Farfan: Upper Tribunal clarifies when information obtained through external appointments is “held” under FOIA

The Upper Tribunal’s recent decision in Farfan v Information Commissioner and the University of Central Lancashire provides important clarification for universities and other public authorities on when information is considered “held” for the purposes of the Freedom of Information Act 2000 (“FOIA”). In particular, the case offers reassurance for institutions whose staff commonly participate in sector bodies, boards or external associations, and confirms that such involvement does not automatically draw information into FOIA’s scope.

Background to the appeal

• Dr Farfan submitted a FOIA request to the University in 2023 seeking “All the sent and received communications (whether internal, external, and regardless of the platform) of Professor Graham Baldwin that are related, however tangentially, to Queen’s University Belfast”.  
• The University responded on the basis that it did not hold information within the request. 
• That position was upheld when Dr Farfan then made a complaint to the ICO and subsequent appeal to the First-tier Tribunal; which respectively confirmed that, to the extent the University held information of that nature, they would be private communications received by Professor Baldwin (the University’s Vice-Chancelor) in his role at that time as a Director and Deputy Chair of the Board of UCEA.  
• Dr Farfan appealed to the Upper Tribunal, which has jurisdiction to consider whether any material errors of law arise from decisions of the First-tier Tribunal.

The central legal question: when is information “held” under the FOIA?

The central issue for the Upper Tribunal to determine in that context is whether information requested by Dr Farfan was “held” by the University. Like so many aspects of the law, the word “held” sounds a straightforward concept, but there are various nuances to consider when applying statutory obligations under the FOIA. The duty to provide disclosure under FOIA applies only to information that is held by a public authority (section 1(1) FOIA), but is not held by the public authority on behalf of another person (section 3(2)(a) FOIA).

The Upper Tribunal in the Farfan decision drew a clear distinction between two separate questions:

1. Factual possession – ie does the public authority physically or electronically hold the information?
2. Capacity/purpose – even if it has possession, is the information held for the public authority’s own purposes, or solely on behalf of a third party?

The appeal centred on the second point; all parties accepted that the Vice Chancellor had physical possession of information through his UCEA role.

The Tribunal’s reasoning

The Tribunal clarified that the key question is the nature of the connection between the public authority receiving the request and the information. The test is not whether the public authority has “interest” in the information, nor whether the connection is “sufficient” or “rational”.  If the public authority is acting as agent for another organisation, the information will normally fall outside FOIA.

Applying that test, the Tribunal found the Vice Chancellor received UCEA papers in the capacity of agent or representative of UCEA as board member, not as Vice-Chancellor of the University. Accordingly, the information was held solely on behalf of UCEA, and FOIA did not apply – meaning the appeal was dismissed.

Practical implications for universities

This is a helpful judgment for the HE sector, where senior leaders and broader staff often hold external roles. Key implications include:

• External roles do not automatically bring information within the scope of potential FOIA disclosure. The principles set down by the Upper Tribunal mean that information received in a personal or representative capacity for another body is not “held” by the institution merely because it appears on university systems; storage location is not decisive. It is important to analyse capacity, not just possession, when responding to FOIA requests involving external appointments.
• However, each request will involve a fact-specific process of considering whether information is held by the public authority receiving a request. Clarity of role boundaries is often complex, but far easier to determine in advance than when an issue arises. Staff should understand when they act personally or on behalf of external bodies as opposed to acting for and on behalf of their own institution.
• Be alert that there may be broader legal obligations arising from an institution hosting information on its systems than “just” the potential for FOIA disclosure alone. For example, if the information consists (in whole or part) of personal data, was it lawful to obtain and process that personal data – and are you (whether your institution, or the staff in a separate/individual capacity) acting as a data controller or processor.

Please do contact us if you would like assistance integrating these important information-handling considerations within your institution.

Our content explained