Reference: FS50898156

Freedom of Information Act 2000 (FOIA)

Decision notice

Date: 22 June 2020

Public Authority: House of Commons

Address: London
SW1A 0AA

Complainant: on behalf of The Guardian Newspaper

Decision (including any steps ordered)

1. The complainant has requested details of the number of times each

Former Member’s security pass was used. The House of Commons (“the
Commons”) disclosed an anonymised version of the list, but relied on
section 40(2) of the FOIA to withhold the name linked to each individual
pass.

2. The Commissioner’s decision is that the information in question is

personal data but that the legitimate interests in disclosure outweigh the
rights of the data subjects. She therefore finds that the Commons is not
entitled to rely on section 40(2) of the FOIA to withhold the information.

3. The Commissioner requires the Commons to take the following steps to

ensure compliance with the legislation.

• Disclose a de-anonymised version of the list it has already

disclosed.

4. The Commons must take these steps within 35 calendar days of the
date of this decision notice. Failure to comply may result in the
Commissioner making written certification of this fact to the High Court
pursuant to section 54 of the Act and may be dealt with as a contempt
of court.

1
Reference: FS50898156

Request and response

5. On 8 August 2019, the complainant wrote to the Commons and

requested information in the following terms:

“Please may I be provided with the following information concerning

the most recent (July 2019) list of former Members who hold a pass
for the parliamentary estate:

“1) For each former Member named in the spreadsheet, please

provide us with the total number of dates on which their
parliamentary pass was used between 1 July 2018 to 30 June 2019.
We anticipate that this information will likely be held by the
Parliamentary Security Department or the Pass Office. Please do
not provide us with the individual dates; only the total
number of dates on which each pass was used.” [original
emphasis]

6. The Commons responded on 30 August 2019. It provided a list which

showed the number of occasions on which each individual pass had been
used, but did not link the passes with the individual users. It stated that
linking an individual with a particular pass would result in a disclosure of
personal data about that individual which would breach the data
protection principles. It therefore relied on section 40(2) of the FOIA to
withhold the information.

7. The complainant sought an internal review on 2 September 2019. He

noted that the list of former member pass holders was already in the
public domain and therefore the withheld information could not be
personal data. Furthermore, he argued, even if the information was
personal data there would be a legitimate interest in its disclosure.

8. The Commons completed is internal review on 15 October 2019. It

upheld its original position.

Scope of the case

9. The complainant contacted the Commissioner 16 December 2019 to

complain about the way his request for information had been handled.

10. The Commissioner considers that the scope of her investigation is to

determine whether the requested information would result in the
disclosure of personal information and, if it would, whether that
disclosure would breach the data protection principles.

2
Reference: FS50898156

Reasons for decision

Section 40 personal information

11. Section 40(2) of the FOIA provides that information is exempt from
disclosure if it is the personal data of an individual other than the
requester and where one of the conditions listed in section 40(3A)(3B)
or 40(4A) is satisfied.

12. In this case the relevant condition is contained in section 40(3A)(a)1.

This applies where the disclosure of the information to any member of
the public would contravene any of the principles relating to the
processing of personal data (‘the DP principles’), as set out in Article 5
of the General Data Protection Regulation (‘GDPR’).

13. The first step for the Commissioner is to determine whether the withheld
information constitutes personal data as defined by the Data Protection
Act 2018 (‘DPA’). If it is not personal data then section 40 of the FOIA
cannot apply.

14. Secondly, and only if the Commissioner is satisfied that the requested
information is personal data, she must establish whether disclosure of
that data would breach any of the DP principles.

Is the information personal data?

15. Section 3(2) of the DPA defines personal data as:

“any information relating to an identified or identifiable living

individual”.

16. The two main elements of personal data are that the information must
relate to a living person and that the person must be identifiable.

17. An identifiable living individual is one who can be identified, directly or

indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social identity of the individual.

1
As amended by Schedule 19 Paragraph 58(3) DPA.

3
Reference: FS50898156

18. Information will relate to a person if it is about them, linked to them,

has biographical significance for them, is used to inform decisions
affecting them or has them as its main focus.

19. In this case, the complainant has argued that the withheld information is
not personal data because it is a list of names and that list has already
been published elsewhere.

20. Whilst the information which has been withheld is literally a list of
names, the Commissioner agrees with the Commons that it is the
complete information (ie. the withheld information combined with what
has already been disclosed) and what that might reveal, that should be
considered.

21. Providing the withheld information as well as that already disclosed

would reveal a list which would link the names of former Members of
Parliament with the exact number of times their Parliamentary security
pass had been used. This usage data would have the individuals
involved as its main focus and the individuals would clearly be
identifiable from the complete list.

22. Whilst the Commissioner has not viewed the complete list in this case
(as she does not consider it would add anything substantive to her
considerations) she is satisfied that the complete information would
clearly both relate to and identify the individuals concerned. This
information therefore falls within the definition of ‘personal data’ in
section 3(2) of the DPA.

Would disclosure contravene principle (a)?

23. The fact that information constitutes the personal data of an identifiable
living individual does not automatically exclude it from disclosure under
the FOIA. The second element of the test is to determine whether
disclosure would contravene any of the DP principles.

24. The most relevant DP principle in this case is principle (a).

25. Article 5(1)(a) of the GDPR states that:

“Personal data shall be processed lawfully, fairly and in a transparent

manner in relation to the data subject”.

26. In the case of an FOIA request, the personal data is processed when it is
disclosed in response to the request. This means that the information
can only be disclosed if to do so would be lawful, fair and transparent.

27. In order to be lawful, one of the lawful bases listed in Article 6(1) of the
GDPR must apply to the processing. It must also be generally lawful.

4
Reference: FS50898156

28. Article 6(1) of the GDPR specifies the requirements for lawful processing
by providing that “processing shall be lawful only if and to the extent
that at least one of the” lawful bases for processing listed in the Article
applies.

29. The Commissioner considers that the lawful basis most applicable is
basis 6(1)(f) which states:

“processing is necessary for the purposes of the legitimate interests

pursued by the controller or by a third party except where such
interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal
data, in particular where the data subject is a child”.2

30. In considering the application of Article 6(1)(f) of the GDPR in the

context of a request for information under the FOIA, it is necessary to
consider the following three-part test:-

i) Legitimate interest test: Whether a legitimate interest is being

pursued in the request for information;

ii) Necessity test: Whether disclosure of the information is

necessary to meet the legitimate interest in question;

iii) Balancing test: Whether the above interests override the

legitimate interest(s) or fundamental rights and freedoms of the
data subject.

31. The Commissioner considers that the test of ‘necessity’ under stage (ii)
must be met before the balancing test under stage (iii) is applied.

2 Article 6(1) goes on to state that:-

“Point (f) of the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks”.

However, section 40(8) FOIA (as amended by Schedule 19 Paragraph 58(8) DPA) provides
that:-

“In determining for the purposes of this section whether the lawfulness principle in
Article 5(1)(a) of the GDPR would be contravened by the disclosure of information,
Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph
(dis-applying the legitimate interests gateway in relation to public authorities) were
omitted”.

5
Reference: FS50898156

Legitimate interests

32. In considering any legitimate interest(s) in the disclosure of the

requested information under FOIA, the Commissioner recognises that a
wide range of interests may be legitimate interests. They can be the
requester’s own interests or the interests of third parties, and
commercial interests as well as wider societal benefits. These interests
can include broad general principles of accountability and transparency
for their own sakes, as well as case-specific interests or purely private
concerns. However, the more trivial the interest, or the more unrelated
the private concern is to the broader public interest, the less likely it is
that any balancing test would conclude that unrestricted disclosure to
the general public is proportionate.

33. In its submission, the Commons noted that there was a legitimate
interest in:

“understanding the access that former Members may have to

parliamentarians and others visiting the parliamentary estate, also
in transparency about the use of publicly funded resources on the
estate.”

34. In this particular case, the complainant is journalist. He argues that this
type of pass affords the individuals involved privileged access to one of
the institutions at the heart of government and that there is thus a
legitimate interest in understanding how those passes are being used.
He also noted that there would be a legitimate interest in understanding
who the most frequent users of the passes are – so that those
individuals can be subject to further journalistic inquiry. This would be
particularly important where former MPs have business interests.

35. The Commissioner’s view is that understanding how the passes are
being used and identifying the misuse of the passes are two distinct, but
related, legitimate interests in disclosure of this personal data. She also
considers that there is a third legitimate interest: that of preventing (or,
at least, deterring) the misuse of passes from occurring in the first
place.

36. The Commissioner is therefore satisfied that the legitimate interest test
has been met and will therefore go on to consider the Necessity test.

Is disclosure necessary?

37. ‘Necessary’ means more than desirable but less than indispensable or
absolute necessity. Accordingly, the test is one of reasonable necessity
and involves consideration of alternative measures which may make
disclosure of the requested information unnecessary. Disclosure under

6
Reference: FS50898156

the FOIA must therefore be the least intrusive means of achieving the
legitimate aim in question.

38. When asked why the Commons did not consider disclosure to be
necessary to satisfy the legitimate interest identified, the Commons
responded to say that:

“In this case, disclosure would not be targeted at any individual but
would cover a large group of over four hundred former Members. It
would not achieve the requestor’s stated purpose and for the
reasons set out below, disclosure would not meet the legitimate
interests we have identified. As explained in this response, the level
of pass usage does not give any information about the purpose of
each visit to the estate. It is not, of course, the case that
parliamentarians can only have meetings with individuals on the
parliamentary estate. This type of pass enables former Members to
make very limited use of catering facilities and not, for example, to
take advantage of publicly funded services or to book meeting
rooms (see below on the facilities made available to an individual
with a former Member’s pass). If individuals use any catering
facilities, then they must pay for them in the same way as any
other customer…..Passes are issued to former Members subject to
restrictions which make it clear that access to facilities on the
parliamentary estate is not permitted and that the passes may be
withdrawn in the event of misuse. In the small number of cases
where this has occurred, passes have been suspended or
withdrawn. In addition, the Code of Conduct for Members sets out
rules to prevent advocacy, and former Ministers are also subject to
restrictions on employment. The legitimate interests are not,
therefore, unaddressed.”

39. Whilst the Commissioner does not consider the arguments above to be
unreasonable, she notes that the arguments appear aimed at the
Balancing test rather than the Necessity test. As a result the Commons
has failed to show how the legitimate interests could be met by other
means which would be less intrusive to the privacy of the individuals
concerned.

40. As she is also the regulator of data protection legislation, the

Commissioner has considered whether there might be other means of
satisfying the legitimate interests identified above.

41. In its submission, the Commons informed the Commissioner that, in

order to be eligible for such a pass, a former member would need to
undergo a criminal record check. Each pass is valid for up to five years,
after which the individual would need to submit a fresh application and
undergo a further police check.

7
Reference: FS50898156

42. The Commons was also keen to point out that there are strict rules in
place to govern the use of the pass. Members are prohibited from
lobbying activities for six months after leaving office and they are not
permitted to use publicly-funded resources available on the
Parliamentary estate (such as stationery or copying facilities).

43. Any allegation that a pass had been misused would, the Commons
noted, be referred to the Commons Administration Committee (HCAC)
which could, for the most serious infringements, order that passes be
withdrawn. It argued that this process was sufficient to satisfy any
legitimate interests in the information.

44. Whilst the Commissioner accepts that disclosure of the complete list
would not, on its own, enable any misuse of passes to be identified, she
considers that it is a necessary tool in doing so. Furthermore, she
considers that disclosure is necessary to satisfy the other legitimate
interests identified above.

45. The Commissioner notes that whilst sitting Members, their staff
members (who hold passes), journalists and All-Party Parliamentary
Groups (APPGs) are subject to some form of Register of Interests – in
which any financial interests which might affect, or might be thought to
affect, their work, must be declared – former members (whose passes
confer many of the same privileges) are not.3

46. Where misuse of a pass does occur, this will not necessarily be identified
by HCAC unless a complaint is made. In practice, the Commissioner
considers that misuse instances are likely to be underreported. For a
Member, or the staff of a Member, reporting an inappropriate
conversation would involve admitting they had themselves been party to
an inappropriate conversation which, for political reasons, they may well
be unwilling to do – particularly if the former member involved is a
personal friend.

47. The Commons has given no indication that it uses this data itself to
identify misuse of former member passes. The Commissioner therefore
considers that any former member who wished to abuse their pass
would have little reason to suspect that they would be detected.

48. Making the usage data publicly available would, in the Commissioner’s
view, act as a deterrent to any former member who might be tempted

3
The Commons did point out that, where former members had recently vacated their seat,
entries on the Register of Members’ Interests might still be relevant, but noted that there
were practical difficulties in creating and maintaining a register for former members.

8
Reference: FS50898156

to abuse their position of trust. In the absence of any other significant

deterrent, she therefore considers that disclosure of the information is
necessary for the purpose of satisfying a legitimate interest.

49. As the Commissioner is satisfied that disclosure in this case meets the
Necessity test, she will now go on to consider the Balancing test

Balance between legitimate interests and the data subject’s interests or

fundamental rights and freedoms

50. Even where disclosure of personal data is necessary to satisfy a

legitimate interest, the Commissioner must still balance the legitimate
interests in disclosure against the data subject’s interests or
fundamental rights and freedoms. In doing so, it is necessary to
consider the impact of disclosure. For example, if the data subject would
not reasonably expect that the information would be disclosed to the
public under the FOIA in response to the request, or if such disclosure
would cause unjustified harm, their interests or rights are likely to
override legitimate interests in disclosure.

51. In considering this balancing test, the Commissioner has taken into
account the following factors:

• the potential harm or distress that disclosure may cause;

• whether the information is already in the public domain;
• whether the information is already known to some individuals;
• whether the individual expressed concern to the disclosure; and
• the reasonable expectations of the individual.

52. In the Commissioner’s view, a key issue is whether the individuals

concerned have a reasonable expectation that their information will not
be disclosed. These expectations can be shaped by factors such as an
individual’s general expectation of privacy, whether the information
relates to an employee in their professional role or to them as
individuals, and the purpose for which they provided their personal data.

53. It is also important to consider whether disclosure would be likely to

result in unwarranted damage or distress to that individual.

54. The Commons noted that former members would be aware that the
House of Commons was subject to the FOIA and that, as passholders,
their names would be published. However, it argued that the data
subjects concerned would have no reasonable expectation that the
frequency with which they used their pass would be made public and
therefore disclosure would potentially cause distress.

55. Former members had not given their consent to such disclosure and the
Commons considered that it would be impractical to consult all 467

9
Reference: FS50898156

passholders prior to responding to the request. When applying for a

pass, the application form states that the information collected will be
kept confidential. Therefore any disclosure would take place without
meaningful consent.

56. Use of the pass would, the Commons argued, relate to the personal life
of the individual passholder. Therefore disclosure would be unfair
because:

“It is a matter for each individual to decide how often they visit the
estate and why. It is possible that their partners or spouses may
not know the exact details of how they spend their days and this is
each individual’s prerogative as part of their personal life.”

57. As noted above, the Commons also drew attention to what it considered
to be the lack of evidence supporting a correlation between frequency of
pass usage and mis-usage of passes. An individual could, as the
Commons argued, have multiple inappropriate conversations on a single
visit or behave entirely appropriately throughout multiple visits.
Disclosure of all the data, to the world at large, which would not
necessarily achieve the stated purpose, would, the Commons argued, be
a disproportionate method of achieving the legitimate interest.

58. The Commissioner accepts all these arguments as reasonable ones to

present. However, she is not convinced that, in the circumstances, they
outweigh the legitimate interests in disclosure.

59. The Parliamentary Estate is where the nation’s lawmakers have their
offices. Because government ministers are drawn from Parliament,
senior members of both the executive and the legislature are often to be
found moving freely around the Estate in a manner which does not occur
anywhere else.

60. The Estate is also one of the most heavily-protected non-military sites in
the United Kingdom. It is patrolled by armed guards, access to the
general public is severely restricted and, where visitors are admitted,
they must be accompanied at all times.

61. By contrast, passholders are permitted to visit many areas of the Estate
unaccompanied – including communal areas, such as Portcullis House,
where Members can often be found socialising or seeking refreshment.

62. The Commissioner therefore considers that there is a compelling interest

in understanding which individuals have passes allowing them privileged
access to this sensitive location – a privilege not available to the general
public – and how that privilege is being utilised.

10
Reference: FS50898156

63. The Commons has noted that former Members are not entitled to use
publicly-funded resources or entertain non-family members as guests. It
has also pointed out that most of the areas that former Members can
access are areas the general public can access – albeit that the general
public are not permitted to have unaccompanied access to these areas.
Nevertheless, the Commissioner still considers that former Members’
passes give them privileged access to the corridors (and cafeterias) of
power – and that those afforded this privilege should have a reasonable
expectation that the privilege will come with increased scrutiny.

64. The fact that former Members are not subject to the same degree of
transparency, in respect of their financial interests, as other
passholders, in the Commissioner’s view, strengthens the legitimate
interests in understanding how often they are making use of their
privilege and weakens any expectations of privacy.

65. Given that the evidence suggests that several of the passholders are
employed by lobbying or public relations companies, there is a
legitimate concern about how such passes are used.4 Whilst the
Commissioner is not aware of any evidence to suggest widespread
misuse of the passes, she does consider that the current system is
vulnerable to abuse.

66. The Commissioner accepts that transparency alone will not be enough to
identify when passes are being misused, nor to prevent any future
misuse. Nevertheless she considers that it is an important tool, as
having access to data will enable journalists and others to ask legitimate
questions of those who might seek or have sought (or might be
perceived to be seeking or have sought) undue influence over those who
shape our laws.

67. The data which the Commons has released indicates that four
individuals accessed the estate on over 70 occasions during the course
of a year. Allowing for the Parliamentary calendar, that is approximately
equivalent to a visit every other day that the House sat during that
period. There is no suggestion that any of those individuals has acted
inappropriately – indeed the data does not indicate how many of the
visits were on sitting (as opposed to non-sitting – when MPs would be
unlikely to be present) days – but that does not, in the Commissioner’s
view, mean that it would be illegitimate to ask why an individual
required such frequent access to a restricted area.

4
See, for example: https://www.independent.co.uk/news/uk/politics/lobbying-calls-for-
transparency-over-former-mps-access-to-parliament-6277136.html

11
Reference: FS50898156

68. The Commissioner notes that some of the individuals who hold these
passes, whilst no longer sitting Members, remain very much in the
public eye. The current list of passholders includes Greater Manchester
Mayor Andy Burnham, Evening Standard Editor George Osborne and
Facebook Vice-President Nick Clegg.

69. Whilst the Commissioner notes that disclosure of the data will likely
cause some of the individuals involved a certain degree of inconvenience
– in that they may be asked to justify the frequency of their visits – she
also notes that these individuals would, by definition, be familiar with
(and are likely to have had training to deal with) press enquiries by
virtue of the office they once held. Equally, the names of these
individuals are already in the public domain and it is clear that they have
already been subjected to scrutiny. Therefore the Commissioner
considers that, not only would the additional scrutiny be relatively
modest, but that, because additional scrutiny would be likely to focus on
those whose usage is frequent, or who have outside interests, it is likely
to result in some of the former Members receiving fewer enquiries.

70. Admittedly, the individuals would reasonably have expected that, having
left office, they would be subject to less rigorous scrutiny. However, the
Commissioner considers that, as ex-MPs, the data subjects would be
much better prepared to deal with that scrutiny than ordinary members
of the public.

71. Finally, the Commissioner considers that disclosure of the usage data
would reveal relatively little about the personal life of the former
members involved – other than that they visited the Parliamentary
Estate. She therefore considers the privacy intrusion to be relatively low.

72. Based on the above factors, the Commissioner has determined that
there is sufficient legitimate interest to outweigh the data subjects’
fundamental rights and freedoms. The Commissioner therefore
considers that there is an Article 6 basis for processing and so the
disclosure of the information would be lawful.

Fairness and transparency

73. Even though it has been demonstrated that disclosure of the requested
information under the FOIA would be lawful, it is still necessary to show
that disclosure would be fair and transparent under the principle (a).

74. In relation to fairness, the Commissioner considers that if the disclosure

passes the legitimate interest test for lawful processing, it is highly likely
that disclosure will be fair for the same reasons. Having carried out a
balancing test, she considers that the rights of the data subjects

12
Reference: FS50898156

involved have been appropriately considered and weighted against other

considerations.

75. The requirement for transparency is met because as a public authority,

the Commons is subject to the FOIA.

76. Having considered the arguments fully, the Commissioner has decided
that the Commons has failed to demonstrate that the exemption at
section 40(2) is engaged.

13
Reference: FS50898156

Right of appeal

77. Either party has the right to appeal against this decision notice to the
First-tier Tribunal (Information Rights). Information about the appeals
process may be obtained from:

First-tier Tribunal (Information Rights)

GRC & GRP Tribunals,
PO Box 9300,
LEICESTER,
LE1 8DJ

Tel: 0300 1234504

Fax: 0870 739 5836
Email: [email protected]
Website: www.justice.gov.uk/tribunals/general-regulatory-
chamber

78. If you wish to appeal against a decision notice, you can obtain
information on how to appeal along with the relevant forms from the
Information Tribunal website.

79. Any Notice of Appeal should be served on the Tribunal within 28

(calendar) days of the date on which this decision notice is sent.

Signed ………………………………………………

Phillip Angell
Group Manager
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

14