FOI and information held on computer systems

In Farfan v Information Commissioner [2026] UKUT 16 (AAC) the Upper Tribunal dismissed an appeal which argued that, for the purposes of the Freedom of Information Act 2000 (“FOIA”), public authorities ‘hold’ all information stored on their computer systems. In doing so, the UT issued valuable guidance on when data is ‘held on behalf of’ a third-party for the purposes of s.3(2) of the Freedom of Information Act 2000.

Background

The Appellant requested from the University of Central Lancashire (“the University”) all communications sent to/ from an individual called Professor Baldwin about Queen’s University Belfast.

The University stated it did not hold any information within the scope of the request. Following an internal review in which the University upheld its position, the Appellant complained to the ICO.

While Professor Baldwin was the University’s Vice-Chancellor at the material time, he also served as the Deputy Chair and Director of the University and Colleges Employers Association (“UCEA”), an external body to which the University subscribed. It was agreed that any relevant communications were sent or received by Professor Baldwin strictly in his capacity at the UCEA, rather than his role at the University.

The ICO’s decision

The Information Commissioner’s Office (“ICO”) rejected the Appellant’s complaint. It held that any communications falling within the request would be private exchanges received/sent by Professor Baldwin in his roles at the UCEA. Any such messages were therefore held on behalf of the UCEA.

Because the University neither required nor could use this information, the ICO concluded the University did not “hold” it under Section 3(2) FOIA.

The FTT’s decision

The First Tier Tribunal (“FTT”) upheld the ICO’s decision. It found there was “an insufficient connection between the University and that information” (emphasis added), such that it was not ‘held’ by the University. The Appellant appealed.

Legal framework

Section 1 of FOIA materially provides:

“(1) Any person making a request for information to a public authority is entitled—

(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b) if that is the case, to have that information communicated to him […]

(4) The information—

(a) in respect of which the applicant is to be informed under subsection (1)(a), or

(b) which is to be communicated under subsection (1)(b),

is the information in question held at the time when the request is received”…

Section 3(2) FOIA defines when information is ‘held’:

For the purposes of this act, information is held by a public authority if:

(a) it is held by the authority, otherwise than on behalf of another person, or

(b) it is held by another person on behalf of the authority.

The UT’s decision

First Ground of Appeal

The first ground of appeal related to a sentence in the FTT’s decision in which it stated “information must be held by the public authority solely on behalf of someone else in order to fall within section 3(2) FOIA”. The Appellant argued that phrasing reversed the statutory test.

The Upper Tier Tribunal (“UT”) agreed. As set out above, the effect of section 3(2) FOIA is that “information held by a public authority falls within section 3(2) of FOIA unless it is held solely on behalf of someone else” (emphasis added). However, when read as a whole it was clear the FTT had considered the correct test. This ground of appeal therefore failed.

Second Ground of Appeal

The Appellant’s second ground of appeal was that any information on an authority’s computer system is ‘held’ because the authority has access to the information and a degree of control over it. He further argued that when considering whether the information is held ‘on behalf of’ another person the FTT ought to have asked itself whether there was ‘appropriate connection’ (i.e. a ‘rational connection’) between the University and the information requested, rather than asking whether there was a ‘sufficient connection’. The former test, the Appellant argued, means an authority will hold information (at least partially) on its behalf of there is something about the information on its computer systems which touches upon the authority’s aims.

The ICO and the University argued, by contrast, that the mere fact a public authority holds information on its computer system, which it may have an interest in securing or controlling, does not mean that it is holding the information on its own behalf.

The meaning of ‘Holds on behalf of’

The UT ruled that when analysing s.3(2) FOIA it is important to keep the two parts of the statutory question in mind – i.e. “whether, at the time of the request: (i) the University is “holding” the information; and, if so, (ii) it is doing so “otherwise than on behalf of another person””.

In respect of the first part of that test, the UT ruled that the word ‘holds’ is an ordinary word which will usually encompass all information in the physical or digital possession of a public authority.

In respect of the second part of the statutory test, the UT emphasised that an authority ‘holds’ information if it does so even partially on its own behalf. In respect of the phrase ‘on behalf of’, the Tribunal ruled:

… “there need not be any element of request or instruction: it is also possible to do something ‘on behalf of’ a third party without their knowledge or approval, in particular (perhaps), where the third party has lost or accidentally left the information with the public authority”… (at [58])

The correct question when analysing this issue is to apply the ‘appropriate connection’ test, rather than the ‘sufficient connection’ test. It cannot be right that an authority holds all information on its computer systems at least partially ‘on its own behalf’, because otherwise section 3(2) FOIA would be rendered nugatory.

Given that the FTT applied the correct test this ground of appeal was dismissed.

Third Ground of Appeal

The UT rejected the Appellant’s argument that the FTT had perversely misunderstood the relationship between Professor Baldwin, UCEA and the University.

It was open to the FTT to conclude that the information was held by Professor Baldwin purely in his roles on the UCEA. This ground of appeal therefore failed as well.

Comment

Authorities will be relieved to have judicial confirmation that all information stored on its computer systems is not necessarily subject to FOIA.

When faced with this issue authorities, and those advising them, should carefully consider the two-part statutory test:

1. Is the authority holding the information?
2. If so, does it hold the information solely on behalf of another person? When considering this question one should ask whether there is an ‘appropriate connection’ between the authority and the information, bearing in mind the purpose of the FOIA regime.

The full decision is available here.

Conor Monighan is a barrister at 5 Essex Chambers.