by others to be published and we accept that the email from the Whistleblower does not provide that authorisation effectively for that person nor in any way for the many others who provided confidential information and assisted with the investigation and the Report. We also do not accept as suggested that BCC were under a legal obligation to try to get that authorisation and therefore BCC's reasons for not having done so, while noted, we did not find to be relevant in our consideration of this appeal; (d) if necessary to do so we accept (see paras 34ff of Mr Preston's statement) that an unauthorised publication could be to the detriment of those who have given information in confidence due to the nature of the allegations, the openness with which some have approached giving their views and the attention that could be drawn to them internally in BCC and more publicly. Would BCC have a public interest defence?

70. We accept the information is not trivial. However we did not agree with BCC in relation to all relevant parts of the Report on the question of whether BCC would have a public interest defence to an action for breach of confidence.

71. The Appellant (who has not seen the Report) has the burden of showing why the public interest would operate as a defence to an action for breach of confidence in this case. The arguments put forward by the Appellant include:- (a) the very large sums of public money that appear to be involved; (b) the existence of an allegation that there may have been collusion between BCC staff and those seeking to overcharge BCC; (c) the allegation of the existence of a substantial issues with BCC's accounts; (d) the principle that local people have the right to know how their money is spent and how decisions are made; (e) the ongoing financial difficulty of BCC caused allegedly by mismanagement; (f) to ensure that the allegations of a large fraud is not brushed under the carpet which would make future frauds more likely; (g) because of the very high level of public interest; and (h) because BCC could consider publication of the Report with redactions

72. To these the Tribunal, which had the benefit of seeing the Report, would add the generic but important public interest in public authorities acting with openness and transparency and other reasons set out in the Annex. We also noted the IC's view that (8) "there is a strong public interest in the disclosure of the withheld information as the information relates to allegations of misconduct and maladministration."

73. The reasons put forward by BCC (and its witness) and the IC against the public interest operating as a defence to an action for breach of confidence included these:- (a) the powerful public interest" that, especially in the area of whistle blowing, confidences are preserved so "that individuals feel able to come forward with concerns without fear of their confidence being broken"; (b) publication risks there being a greater reluctance in the future on the part of those who may have information to give; (c) publication risks dissuading "employees and others from coming forward in the future to raise concerns about fraud, corruption and serious misconduct"; ( d ) "it can take time to build the confidence of the informant and to reassure them that their concerns will be taken seriously and that their information will be treated in strictest confidence"; and ( e ) publication would seriously undermine BCC's ability "to root out fraud."

74. We accept that the submissions made are relevant considerations and we noted that in the DN the IC referred to this question as being "finely balanced." Our decision is that for some parts of the Report, where section 41 applies, BCC would have a public interest defence and for other parts it would not. Those where it would not are set out in section D of the Annex. Other than those listed in section D of the Annex it is our conclusion that BCC would have a public interest defence.

75. Our reason for concluding that a public interest defence would be available is based on a combination of the following: (a) as set out in the Annex (see section C); (b) because of the decisions we have made:- (i) on section 40(2) FOIA by which the personal data of those who have contributed to the Report should not be disclosed (see paras 55 & 56); (ii) that the Whistleblower should not be identified or that person's personal data disclosed (see paras 13 & 55); (iii) that the names of those about whom the allegations were made should not be disclosed (see para 66); (c)while we accept that it is against the public interest for individuals to feel inhibited from coming forward to make allegations and to take part in investigations having sought to protect the identity of the whistleblower and those who contributed to the Report in our view that concern is in part mitigated; (d) BCC's whistleblowing policy explained that there were circumstances in which information might have to be disclosed (30); (e) while publication risks there being a greater reluctance in the future on the part of those who may have information to give if nothing appears to have been done in response to the whistle blowing and provision of information that may also operate to dissuade potential informants from making the effort and taking the risk to get involved; (f) because of the generic importance of public authorities being open and transparent; (g) because we agree with the IC that "t here is a strong public interest in the disclosure of the withheld information as the information relates to allegations of misconduct and maladministration." (h) because the allegations in the Report relate to the misuse of public money. Not held information (emphases added)

76. In the Request the Appellant asked:- "I am writing this FOI request to request any document s and communications within the council’s leadership (both senior staff and elected officers) related to a project named ‘Project Burlington’"

77. When replying to the Request BCC said (68):- "Since our previous correspondence to you explaining we need more time to consider the application of qualified exemptions, primarily sections 41 and 40(2) of the FOIA to the following information held i) Report relating to Project Burlington, and ii) Communications within the council’s leadership , We have determined that section 41 applies to i) and ii "

78. In correspondence with the IC BCC was asked (87):- "Furthermore, based on the Council's response to the request, I understood that as well as the Project Burlington Report, the Council was withholding some "communications within the Council's leadership" under section 41 of FOIA. However, this information has not been provided to me"

79. BCC replied (89):- "In relation to other communications within the council's leadership at this time we are not aware of any, however, I have asked the service area to check again and will come back to you shortly with a copy if applicable"

80. BCC went on to state on 1 November 2023:- " Further to my email of yesterday, we can now confirm that only the Report falls within scope of the FOI request, there was no communications with the council leadership or elected officers."

81. By the CMD of 20 October 2025 BCC were required to "10... state in writing if it asserts that, apart from the Burlington Report, the information relevant to the remainder of the request is "not held" and if so on what basis." Mr Preston in his statement says:- "23.The Project Burlington report was not widely shared within Birmingham City Council. It was provided only to the Council’s Whistleblowing Team, for them to decide on appropriate dissemination. Whilst I am unable to confirm exactly who then received the report, it is highly likely that it would have only been shared with senior managers within the organisation who needed to be made aware of its contents to be able to act upon it. I would expect that it was likely shared with Directors in the Children and Families Directorate"

82. In our view it is probable that BCC's main focus was on the Report and that the possible existence of other documents and communications within the scope of the Request was not considered to the same degree. In any event we saw no adequate explanation of what had been done to look for such items or what processes had been adopted of the sort referred to in Bromley and the IC's Guidance.

83. From para 23 of Mr Preston's statement, it was clear that he thinks the Report had been shared and with whom. Additionally when reporting back to the Whistleblower BCC said "... The report has been shared with the Directorate. .." We would expect the process of sharing to have been done in writing. It also seemed unlikely to us that the Report could have been produced and finalised without there being any connected correspondence especially as this was referred to as being held in BCC's response to the Request.

84. Therefore on the balance of probabilities we do not accept the accuracy or adequacy of BCC's statement of 1 November 2023 that "... only the Report falls within scope of the FOI request, there was no communications with the council leadership or elected officers" and require BCC to search and then respond to the Appellant . Conclusions

85. In summary and as set out in this decision and the Annex:- (a) the Council acted appropriately to prevent the personal data of the Whistleblower and the identity of those against whom the allegations are made from being disclosed by sections 40(2) and 41 FOIA. (b) each place in the Report that BCC claims section 40(2) FOIA applies does contain personal data directly or indirectly or that personal data could be identified by a motivated intruder or the person themselves. In our view there would not be a lawful basis for the disclosure of that personal data because disclosure is not necessary for the pursuit of a legitimate interest. However, we conclude that the redaction of the Report has gone further than is necessary to ensure that the personal data is protected even from a motivated intruder and therefore BCC is required to reconsider the extent of the redactions to ensure that only personal data is removed and that other information is published (unless another exemption applies) as set out in section A of the Annex. (c) some material in the Report did not derive from other people for the purposes of section 41(1) (a) FOIA. This is identified in section B of the Annex. (d) where the material in the Report did derive from other people we have concluded that:- (i) the confider in each case would have an action for breach of confidence against BCC if it was disclosed because the material has the quality of confidence, it was provided in circumstances which were confidential and there has been no authorisation of its disclosure but; (ii) because of the reasons set out in section C of the Annex and paras 74-75 of the decision, BCC would have a public interest defence for any unauthorised disclosure of the Report save as listed in section D of the Annex. (e) in so far as BCC asserts other documents and correspondence are not held we conclude that BCC should re-consider that position and having carried out searches in the manner suggested by the IC's Guidance then respond to the Request again. Decision

86. Accordingly we have concluded that the DN is not fully in accordance with the law and the appeal is allowed in part. Signed Judge Heald Date: 23 March 2026