Peter Stead v Information Commissioner & Anor

Neutral citation number: [2026] UKFTT 00725 (GRC) Case Reference: FT/EA/2025/0367 First-tier Tribunal General Regulatory Chamber Information Rights Decided without a hearing Decision given on: 18 May 2026 Before JUDGE HAZEL OLIVER MEMBER MARION SAUNDERS MEMBER DAVE SIVERS Between PETER STEAD Appellant and (1) INFORMATION COMMISSIONER (2) THE BRITISH BROADCASTING CORPORATION Respondents Decision: The appeal is Dismissed REASONS Background to Appeal

1. This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 3 October 2025 (IC-372799-Q2F0, the “Decision Notice”). The appeal relates to the application of the Freedom of Information Act 2000 (“FOIA”). It concerns information about correspondence between some departments of the British Broadcasting Corporation (BBC) and the Creative Industries Independent Standards Authority (CIISA) requested from the BBC.

2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).

3. On 1 June 2024, the Appellant wrote to the BBC and requested the following information (the “Request”): “Please send to me all of the emails and associated attachments between the BBC’s Finance and HR Departments and the Creative Industries Independent Standards Authority (CIISA) including when it was known as the Independent Standards Authority (ISA)”.

4. The Request was amended on 4 September 2024, to “Let’s limit the time period to 2023 as before”.

5. The stated purpose of CIISA is to, “…uphold and improve standards of behaviour across the creative industries and to prevent and tackle all forms of bullying and harassment, including bullying and harassment of a discriminatory nature.” CIISA is an independent body that was set up following a number of serious public allegations relating to the creative industries in 2021. The BBC was one of the first broadcasters to announce support for the establishment of a new Independent Standards Authority in 2022, which became CIISA. This includes the BBC providing funding support to CIISA.

6. The BBC responded on 9 January 2025 and provided some information. They redacted information based on section 40(2) (personal information) and section 43(2) (prejudice to commercial interests). They also redacted some information that was out of scope. Following an internal review, the information that had been withheld under section 43(2) was disclosed. The redactions of personal information were retained. These redactions were done by removing all individual names and contact details from emails. The domain name of email addresses was not redacted, so that it was clear which organisation had sent and received each email.

7. The Appellant complained to the Commissioner on 23 March 2025. In relation to the redaction of personal data, the Commissioner decided that the Appellant had a legitimate interest in the names of senior individuals. However, disclosure was not necessary as transparency had been achieved through the release of the content of the emails. The Commissioner went on to find that there is insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. This decision factored in a specific argument from the BBC that could not be disclosed openly for reasons of personal data. The Appeal and Responses

8. The Appellant appealed on 7 October 2025. His appeal is against the use of section 40(2) to redact the names of senior, public-facing individuals. His grounds of appeal are: a. The rationale for non-disclosure from the BBC that has not been disclosed openly needs to be interrogated by the Tribunal. b. It is unclear from the decision which limb of the test fails, and he is concerned by the statement that “transparency has been achieved”. c. The Commissioner accepted his arguments regarding the reasonable expectation of privacy for senior and public facing individuals, and offers no cogent arguments to offset this argument.

9. The Commissioner’s response maintains that the Decision Notice was correct. The Commissioner accepts that there would be a legitimate interest in disclosure of the body of communications and domain names of email addresses, but no legitimate interest in disclosure of specific names of individuals. The Commissioner also maintains that any such legitimate interest in disclosure of individual names would be outweighed by the interests or fundamental rights and freedoms of those data subjects.

10. The BBC was joined as a party to the proceedings. The BBC provided an open response and two additional paragraphs of closed response. The BBC’s open response maintains that personal information of staff (names, phone numbers, email addresses) is not relevant, let alone necessary, for the purposes of meeting any legitimate interest in the Request. The BBC also says there is a specific matter that means the Appellant’s argument fails the necessity test, with details of this matter provided in the closed paragraphs.

11. The Appellant submitted a reply to both responses, and his points have been taken into account in the discussion below. Applicable law

12. The relevant provisions of FOIA are as follows. 1General right of access to information held by public authorities. (1) Any person making a request for information to a public authority is entitled— (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him. …… 40 Personal information. (1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. (2) Any information to which a request for information relates is also exempt information if – (a) it constitutes personal data which do not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles… ……. 58Determination of appeals (1) If on an appeal under section 57 the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

13. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”.  The “processing” of such information includes “disclosure by transmission, dissemination or otherwise makingavailable” (s.3(4)(d) DPA), and so includes disclosure under FOIA.

14. The data protection principles are those set out in Article 5(1) of the UK General Data Protection Regulation (“UK GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the datasubject”. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) UK GDPR. These include where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)). The UK GDPR goes on to state that this condition shall not apply to processing carried out by public authorities in the performance of their tasks, but section 40(8) FOIA omits this provision, meaning that Article 6(1)(f) can be used as a lawful basis for the disclosure of personal data under FOIA.

15. The balancing of interests test under Article 6(1)(f) involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55): (i) Are the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and UK GDPR. This should now reflect the words used in the UK GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

16. “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity. The test is one of “reasonable necessity”, reflecting European jurisprudence on proportionality. (See UT Judge Wikeley in Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC)). Issues and evidence

17. The main issue is whether the BBC was entitled to rely on section 40(2) FOIA to withhold individual names and contact details from the requested information. The issues for the Tribunal to consider are: a. Are the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? b. Is the processing involved necessary for the purposes of those interests? c. Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?

18. By way of evidence and submissions we had the following, all of which we have taken into account in making our decision: a. An agreed bundle of open documents. b. A closed bundle of documents containing (i) the withheld information, and (ii) closed paragraphs from the BBC’s representations to the Commissioner and the BBC’s response to the appeal. Discussion and Conclusions

19. In accordance with section 58 of FOIA, our role is to consider whether the Commissioner’s Decision Notice was in accordance with the law. As set out in section 58(2), we may review any finding of fact on which the Decision Notice was based. This means that we can review all of the evidence provided to us and make our own decision. We deal in turn with the issues.

20. Are the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? The Appellant maintains that he requires disclosure of the names of senior, public facing individuals. His reply makes the point that conflict of interest sits at the heart of the entire arrangement, as CIISA is funded by some of the organisations it will adjudicate, of which the BBC is one.

21. The Commissioner now says that there is no legitimate interest in the disclosure of specific names. This is a change of position from the Decision Notice, where the Commissioner says in paragraph 22 that the Appellant does have a legitimate interest in this information that would be met through disclosure. The BBC’s response appears to accept there is a legitimate interest.

22. The Appellant has explained his legitimate interest as follows: “It is important to understand who within CIISA is communicating with whom within the organisations who financially back them and how these are influencing CIISA. I am talking about how they navigate conflicts of interest, given that CIISA will adjudicate cases involving these very backers, not just on an organisational level, but on an individual key decision maker level. It is necessary that senior people are held individually accountable for their actions and for this to be possible, there must be transparency. A great many other people, most likely also senior in their organisations, and public facing (eg in page 10 of the supplementary bundle), are on the ground floor of CIISA’s formation and so it is difficult to see how CIISA could be completely impartial with them in case they ever have to investigate them for wrongdoing. This is a legitimate interest and is indeed also in the public interest.”

23. We accept that there is a legitimate interest in the information requested by the Appellant, and this includes the identity of senior people involved in the correspondence between CIISA and the BBC. This is because the BBC was involved in supporting and providing funding to CIISA. There is an argument for full transparency about correspondence between the two organisations because of the potential for conflicts of interest.

24. Is the processing involved necessary for the purposes of those interests? The Appellant maintains that disclosure of individual names is necessary. The Commissioner’s Decision Notice is somewhat unclear on this point, as it seems to conflate the necessity and balancing tests. The responses from the Commissioner and BBC both maintain that disclosure of individual names is not necessary. The BBC says that transparency is achieved through release of the content of the emails, not through names and contact details of staff. The domain name of emails is visible, enabling the Appellant to understand which entity was the author/recipient of which passages of correspondence.

25. We find that the disclosure of senior names is necessary for the purposes of the identified interests, applying the test of whether this is reasonably necessary. We understand the BBC’s point that transparency is achieved through release of the content of emails and domain names. Although we found this a finely balanced question, we find that the names of senior individuals would add something further in circumstances where there may be a concern about conflicts of interest. We have taken into account the relationship between the BBC and CIISA, the fact that senior individuals at both organisations may have worked together in setting up CIISA, and the fact that CIISA may be asked to investigate specific senior individuals. This applies to names only, and the disclosure of personal contact details is not necessary.

26. Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? The Appellant made the point to the Commissioner that senior and public facing individuals at the BBC and CIISA would not have a reasonable expectation of privacy with regard to their names. He provided a link to names listed on CIISA’s website, and links to other websites showing names of people who had left but were with CIISA at the time of the correspondence.

27. The Commissioner’s Decision Notice accepted that the Appellant’s arguments about seniority and reasonable expectations of privacy were valid, but the BBC “has provided argument concerning this specific matter that cannot be detailed here for reasons of personal data but that the Commissioner has factored into his decision.” The BBC’s response to the appeal says that this matter “took this case out of the ordinary run of cases”. The Appellant’s response says that the BBC essentially accepts that the names of senior, public facing people would be disclosed almost as a matter of course, but they fail to explain why this case is any different.

28. We have seen the closed paragraphs from the BBC that explain this matter. We have provided further details in a Closed Annex to this decision, which explains how this information has affected our reasoning. We cannot provide further details in the open decision, but we can confirm that we have scrutinised this additional information. It is directly relevant to the protection of personal data, and does take this matter outside the “ordinary run” of cases.

29. We find that the interest in disclosure of the names of senior individuals is overridden in this case by fundamental rights related to protection of personal data. Although we have found that disclosure of the names is necessary, the disclosure of the content of emails and domain names goes a long way towards satisfying the legitimate interests pursued by the Appellant. The names would add something to transparency, but substantial transparency has already been provided by the existing disclosure. On the other side of the balance are the general interests of the data subjects in privacy, and the specific matter related to protection of personal data that is discussed in the Closed Annex. We accept that senior individuals at both organisations would not necessarily have an expectation of privacy with regard to their names, particularly where those names are published on a website (although we note that is different from linking names to particular correspondence). However, the additional matter provided a strong reason for personal data to be protected. This is sufficient to outweigh the interest in disclosure.

30. This means that there would not be a lawful basis for disclosing the names or related contact details of senior individuals. Doing so would contravene the data protection principles, and the BBC was entitled to withhold this information under section 40(2) FOIA. We dismiss the appeal for the reasons explained above and in the Closed Annex. Signed:Judge OliverDate:13 May 2026