Stefania Maurizi v The Information Commissioner & Anor

Neutral citation number: [2025] UKFTT 00001 (GRC) Case Reference: FT/EA/2024/0106 First-tier Tribunal General Regulatory Chamber Information Rights Heard: Field House, London Heard on: 24 September 2024 Deliberation: 24 September 2024 and 12 December 2024 Decision given on: 2 January 2025 Before TRIBUNAL JUDGE FOSS TRIBUNAL MEMBER SCOTT TRIBUNAL MEMBER DR MANN Between STEFANIA MAURIZI and THE INFORMATION COMMISSIONER and THE CROWN PROSECUTION SERVICE Appellant First Respondent Second Respondent Representation: For the Appellant: Estelle Dehon KC, Counsel For the First Respondent: Did not appear and was not represented For the Second Respondent: Rory Dunlop KC and Tom Tabori, Counsel Decision: the appeal is ALLOWED to the extent that the Information Commissioner's decisions that (1) the Crown Prosecution Service complied with its duties under s1(1) of the Freedom of Information Act 2000 by its response to the final, un-numbered paragraph of the Appellant’s request of 12 December 2019, and (2) that the Crown Prosecution Service did not hold further recorded information within that same part of the Appellant’s request of 12 December 2019, are not in accordance with the law. Substituted Decision Notice: The Crown Prosecution Service must, by no later than 4.00 p.m. on 21 February 2025: (1) Confirm to the Appellant whether it held recorded information as to when, how and why any hard or electronic copies of emails referred to in the Appellant’s request to the Crown Prosecution Service of 12 December 2019 were deleted; (2) If it did hold such information, either supply the information to the Appellant by 4.00 p.m. on 21 February 2025 or serve a refusal notice under section 17 of the Freedom of Information Act 2000, identifying the grounds on which the Crown Prosecution Service relies. A failure to comply with this Substituted Decision Notice could lead to contempt proceedings. REASONS Introduction to the Appeals 1. This is an appeal by the Appellant against the Decision Notice of the Information Commissioner (“the Commissioner”) referenced IC-262968-J4R3 of 29 February 2024 (“the Decision Notice”). 2. The appeal concerns a request made by the Appellant of the Crown Prosecution Service (“the CPS”) on 12 December 2019 as to when, how and why the emails of a by then retired CPS lawyer (“the CPS lawyer”), who had been handling communications between the CPS and a number of foreign prosecution authorities in relation to Mr Julian Assange, had been deleted. 3. The CPS says that the Appellant’s request is based on a false premise: that the CPS lawyer’s emails were, in fact, deleted. Background to the appeal 4. The Appellant is an investigative journalist. 5. Julian Assange, an Australian citizen, is the founder and publisher of WikiLeaks. He was the subject of extradition proceedings brought in the United Kingdom by the Swedish Prosecution Authority (“SPA”), for alleged sex crimes. The proceedings were conducted on behalf of the SPA by the CPS. In June 2012, in order to avoid extradition, Mr Assange sought asylum in the Ecuadorian Embassy in London. The 2015 Request 6. On 8 September 2015, pursuant to the Freedom of Information Act 2000 (“FOIA”), the Appellant requested from the CPS correspondence between the CPS and the SPA, the US State Department and the US Department of Justice, in relation to those parties’ investigations into Julian Assange (“the 2015 Request”). 7. The CPS refused the 2015 Request. The Commissioner investigated and decided that the CPS had complied with FOIA in responding to the 2015 Request. The Appellant appealed to the First-tier Tribunal. Her appeal was dismissed in a decision of 11 December 2017 (Maurizi v The Information Commissioner and the Crown Prosecution Service EA/2017/0041). 8. By evidence in that appeal dated 2 November 2017, the CPS confirmed that it had searched its electronic records and found that all the data associated with the account of the CPS lawyer was deleted when he retired and could not be recovered; if there had been emails beyond those already identified by the CPS between the CPS lawyer and the SPA, they had not been printed off and filed by him, the electronic copies of those emails had been deleted when he retired, and they were no longer in the possession of the CPS. 9. The Tribunal found that all significant case papers were intended and believed to have been collated separately from the lawyer’s email account; deletion of electronic data occurred before the Appellant’s request had been received, and there was nothing untoward in deletion of the email account. The 2018 Request 10. On 8 October 2018, the Appellant made a FOIA request to the CPS in relation to the deletion of the CPS lawyer’s email account (“the 2018 Request”). The CPS responded on 5 November 2018. 11. The relevant requests and responses were as follows: “Request and Response 1) the FULL correspondence, if any, held by the CPS concerning the deletion of [CPS lawyer’s] e- mail account. Correspondence from the 1st of January 2014 to the 31st December 2014. The Crown Prosecution Service (CPS) can confirm there is no correspondence between 1st of January 2014 to the 31st December 2014 concerning the deletion of [CPS lawyer’s] email account. 2) a reply to the questions below, considering that FOIA requests can be made in the form of a question: QUESTIONS: Is it network operation policy to delete, and not disable, user accounts upon users ending their term of employment? Prior to 2015, details of staff leaving the CPS would be notified to our IT providers who would disable the relevant network account. This would remove the user’s name from the Global Address Book and prevent the user from being able to log on to the CPS network. After three months the data associated with the account would normally be deleted, unless the IT providers were notified to the contrary. Since 2015 there has been a general moratorium on destruction of Government data, owing to the Independent Inquiry into Child Sexual Abuse (IICSA). Accordingly, our current process is that accounts are suspended but not deleted. Was [CPS lawyer’s] user account deleted or disabled following his retirement? [CPS lawyer’s] account would have been deleted in accordance with the 2014 working practice set out above. Can you confirm whether it was [CPS lawyer’s] network user account (e.g. Microsoft Active Directory User Account), email account (e.g. Microsoft Exchange Email Account) or both, that was deleted (or disabled) following his retirement? The CPS can confirm both network user accounts and email would have been deleted. Do you have any event logs (such as Microsoft Windows Event Logs and relevant Event IDs) that show the date and time of [CPS lawyer’s] account deletion or disabling? If so please provide them. The CPS does not hold any event logs showing these details. What is the retention period for event logs on the network? The CPS retention period for event logs held on the CPS network is for 6 months. In line with Identity Access Management (IAM) best practice, is there any change control documented (perhaps by a network administrator) pertaining to the rationale for deleting or disabling [CPS lawyer’s] account? If so please provide that. There is no existing documentation in relation to the above. Is there a network operation policy of archiving user account data and emails prior to user deletion or disabling? The agreed practice in 2014 was for accounts to be suspended upon the departure of a member of staff and then permanently deleted three months after that date. As detailed above, this practice has changed for the time being owing to IICSA. Is the network configured to retain user mailboxes following deletion, until a retention period expires, or was [CPS lawyer’s] mailbox forcibly deleted upon his retirement? [CPS lawyer’s] mailbox was deleted in accordance with the policy in operation at the relevant time. The current policy of retaining data exists to meet the CPS’ obligations under IICSA as explained above.” 12. The Appellant did not seek an internal review of the CPS’s responses or pursue any complaint to the Commissioner. The 2019 Request 13. On 12 December 2019, the Appellant made a FOIA request to the CPS, as follows: “Please provide a copy of: 1) THE FULL correspondence on Julian Assange between the Crown Prosecution Service and the Swedish Prosecution Service between the 1st of November 2010 and the 8th of September 2015 which has NOT been released to me in my previous FOIA. 2) THE FULL correspondence on Julian Assange between the Crown Prosecution Service and the Swedish Prosecution Service between September 2017 and the 1st of December 2019. 3) THE FULL correspondence on Julian Assange between the Crown Prosecution Service and the Ecuadorian authorities between the 19th of June 2012 and the 11th of April 2019. 4) THE FULL correspondence on Julian Assange between the Crown Prosecution Service and the US Department of Justice between the 1st of November 2010 and the 1st December 2019. 5) THE FULL correspondence on Julian Assange between the Crown Prosecution Service and the US State Department between the 1st of November 2010 and the 1st of December 2019. Finally, please explain when, how and why the emails of the CPS lawyer, [name redacted], were deleted. Given what the Swedish prosecutor said in deciding not to take the charges forward and given what emerged about the CPS advising the SPA [Swedish Prosecution Authority] not to question JA [Julian Assange] in the embassy, there is a clear public interest in knowing why the e-mails of the key person liaising with the SPA were deleted during an ongoing investigation, apparently against the CPS’s retention policy”. 14. It is the final, un-numbered paragraph of the Appellant’s various requests quoted above, namely the request for an explanation as to when, why and how the emails of the CPS lawyer were deleted (“the 2019 Request”), which is the subject of this appeal. 15. On 10 February 2020, the CPS responded to the 2019 Request as follows: "The lawyer concerned retired from the CPS in 2014. Deleting the lawyer's email account after retirement was in line with CPS general practice. As you know, issues concerning this matter were considered at the First Tier Tribunal in 2017 (in the case of Maurizi v IC & Crown Prosecution Service) and the tribunal referred to this in the decision issued in December 2017. For example at para 41 of that decision the judge said: "A question arose in evidence about the CPS's records management policy and about the deletion of the email account of one of the lawyers dealing with the matter, who retired. It became apparent that all significant case papers were intended and believed to be collated separately from the email account. Moreover, the deletion was made before Ms Maurizi’s information request was received. We conclude that there was nothing untoward in the deletion of the email account."" 16. On 3 March 2020, the Appellant requested an internal review in relation to the entirety of her request of 12 December 2019. In relation to deleted emails, she said: “On the deleted e-mails, I am NOT content with the CPS just quoting the Tribunal decision. I am requesting all information held by the CPS relevant to when, how and why the e-mails were deleted. None of this information was before the Tribunal. None of it was ever provided to me and to my lawyers to whom I am copying this request for an internal review by the CPS.” 17. The CPS maintained its response on internal review. The Appellant complained to the Commissioner. In her complaint, the Appellant said this: “In its original and review decisions, the CPS has made reference to its general policy of deleting employees’ email accounts after they retire, but it has not confirmed whether it holds any information as to whether that was the reason for the deletion of [named lawyer’s] account specifically, or as to when or how [named lawyer’s] account was deleted. Contrary to what is implied by the CPS, those questions were not answered in the course of the proceedings relating to the 2015 Request.” 18. The Appellant’s Counsel wrote to the Commissioner on 14 December 2021, as follows: “25. Your letter states that “the CPS have assured the Commissioner, and she accepts, that the deletion of [named lawyer’s] email account was carried out in accordance with the relevant records management policy at the time.” It appears from that that the Commissioner has not examined the Records Management Manual for herself to determine if the deletion was in accordance with the policy. The CPS provided the manual to Ms Maurizi in 2017. It is attached to this letter as Attachment 2. Ms Maurizi asks that the Commissioner make her own decision as to whether deletion of the account was in accordance with the policy. 26. Ms Maurizi does not agree that the deletion of the e-mail account was required by, or justified under, the CPS’s Records Management Manual. The Retention Schedule for Criminal Case Files and Related Documents/Material begins at page 29 of the Manual, and states that general correspondence relating to a criminal case file should be retained for “5 years from the date of most recent correspondence” (emphasis in original). Page 3 of the Manual requires that electronic records, “including emails”, must have “their integrity maintained and their retention and disposal requirements defined and adhered to.” There is no support in the Manual for e-mails being deleted shortly after retirement of an individual, particularly in an ongoing case. 27. The Request is for any information held by the CPS which explains when, how and why [named lawyer’s] e-mails were deleted. The CPS has still not informed Ms Maurizi of whether or not it holds the requested information, and, if it does hold that information, provided her with it or explained why it is exempt information. Your letter does not give any reason why the Commissioner considers this is acceptable in light of the obligations under sections 1(1) and 17(1) of FOIA. Ms Maurizi does not agree that it is acceptable. 28. Your letter refers to Ms Maurizi’s FOIA request made on 8 October 2018, to which the CPS responded on 5 November 2018, which asked specific questions about the deletion of [the named lawyers] e-mail account. That was a narrow request focusing of very specific questions, which does not explain when, how and why [the named lawyer’s] e-mails were deleted. It does not justify the CPS’s wholescale failure to comply with sections 1(1) and 17(1) of FOIA in relation to the final part of the Request.” 19. By a Decision Notice dated 8 March 2022, referenced IC-47745-L6Q0, the Commissioner concluded: “77. CPS said that a named former CPS officer, whose email account was of interest to the complainant, had retired from CPS, and his email account had been deleted in line with CPS general practice of the day. At the time of his retirement in 2014, his relevant network account had been disabled to prevent its use on the CPS network. After three months, the data associated with the officer’s email account had been deleted. 78. CPS added that deletion of the officer’s email account had been carried out in accordance with the then CPS records management policy. This had been in line with CPS general practice and was undertaken before the complainant's 2015 first FOIA request had been received. CPS said that CPS had previously disclosed such relevant information as it held in relation to the deletion of the officer’s email account. 79. The Commissioner accepted the CPS evidence and decided he therefore had no concerns in respect of the deletion of the officer’s email account.” 20. The Appellant appealed against the Decision Notice to the Tribunal. 21. On 25 May 2023, the Tribunal dismissed the Appellant’s appeal in relation to numbered parts 1) to 5) of her request of 12 December 2019 but allowed the appeal in relation to the 2019 Request (the question about deleted emails) (Maurizi v Information Commissioner and CPS [2023] UKFTT 442 (GRC)). The Tribunal said this: “175. In our conclusion, the CPS were required to, but did not, inform the appellant in the 2020 Refusal whether or not it holds the information requested in the final part of the 2019 Request. To this extent we find that the 2020 Refusal is not in accordance with section 1(1)(a) of Part I of FOIA. 176. The CPS could, for example, have said that it does not hold any such information, or stated that it holds such information but that this has already been disclosed, or stated that it holds such information but that it is exempt pursuant to a provision in Part II of FOIA. The 2020 Refusal takes none of these approaches in relation to the final part of the 2019 Request. … 178. The ICO’s 2022 Decision lacks clarity in its consideration of the final part of the 2019 Request. The respective paragraphs of the 2022 Decision do not address the CPS’s consideration of this issue but rather, on our reading, reach an independent conclusion not communicated to the appellant in the 2020 Refusal, that the CPS had “previously disclosed such relevant information as it held in relation to the deletion of the officer’s email account” i.e. that it held no information in this regard that had not already been disclosed.” 22. The Tribunal addressed oral evidence which had been given at the hearing of that appeal by a solicitor employed by the CPS as a Deputy Chief Crown Prosecutor, who had held the post of Head of Extradition since 5 September 2022. The Tribunal said this: “182. Moving on, in his oral evidence Mr Sheehan indicated that “very detailed enquiries” had been made by the CPS, and that he “understood from those who made the enquiries” that there is a document “which is described as desk instructions in relation to the deletion of material within 30 days” which was “the practice at the time”. The appellant has not been provided with a copy of these “desk instructions” and Mr Sheehan has not personally seen them. In these circumstances, we are not prepared to conclude that the “desk instructions” fall within the scope of the final part of the appellant’s 2019 Request, but neither can we find that they do not.” 23. The Tribunal recorded that the witness identified in oral evidence, “for the first time”, the existence of the desk instructions. 24. The Tribunal issued a Substituted Decision Notice requiring the CPS to state whether it held the information requested by the Appellant by the 2019 Request, and if it did hold it, either supply it to her or serve a refusal notice under s17 FOIA, to include the grounds on which the CPS relied (save for s14(1) FOIA from which the CPS was precluded on relying, the CPS having attempted at short notice but failed to rely on s14(1) (vexatious request) to refuse the request). 25. On 23 June 2023, the CPS responded to the Appellant, as ordered. It disclosed to her two documents: a. a PDF of a leavers’ process document called “Introduction of New (Automated) CPS Network Account Management Leavers Process” (“the LPD”); b. a PDF of a CPS email to employees dated 25 April 2012 email (“the Gateway Notice”), notifying them of the LPD, and attaching a copy of it. The CPS had redacted the addressee(s) to the Gateway Notice pursuant to s40(2) FOIA (personal data). 26. The LPD is undated on its face. It provides materially as follows: “... The information below contains vital information for Managers, which details the changes that have taken place and the implications of the new process and information for managers on how to safeguard data stored on an individuals personal account should it be required by the business following their departure Following the submission a PU4 Leavers form by a line manager/Area, Pay & Benefits will still continue to input the details of the leaver on i-Trent which triggers an email to the line manager along with a checklist of things the line manager needs complete. In addition to this BIS have now negotiated and implemented a separate automated process whereby the CPS ICT Service Desk will now automatically receive details of the leaver, their line manager and the scheduled leaving date of the member of staff. Upon receipt of this notification, the CPS ICT Service Desk will also contact the manager and named leaver via email, to inform them arrangements will be made to disable the individuals ICT account on the specified leaving date. Both the manager and user will be advised that if any of the information is incorrect, especially if there is a change to the leaving date that they must notify the Service Desk immediately, as 30 days after the date of disablement, the users account and email data will be automatically deleted and no longer accessible. It is vitally important that managers are aware that if any of the individuals data needs to be retained for business purposes, that they ensure it is moved to an alternative location such as network drive prior to the date when the account data will be finally deleted and irrecoverable. Further assistance is available from the Service Desk on 0800 692 6996 option 1 (or short dial 7997) who should be contacted at the earliest opportunity to be advised of the options available.” 27. Under cover of its letter of 23 June 2023 providing the Appellant with the LPD and the Gateway Notice, the CPS said this: “The Leavers Process Document was the general working practice in existence for disabling and deleting the personal email accounts of CPS staff after they had left the service. It was introduced in 2012 and was applicable when the lawyer concerned left the service of the CPS in 2014. That document explains what the process was for the deletion of a leaver’s personal email account, namely that the leaver’s ICT account would be disabled on the day of their departure and, 30 days after the date of disablement, the users account and email data would be automatically deleted and no long accessible (page 2, paragraphs 6 and 7). The process would have been carried out by the IT providers for the CPS at the time. The CPS’ Leavers Process Document announced in 2012 is distinct from the policy for deleting cases from the CPS’ case management system (CMS). The Records Management Manual (RMM) from the time concerned, a copy of which was provided to you in 2017, mentions that “Information providing evidence of the functions, policies procedures, decisions, actions and other key activities in HQ and the Areas is recorded.” The same RMM source said in relation to ‘Creating Draft Administrative Documents Electronically For Comment’ that: If you use the email application  E-mail and print the document to paper  If the document contains significant information (i.e. a CPS business activity), insert the document in the relevant file. Currently, CPS’ corporate policy is paper-based. Therefore, all electronic documents that contain a record of CPS business activity should be printed out on to paper and stored within the appropriate file. CPS business activity can contain information:  About individuals;  Involving financial matters;  That have policy, procedure or project implications;  Recording why and how decisions or actions were taken;  Needed to account for CPS activities to Parliament. To clarify the position further, a reviewing lawyer who receives an email about a case must ensure a copy of that email and their response is lodged on the case file (i.e. the corporate record) to ensure it contains a full history of all actions and decisions taken; this requirement applies equally to letters, faxes, attendances notes, review notes, and any other document, material or record. This practice ensures that, irrespective of whether that lawyer leaves the CPS during the lifetime of a case, the corporate record remains intact. Whilst we cannot confirm that every email received in this case was transferred to the case file, we have no reason to suspect it was not. The deletion of the relevant email account in 2014 therefore had no bearing on the case. The RMM states that the case file must be retained at least for the length of the sentence passed, or a minimum of five years after the last record is made. Given that the Swedish extradition request relating to Julian Assange was made in 2010 and concluded in 2017, the earliest possible date under the retention policy for the destruction of the case file would have been 2022. However, from May 2015, following the establishment of the Independent Inquiry into Child Sexual Abuse (IICSA), a moratorium, preventing the destruction of any criminal case file held by government departments was established; this ensured the preservation of any and all information which could be of use to the Inquiry. This moratorium superseded the retention policy and remains in place today.” Internal Review 28. On 28 June 2023, the Appellant sought an internal review. She requested: a. the LPD in native format; b. an unredacted version of the Gateway Notice, in native format; c. an explanation of the discrepancy between the CPS’s historic statement that employee email accounts were suspended upon departure of employees and then permanently deleted after 3 months, and the statement in the LPD that user accounts would be automatically deleted 30 days after suspension of the account. 29. On 29 August 2023, the CPS decided on internal review that in disclosing the LPD and the Gateway Notice, it had satisfied the requirement imposed on it by the Tribunal’s Substituted Decision Notice: “In other words, the CPS has confirmed that it does not hold information from the relevant email account and has provided all of the documentation to the Appellant confirming the process in operation at the relevant time.” 30. To address the Appellant’s request as to the discrepancy in CPS statements as to deletion periods, the CPS disclosed an internal CPS email dated 24 January 2023, redacted so as not to disclose (a) the name of the sender who was a member of Digital Technology Service Management, Digital and Information Directorate, CPS, (b) the recipient, and (c) a person referred to in the body of the email. The email said this: “I have taken the following actions: I have asked a range of people in my team to check if they had anything that confirms that in 2014 deletions of email accounts occurred after 3 months. My research has shown that the documented timeframe was 30 days, i.e. deletions occurred after 30 days. I can only assume [name redacted] stated 3 months to cover off an exceptional circumstances? I can confirm that since 2017 no emails accounts have been deleted; where someone has left, their account is suspended, the licence has been retrieved and we have left the data in situ due to the moratorium requirements.” 31. It would subsequently transpire that the then redacted sender of the email was Ms Debbie Hillary, Head of Service Management for the CPS since late March 2019, who gave evidence at the hearing of this appeal. 32. The CPS declined to provide the Appellant with native formats of the LPD and the Gateway Notice, on the basis that s11 FOIA provides that a requester may only specify the format of the information requested in their initial request for information, and the Appellant’s request of 28 June 2023 was not her initial request. Additionally, the CPS argued that provision of the information in such format would expose metadata underlying the relevant documents from which personal information could be gleaned. 33. On 9 October 2023, the Appellant complained to the Commissioner. The Commissioner investigated. The Decision Notice 34. On 29 February 2024, the Commissioner issued a Decision Notice deciding that the CPS had complied with its duties under s1(1) FOIA, and that “no further information was held.” 35. In relation to the Appellant’s request for documents in their native format, the Commissioner decided that the Appellant had only asked for them in that format after the CPS had disclosed them to her in PDF format, that it had been reasonable for the CPS to provide them to her in PDF format, and he would not consider that part of the Appellant’s complaint further. He noted that it was open to the Appellant to make a further request for those documents in their native format, if she wished. 36. The Commissioner characterised the Appellant’s request for an explanation as to when, why and how the emails of the CPS lawyer had been deleted, as a request as to whether the CPS held any recorded information to support its change of position regarding the destruction parameters for email accounts of CPS employees who ceased employment by the CPS in 2014. The Commissioner noted that whether the retention period was either 30 days or three months, the email account in question would have been deleted some considerable time before the Appellant’s request was made. 37. The Commissioner observed that he was required to assess on the balance of probabilities whether the CPS held information relevant to the 2019 Request. He said that he had asked the CPS for an explanation, which he recorded in the Decision Notice as follows: “The Information Access Team [IAT] was told that the CPS practice in 2014 (when the lawyer concerned retired from the service) was that email accounts would be suspended and then deleted after three months. This position was then communicated to [the complainant] in a previous FOI request response. In preparation for the Tribunal hearing in 2023 the position was checked with a manager in the Digital and Information Directorate (DID) who confirmed to the IAT that the practice in 2014 was actually to delete email accounts after 30 days. The response provided by the CPS to [complainant’s name, redacted]’s Internal Review request dated 29/8/2023 included a disclosure containing an email from the DID manager concerned. This email is dated 24/1/2023. Within that email the manager said: ‘I have asked a range of people in my team to check if they had anything that confirms that in 2014 deletions of email accounts occurred after 3 months. My research has shown that the documented timeframe was 30 days, i.e. deletions occurred after 30 days. I can only assume [name redacted] stated 3 months to cover off an exceptional circumstances?’ This is the explanation for why the CPS position changed from originally saying that email accounts were suspended/deleted after 3 months to stating later on that email accounts were deleted after 30 days. We considered at the time of the disclosure that the contents of that manager’s email provided a reasonable account of the change in position. …It may assist if I mention that the CPS witness at the First Tier Tribunal in 2023 did also refer briefly in evidence to that hearing that there is a document which describes the deletion of accounts within 30 days. This refers to the documents the CPS has since disclosed. The reference from the witness is mentioned at para 22 of the Tribunal’s open decision provided on 25/5/2023”. 38. The Commissioner went on to say that he had asked whether the party whose name had been redacted had been contacted for comment, and that the CPS had told him this: “The reference to [name redacted] in that sentence concerns a former CPS employee called [name redacted]. This colleague retired from the CPS on [date redacted] 2021. [Name redacted] had retired from the service long before the time when further enquiry was made about the email account deletion policy, which was during January 2023 in preparation for the First Tier Tribunal hearing that happened on 27 Jan 2023. It was not therefore possible to contact [name redacted] to ask why he thought the policy was 3 months rather than 30 days”. 39. The Commissioner’s reasoning for his decision was this: “28. When, as in this case, the Commissioner receives a complaint that a public authority has not disclosed some or all of the information that a complainant believes it holds, it is seldom possible to prove with absolute certainty that it holds no relevant information. However, as set out in the paragraphs, above, the Commissioner is required to make a finding on the balance of probabilities. 29. When dealing with a complaint to him under FOIA, it is not the Commissioner’s role to make a ruling on how a public authority deploys its resources, on how it chooses to hold its information, or the decisions it makes to hold some, but not other, information. Rather, in a case such as this, the Commissioner’s role is simply to decide whether or not, on the balance of probabilities, the public authority holds the requested information. 30. The Commissioner considers that the CPS contacted the relevant party to consider whether or not any further information was held in respect of the request. He is also satisfied that the source of the ‘three month’ comment was not available for further consultation. 31. While appreciating the complainant’s frustration that the CPS does not hold information to explain why it changed its position regarding the length of time email accounts were retained, the Commissioner is mindful of the comments made by the Information Tribunal in the case of Johnson / MoJ (EA2006/0085)2 which explained that FOIA: “… does not extend to what information the public authority should be collecting nor how they should be using the technical tools at their disposal, but rather it is concerned with the disclosure of the information they do hold”. 32. Based on the information provided, the Commissioner is satisfied that, on the balance of probabilities, no further recorded information within the scope of the request is held. He is therefore satisfied that the CPS has complied with the requirements of section 1 of FOIA in this case.” The Appeal 40. By Notice of Appeal dated 28 March 2024, the Appellant raised two grounds of appeal against the Decision Notice: a. the reasonableness of the CPS’s withholding the metadata underlying the LPD and the Gateway Notice. The Appellant submits that the metadata falls within scope of the 2019 Request. b. whether the CPS held information falling within scope of the 2019 Request. The Appellant submits that the Commissioner should have investigated the adequacy of the CPS’s search; the Tribunal should consider afresh whether the CPS held information falling within the terms of the 2019 Request. 41. In relation to the second ground, the Appellant said this: “23. 24. 25. ... First, the Digital and Information Directorate Manager whose email is cited at DN §26 refers to “research” that the individual undertook in 2023. Information pertaining to that research must be held and would fall within the request. Second, the CPS’s witness in EA/2022/0088, Mr Sheehan, stated to the Tribunal that “very detailed inquiries” has been made by the CPS – again, information pertaining to those very detailed inquiries must be held and would fall within the request.” Third, the CPS has on at least three occasions discovered that it held further information, despite previously after having stated that it had conducted thorough searches: in October 2017 (when two potentially relevant further physical files were found and additional emails); in December 2022 (when over 150 further pages were identified) and in response to the order of the Tribunal in EA/2022/0088. This last discovery, in particular of the Leavers Process Document, which is described as the standard operating procedure for deletion of accounts when a CPS employee retired, is notable. The Appellant had been requesting disclosure of this policy since 2017. It was only disclosed in June 2023, without explanation as to why it was never previously identified or disclosed. 26. Accordingly, the Tribunal is asked to consider afresh whether information is held by the CPS falling within the terms of the request, and, if necessary, to hear oral evidence on the question. If the Tribunal determines that the CPS should conduct further searches, the Tribunal is asked to require the CPS to disclose the information.” The Commissioner’s Response 42. By a Response dated 30 April 2024, the Commissioner maintained that the CPS was not required to disclose the metadata underlying the documents it had disclosed to the Appellant, which had not been requested: “Nowhere within the 12 December 2019 request is there a request for the relevant metadata, nor can it be said to be within the scope of the request when considered objectively. Unless specified it is not reasonable, objective or proportionate to interpret a request to include a requirement for a public authority to provide metadata, and a public authority is not obliged to provide such data under s.11 FOIA unless it is specifically requested when making the request.” 43. In relation to the second ground of appeal, namely whether the CPS held further information, the Commissioner’s position was this: he accepted, on the basis of the CPS’s account to him of the searches it had undertaken, that those searches were sufficient, and that, on the balance of probabilities, the CPS had now disclosed the information it held within the scope of the 2019 Request. The CPS’s Response 44. By a Response dated 16 May 2024 (amended on 9 August 2024), the CPS expressed its primary position as being that the 2019 Request was impossible to respond to and/or that the CPS held no information relating to it as it rested on a false or unproven premise: in summary, the premise of the 2019 Request was that the CPS lawyer’s emails had been deleted; the natural meaning of “deletion” is that the only copy or copies of those emails had been deleted but if an email has been printed out and the hard copy retained before the electronic version is wiped from a computer system, then it cannot be said that the email has been deleted. If the CPS’s averred policy of printing off emails before deletion of the electronic copy of an email was deleted, then it could not be said that the CPS lawyer’s emails had been deleted. 45. In relation to the Appellant’s first ground of appeal concerning metadata, the CPS submitted that the metadata, from which personal data could be gleaned, was first mentioned by the CPS upon internal review, as a reason for not disclosing the 25 April 2022 email in non-PDF format. S11 FOIA did not require its disclosure. 46. In relation to the Appellant’s second ground of appeal, the CPS submitted that the ground rested on the premise that information post-dating the 2019 Request fell within the scope of the 2019 Request, which was wrong, but that if the scope of the 2019 Request did extend as far as information relating to the CPS lawyer’s email account – as opposed to their emails – and even if information recorded by the CPS after 2019 was in scope, the CPS had now complied with its obligations under FOIA. The CPS submitted there would be no purpose in any Order from the Tribunal as proportionate searches had been carried out. The CPS indicated that in this regard it would rely on a witness statement from Ms Debbie Hillary of the CPS, explaining the CPS’s 2014 policy relating to the deletion of email accounts, and that she would attach to her statement copies of all recorded information which the CPS had found, in all its searches to date, relating to the 2014 policy. The Appellant’s Reply 47. By a Reply dated 31 May 2024, the Appellant submitted that the CPS’s primary position that the 2019 Request rested on a false or unproven premise, was a falsely constructed impossibility based on the CPS taking a strained and unnatural reading of the word “deleted” (and various other words, although the Appellant did not say what those were), and that it was perfectly plain what was being requested – all information held by the CPS which explained when, how and why the lawyer’s emails were deleted. 48. In relation to her request for metadata, the Appellant submitted that she had not pursued her request for the information to be provided in a specific format, rather her position was that the metadata underlying the documents in question fell within the scope of the 2019 Request: it met the definition in s84 FOIA of “information recorded in any form”; moreover, an objective reading of the 2019 Request included the metadata given that the Request sought all information which explained when, how and why deletion took place and that metadata which helped to answer those questions fell within scope of the 2019 Request; given the context of the 2019 Request, this was a prime example of where metadata was required to understand the value and cogency of the information disclosed, and to prevent that information potentially creating a false impression of what took place and when. 49. In relation to the issue of whether the CPS held further information, the Appellant submitted that given the history of the CPS discovering that it held further information, despite having asserted that it had conducted thorough searches, the Commissioner had a strong basis not to be credulous of, and to probe carefully, the CPS’s account but, instead, the Commissioner had applied an overly forensic, legalistic and narrow interpretation of the 2019 Request to exclude matters from its ambit and conclude that the searches made by the CPS were adequate. The Appellant submitted that it was for the Tribunal to determine whether the CPS has conducted an adequate search, considering the CPS’s evidence as to that search. The Appellant submitted that any information unearthed by the CPS’s enquiries after the 2019 Request but falling within the scope of the 2019 Request should have been disclosed. The Hearing 50. We read an OPEN bundle, a CLOSED bundle, a bundle of authorities, and certain emails to which we refer at paragraph 81 of this decision, which were handed to us at the hearing. 51. The OPEN bundle contained the pleadings, the parties’ correspondence with the Tribunal, the correspondence relating to the Commissioner's investigation, and the witness statement of Ms Hillary dated 9 August 2024 with exhibits. The correspondence relating to the Commissioner's investigation and the exhibits to Ms Hillary’s witness statement were redacted in parts so as not to disclose either the personal data of individuals referred to therein or information relating to third parties in contractual arrangements with the CPS, which are commercially sensitive. 52. The CLOSED bundle contained the latter two categories of documents, unredacted. Before the hearing, the CPS applied for a direction pursuant to Rule 14(6) of the Tribunal Rules that the material in the CLOSED bundle should not be disclosed to any person other than the Commissioner. Neither the Appellant nor the Commissioner objected to the application, which was granted by the Tribunal on 23 September 2024. The Appellant raised a query about the extent of redactions to one page in the OPEN bundle, which was resolved by agreement between the parties during the hearing. It is sufficient for us to provide all our reasons for our decision in a single, OPEN judgment. The Evidence 53. At the hearing, we heard oral evidence from Ms Debbie Hillary, Head of Service Management for the CPS since late March 2019. Ms Hillary is responsible for live service digital operations for the CPS, which includes ensuring that required policies are applied to the CPS’s IT systems, including the deletion of emails after CPS employees have left the CPS. Ms Hillary gave evidence remotely. 54. The provision of the early parts of Ms Hillary’s evidence was complicated by two matters: first, the CPS had arranged that Ms Hillary should give evidence in an occupied, open plan part of a CPS office. The result was that the Court could hear the background noise of discussions taking place in Ms Hillary’s vicinity; second, when the Tribunal asked Ms Hillary to, and she did, find somewhere more secluded in her office building from where she might give evidence, connection issues arose which then meant that she was either invisible or inaudible to the Tribunal, and it may be that, at points, the Tribunal was one or both of those things to her. Given this unsatisfactory situation, the Tribunal rose in order that the CPS might, and it did, make better arrangements for the provision of Ms Hillary’s oral evidence, so that she could be properly seen and heard by the Tribunal, and so that she could properly see and hear the Tribunal. The Tribunal has taken the opportunity since the conclusion of the hearing to review the Tribunal’s recording, not only of Ms Hillary’s evidence but the entire hearing. 55. The stated purpose of Ms Hillary’s evidence was to explain the enquiries she undertook in 2023 to find recorded information on the timeframe for the deletion of the email accounts of employees leaving the CPS, and, specifically, the research she conducted which informed her email of 24 January 2023 to the CPS Information Access Team (“the IAT”). 56. Ms Hillary was a straightforward witness, answering questions put to her in cross- examination with care and candour. Prior to January 2023, she was not involved in any of the CPS’s response to the Appellant’s requests for information. 57. By her witness statement, Ms Hillary explained that on 17 January 2023, she received an email from the IAT, saying this: “We need to know what written policy/guidance existed in 2014 in relation to deleting the email accounts of leavers. We know that the general working practice in 2014 was as follows and this has been quoted in official replies to the Appellant in an earlier/separate FOI response provided in 2018. Prior to 2015, details of staff leaving the CPS would be notified to our IT providers who would disable the relevant network account. This would remove the user’s name from the Global Address Book and prevent the user from being able to log on to the CPS network. After three months the data associated with the account would normally be deleted, unless the IT providers were notified to the contrary. Since 2015 there has been a general moratorium on destruction of Government data, owing to the Independent Inquiry into Child Sexual Abuse (IICSA). Accordingly, our current process is that accounts are suspended but not deleted. In addition to the 2014 policy/guidance we also need to know what the policy is today (2023) regarding the disablement/deletion of email accounts in relation to leavers. We hope you can send us two policies therefore – one from 2014 and the other as of now.” 58. Ms Hillary asked a member of her team to investigate. He provided her with a document called “Monthly Account Management (Personnel/Nevers) - Desk Instructions” (“the Desk Instructions”). She described this document as dated November 2014. Given that the CPS lawyer had retired before November 2014, she could not be certain the Desk Instructions represented the deletion policy when he left. 59. The IAT indicated to Ms Hillary that the Desk Instructions appeared to relate only to the technical process to be followed in account disablement, whereas what was required was “the actual policy applicable in 2014 on disabling/deleting accounts and when this would take effect, e.g. we were told the general practice in 2014 was to disable accounts first followed 3 months later by account being deleted...” 60. Ms Hillary investigated further, establishing from an internal source that the CPS moved its email system from a third-party supplier in-house to Microsoft Office 365 in 2017. She was given no more precise indication of the timing of that move. 61. On 24 January 2023, Ms Hillary contacted the former third-party supplier directly. She said this: “If a CPS prosecutor left the organisation in 2014, after their account was suspended, at one point would their account have been deleted. Do you have any documents At that point you were providing services to CPS under a PFI contract. in your files from 2014? I am actually looking for the Policy document, which I do not expect [name of third party supplier] to hold as CPS should have any policy document, but you may have an operational document. At this stage I am looking for information that confirms that the approach at that time in 2014 was that account were deleted after 3 months. {I am aware that after 8/5/2015 there was a moratorium on deleting records which is still in place and currently email accounts are not deleted} If you could reply by COP today I would be grateful. e.g the records and documents from 2014 are from a totally different contract and one might expect that those documents were deleted due to subsequent changes to process – if you could confirm that. However if you do have documents could you please forward.” 62. The third-party supplier sought clarification of Ms Hillary’s request: “Is your request in relation to Case Data, CPS Domain Accounts or CMS Application Accounts of any combination of these?” Ms Hillary confirmed that her request was “Solely for email accounts – related to Domain accounts.” 63. Ms Hillary’s witness statement did not exhibit any written response from the third-party supplier to her request. She said in her witness statement that the third-party supplier did not have any relevant documents, “as this was a contract prior to the current one.” 64. Ms Hillary asked several people in her team if they could recall the leaver email deletion process, but they were not able to recall or locate any policy documents. 65. Ms Hillary then searched the whole of the shared folder where her team store their historical documents and there, she located the following documents in an archive: a. the LPD, located both in a folder called “Leaver Process” and in an archive. She took two screenshots of the metadata1 of the LPD, showing: i. ii. from the “General” tab of the metadata, that the LPD was described as created on 27 July 20162, modified on 20 April 2012, and accessed on 19 May 2023. from the “Details” tab, that its content was created on 20 April 2012. the Gateway Notice. b. c. an email from the CPS to what Ms Hillary said was the CPS’s then external email system supplier, dated 9 March 2012, incorporating a proposed new “Leaver’s process” under the heading “CR 3357 Revised Leavers Process Implementation”. The material parts of that document provided as follows: “5. At the end of the users leaving date Service Desk disable the users CPS network account. 6. 7. The Service Desk and Logica Apps support disable CMS/WMS accounts as necessary (CMS account must be disabled within 30 days of leave date as there will be no dummy AD account to access CMS account after this time) 30 days after the user leaves their data and email is deleted, the users account is moved to deleted users OU and the users account is renamed z1username.” 66. On 24 January 2023, Ms Hillary evidently emailed some parts of this newly discovered material to her team. She included the CR3357 Revised Leavers Process Implementation we have described. She said this: “...it seems to me that as per this document attached that the deletion period was 30 days. (However it then states in the attached which is from 2011, that the user emailbox was moved to the OU called Deleted and given a prefix of z1, which sounds recoverable & therefore not actually deleted) I can confirm that the account involved was deleted when checked in 2017. Does is seem right to say that at this time in 2014, the deleted account email box and data was removed within 30 days, but could only be guaranteed to have been removed after 3 months due to when the actual leaving date fell and to cover instances where the line manager had missed informing us as per the process?” 67. A member of her team responded to Ms Hillary as follows: “I do recall the change detailed in CR3357 being implemented. This amended the [entity name redacted] leavers process so that it was triggered by the user’s line manager completing the leavers form on the HR iTrent system. Unfortunately, other than that I do not recall any detail about the timescales for the various account management processes in place as at 2014, and I do not have any records going back this far. However, assuming that the attached CCR was the version accepted then I think it reasonable to assume that if the leaver’s line manager had filled in the HR iTrent leavers form that [entity name redacted] should have disabled the account on the date that the person left the CPS and 30 days after this date they should have taken action to delete the user account and associated e mail data. If the line manager didn’t fill in the leavers form on iTrent then the account should have been picked up and disabled via CPS account management procedures looking at unused accounts. However, the internal process document [name redacted] located dated 2014/15 (attached) only talks about requesting [entity name redacted] to disable the accounts – they do not mention any subsequent requests to then delete a subset of the accounts (some would need to be retained as the user might not have permanently left CPS). I am therefore unable to say with any confidence whether these disabled accounts were deleted after 3 months – albeit someone obviously told [name redacted] that this was the case at the time so may well be correct.” 68. On 19 May 2023, Ms Hillary confirmed to the IAT that the LPD was created in April 2012, which was the policy in place from 2012 and “in theory” during 2014. She reasoned that the fact that the Desk Instructions which were intended to supplement or enhance the process for account management in November 2014, referred to revisions to the leavers’ process meant that the LPD was the valid process in operation from April 2012 to November 2014. 69. Ms Hillary’s conclusion was that to the best of her knowledge and research “in 2014 email accounts were earmarked for deletion 30 days after the individual left the CPS.” 70. Under cross-examination, Ms Hillary explained that her reference in her email of 24 January 2023 to the deletion period of 3 months to “cover off exceptional circumstances” was simply her supposition that in exceptional circumstances where, for example, a leaver’s line manager had not completed the requisite paperwork, 3 months was the very longest that a leaver’s email would be left on the system. She explained that the CPS’s priority in the context of a leaver is to ensure that the leaver should be unable to access anything in the organisation; their line manager has 30 days to extract anything important from their account. Additionally, deleting data means the CPS need not continue to pay any relevant licence fee in relation to that user, and saves money by freeing up electronic storage space. 71. Ms Hillary accepted that if the leaver’s process described in CR 3557 had been followed in 2014, then the Service Desk should have been sent emails about the CPS lawyer’s retirement. 72. Ms Hillary accepted that her enquiries of the third-party supplier had been focused on disablement of email accounts, not their deletion. 73. Ms Hillary said that she was not aware that CPS shared drives had been searched for information relating to the deletion of the CPS lawyer’s emails, what she described as “transactional data”. Ms Hillary did not know whether any transactional data from 2014 would have been in paper or electronic form; if the latter, it would have rested exclusively in the CPS’s datacentre. Ms Hillary explained that she had not been asked to look for such data and had relied on the IAT’s assurance to her that they had checked all the records “specific” to the CPS lawyer. Ms Hillary said that she thought she had been made aware of the Tribunal’s decision of 25 May 2023, but that she had not been asked to conduct any further searches. 74. Ms Hillary explained that the CPS’s email system “mainly” moved in-house in 2017, and that the CPS changed its IT Service Desk provider in 2018. She did not know whether after 2018, the CPS continued to have access to information held by its previous IT service provider but suspected not. She thought that the CPS’s practice would have been to retain transactional data for a short time, but that when the Service Desk provision changed in 2018, transactional data would not have transferred. Legal Framework 75. The relevant provisions of FOIA are as follows: Section 1 General right of access to information held by public authorities. (1) Any person making a request for information to a public authority is entitled- (a) To be informed in writing by the public authority whether it holds information of the description specified in the request, and If that is the case, to have that information communicated to him. (b) Section 11 Means by which communication to be made. (1) Where, on making his request for information, the applicant expresses a preference for communication by any one or more of the following means, namely— (a) (b) (c) the provision to the applicant of a copy of the information in permanent form or in another form acceptable to the applicant, the provision to the applicant of a reasonable opportunity to inspect a record containing the information, and the provision to the applicant of a digest or summary of the information in permanent form or in another form acceptable to the applicant, the public authority shall, so far as reasonably practicable, give effect to that preference. Section 58 Determination of appeals (1) If on an appeal under section 57 the Tribunal considers- (a) (b) that the notice against which the appeal is brought is not in accordance with the law, or to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based. 76. The import of s58 FOIA is that the right of appeal to the First-tier Tribunal involves a full merits consideration of whether, on the facts and the law, the public authority’s response to the Request is in accordance with Part 1 of FOIA (Information Commissioner v Malnick and ACOBA [2018] UKUT 72 (AAC); [2018] AACR 29, at paragraphs [45]-[46] and [90]. The Tribunal has jurisdiction to decide, de novo on the merits, whether the Commissioner’s decision is in accordance with the law. Analysis Premise of the 2019 Request 77. The CPS objects to what it says is the premise of the 2019 Request, namely that the CPS lawyer’s emails were deleted. The CPS says that if an email has been printed off in hard copy form, even if the electronic copy of it has been deleted, the email has not been erased. 78. The Appellant submits that there were periods in relation to which the CPS had said that it did not hold responsive information because relevant emails had not been printed off, for example when: (1) a warrant for Mr Assange’s arrest was issued, (2) Mr Assange took refuge in the Ecuadorian Embassy, and (3) when Ecuador granted him asylum. The Appellant submits that it is simply not credible that there was no correspondence between the CPS and the SPA during those periods. The Appellant looks, therefore, for electronic copies of those emails which she suspects were not printed off. 79. We do not find that the Appellant can be criticised for the premise of the 2019 Request. It was, after all, the CPS who raised the spectre of deleted emails in its evidence of 2 November 2017, when it said that if there had been relevant emails beyond those already identified by the CPS, they had not been printed off and filed and had been deleted. It is clear, therefore, that the CPS was using the word “deleted” to refer to electronic copies of emails in express contradistinction to hard copies, reflecting the common use of that verb in relation to electronic data. 80. We fully accept that the CPS’s assertion by that evidence as to what had become of such emails was conditional upon them having existed in the first place, but such conditionality does not make false or unproven the premise of the 2019 Request nor does it make it a request with which the CPS cannot properly engage. The CPS’s searches 81. The premise of the CPS’s position is that the CPS lawyer did, in fact, print off all relevant emails. The CPS submitted at the hearing that that lawyer “preferred hard copy". To that end, we were shown an exchange of emails in July 2017 between the then Information Commissioner (Elizabeth Denham) and the Government Legal Department (“the GLD”) acting for the CPS, generated, we understand, during the Commissioner's investigations in relation to the 2015 Request. 82. We note that the adequacy of the CPS’s searches responsive to the 2015 Request is not an issue before us. However, we find those emails to be instructive, not only as to the CPS Extradition Unit’s filing practices, which is relevant to the question of when, how and why the CPS lawyer's emails may have been deleted but also because of what they show about the CPS’s approach to searches as early as 2017. 83. In the email exchange, the Commissioner asked the GLD to confirm (which we read to mean “describe” or “explain”) their searches for information held electronically on the CPS system or within relevant inboxes, including those of the CPS lawyer. The GLD lawyer responding to this request said, “I confirm that I did not carry out any searches for information held electronically.” They went on to say this: “The process on the Extradition Unit is that all emails sent electronically to individual lawyers are printed off and put on a physical file or sent to the electronic case file and then deleted from that lawyer’s inbox. Nothing is deleted permanently without being retained in one way or another. [The CPS lawyer’s] account would have been closed when he retired from the CPS.” 84. The Commissioner responded by asking this: “I would be grateful if you would clarify whether all emails are sent to the electronic case file (even if they are all printed off and put on the physical file) in which case, I wondered whether it was possible to carry out a straightforward search of the electronic case file of all emails sent from the SPA.” 85. The GLD responded saying that it was instructed that the CPS lawyer “did not put any correspondence on the electronic case files”. The GLD did not identify the source of that instruction. 86. The Commissioner passed the full email exchanges between him and the GLD on this issue directly to the Appellant’s Counsel on 24 July 2017, saying that in light of what the GLD had said, the Commissioner was satisfied that a reasonable and proportionate search had been carried out. 87. Pausing here, we have several observations. 88. First, it would appear that by July 2017, the GLD had not carried out any searches for information held electronically. Whether the GLD was intending to draw a distinction between the GLD and the CPS in this respect, is unclear. We do not know whether the CPS had carried out any searches for electronic data by this point. Assuming no distinction was intended, then the CPS had not. 89. We find that remarkable given that two years earlier a) the 2015 Request had sought four categories of “FULL correspondence”, that is to say, it did not distinguish between hard copy and electronic data, and b) the GLD appeared to be saying that email and electronic case files were in use by the CPS at the material time as an alternative to hard copy files. 90. We suppose that it is not inconceivable that from the moment the 2015 Request was made, the CPS was entirely confident that no potentially responsive electronic data existed because upon receipt of the 2015 Request, it was certain that a) the CPS lawyer in question only ever operated hard copy case files, b) he had assiduously complied with what the GLD was describing in 2017 as the CPS filing policy, that is to say, printing and filing all emails on the hard copy case files and then deleting his emails, and c) his email account and associated data had definitely been deleted. There is no evidence at all before us, however, that that was the CPS’s corporate thought process in 2015 or 2016 or, if it was, how it was justified. 91. Second, the GLD’s description to the Commissioner in July 2017 of what it understood to be the Extradition Unit’s general filing practice to be, was markedly a description of case management activity in the present tense. The GLD made no reference to the practice in 2014, and the reader is left to infer that the practice described was that in place in 2014. 92. Third, there is no indication as to the source, and thus the credibility, of the GLD’s instruction that the CPS lawyer did not put any correspondence on the electronic case files. It is reasonable to infer that the source of that instruction was not the CPS lawyer, who, we understand, had retired three or so years earlier. 93. Fourth, the GLD’s assertion that where a CPS employee printed off emails for the hard copy file, and then deleted the electronic version, left open how that deletion was supposed to, and did, occur. We have not been shown any evidence of any automated deletion process in place during an employee’s employment. Manual deletion of sent and received emails in the course of a case would have required discipline and time, and it leaves, in turn, these questions: whether such manual deletions were permanent deletions, or whether they simply transferred the deleted emails to the individual’s deleted folder, wherein the individual was then required to exercise further discipline by “double deleting” the emails, failing which, the emails simply continued to reside in that folder; and even if the individual did manually delete emails from their deleted folder, where (else) on the CPS’s systems the emails may have continued to be held. 94. Unquestioning of, and despite, these issues, indeed expressly “in light” of what the GLD had told the Commissioner, the Commissioner confirmed to the Appellant on 24 July 2017 that she was satisfied that a reasonable and proportionate search had been carried out. We do not understand how the Commissioner felt able to reach that conclusion, at least based on the extent of her exchanges with the GLD on behalf of the CPS which we have been shown from July 2017, for the reasons we have given. 95. Four months later in November 2017, the CPS gave evidence that: “... I have been informed that we searched electronic records and found that all the data associated with [the CPS lawyer’s] account was deleted when he retired and cannot be recovered. ...” Thus, it appears that the CPS had conducted a search of its electronic records between July and November 2017. We have not been provided with the witness’ statement in those proceedings but do not understand from the description of his evidence given by the Tribunal in its decision that he gave any explanation as to his source of information, the scope of searches or what positive evidence of deletion was identified. No separate explanation of those things was provided to us in these proceedings. 96. We have seen no evidence as to what searches were undertaken to respond to the 2018 Request, assuming they were different searches from those undertaken to justify the CPS’s evidence in November 2017. As it was, such explanations as were given by the CPS in its response to the 2018 Request were inconsistent or at least imprecise: either that the CPS lawyer’s user account “was” or “would have been” deleted, the author proceeding on the basis that if something should have happened in line with a stated policy, it did happen. 97. We turn to the CPS’s searches in relation to the 2019 Request, which, we remind ourselves, is when, how and why the CPS lawyer’s emails were deleted. 98. We find that the Commissioner fell into error when he characterised the 2019 Request as a request as to whether the CPS held any recorded information to support its change of position regarding the destruction parameters for email accounts of CPS employees who ceased employment by the CPS in 2014. That is not what the Appellant requested. The Appellant wanted to know when, why and how the CPS lawyer’s emails were deleted. The Commissioner's effective re-drafting of the 2019 Request inevitably meant that he then became focused on the narrow issue of inconsistent accounts given by the CPS as to whether the CPS’s email deletion policy was three months or 30 days. Consequently, he did not give proper consideration to the full scope of the 2019 Request, and, within that, whether the CPS had undertaken adequate searches to answer it. 99. On the basis of all the evidence before us, we are not satisfied that the CPS had, by the time of its response to the Appellant of 23 June 2023, undertaken adequate searches responsive to the 2019 Request. 100. First, in its most recent searches in 2023, the CPS has identified that it does still hold electronic data on its systems relating to IT operations from over a decade ago: the LPD and the Gateway Notice. However, there is no evidence that the CPS had, by 23 June 2023, or even now has, searched, either in its shared drives or in hard copy repositories, for any transactional data which might show when, how or why the CPS lawyer’s emails were deleted (if they were). 101. Second, as Ms Hillary accepted, her enquiries, in line with her investigation instructions, of the CPS’s former third-party supplier were focused on disablement of email accounts, not deletion of account data. As it is, there was no evidence before us as to the precise content of the contractor’s response, which, even though apparently negative (Ms Hillary said that she “didn’t get anything back” from the contractor, “they didn’t have anything”), may have been informative and/or might reasonably be taken to have stimulated further questions as to the adequacy of the searches. 102. Third, on 24 January 2023, Ms Hillary told her colleagues “I can confirm that the account involved was deleted when checked in 2017.” We take this to mean that when the position was checked in 2017, it was discovered that the account had been deleted, rather than that when the position was checked in 2017, the account was then deleted. On our construction of that statement, this implies that in 2017 a positive assessment was made that the CPS lawyer’s email account had been deleted, rather than it just being assumed that it had been, either because of a policy which, if operated, would have had that effect, or simply because it could not at that point, within the scope of enquiries then undertaken, be found. There was no evidence before us of the basis of Ms Hillary’s understanding of such an assessment in 2017, if it were, in fact, made. It may be that Ms Hillary was drawing on the CPS’s witness evidence of 2 November 2017, but there is nothing before us to substantiate the source for the belief of the witness when he gave that evidence. 103. Fourth, in her email to colleagues of 24 January 2023, Ms Hillary noted provision in a document attached to her email from 2011, but which we have not seen, for moving deleted mailboxes to an Organisation Unit called Deleted, and given a prefix of z1, which, in her view, indicated that the mailbox might be (or have been) recoverable “& therefore not actually deleted”. There is no evidence before us of what further enquiries were, or could have been, made in relation to that. 104. Fifth, Ms Hillary accepted that she relied on the IAT’s assurance to her that they had checked all the records “specific” to the retired CPS lawyer. This evidence leaves open what records were checked, when, by whom in the IAT, and how such records were identified as “specific” to the retired CPS lawyer. There was no evidence about that before us. We are not sure, in any event, why it was that the IAT was reassuring Ms Hillary about anything, given that it seems that the IAT was reliant on Ms Hillary and her team for instructions to enable them to respond to the Appellant. 105. There are two further gaps in the CPS’s evidence of its searches. First, we now know from Ms Hillary’s evidence in this appeal about her investigations in 2023 that at some point in 2017, the CPS’s email system “mainly” moved in-house. There has been no explanation of what is meant by “mainly”, how that affected any relevant data, and how that might have affected searches in this case. We have seen no identification of when in 2017 the move took place, and we bear in mind the GLD’s confirmation to the Commissioner in July 2017 that no searches for electronic data had been undertaken as at that date. We have no evidence as to whether the move may have impacted upon the retention of such of the CPS lawyer’s emails as may still have existed as at that date, or on the searches undertaken by the CPS (a) in 2017, and thus the accuracy of the evidence it gave on 2 November 2017, or (b) subsequently. 106. Second, on 24 January 2023, Ms Hillary emailed the IAT saying that since 2017 no email accounts had been deleted because of the moratorium requirements. However, in its response to the 2018 Request, the CPS said, “Since 2015 there has been a general moratorium on destruction of Government data, owing to the Independent Inquiry into Child Sexual Abuse (IICSA)”, implying that no deletion of potentially relevant emails would have taken place since 2015. That raises the question of whether, if potentially relevant electronic copies of emails continued to exist after the CPS lawyer left the CPS, they should not have been but were deleted between 2015 and 2017 (assuming they were, in fact, deleted by 2 November 2017, that being the date on which the CPS testified to the Tribunal to the fact of any emails having already been deleted). 107. Overall, based on the evidence before us, our concern is that over a number of years the CPS has not properly addressed itself at least to recording, if not undertaking, adequate searches in relation to the CPS lawyer’s emails, with the result that, in 2023, when it has purported to answer the 2019 Request, it has not been able to give a clear and complete account. Its approach appears to have been informed by a combination of unfounded and incorrect assumptions or speculation, flawed corporate memory, and unreliable anecdotal instruction, much, but not all, of that resting inevitably in the natural succession of employees through the organisation over time. The cumulative effect of those things, taken together with what we find to be (1) imprecisely worded questions and a failure to drill down into answers, and (2) the absence of any clear and complete audit trail of enquiries and responses at each stage, has very likely prevented adequate searches and has certainly prevented a full and satisfactory account of matters. 108. The CPS submits that the adequacy of its searches does not constitute a ground of appeal. We agree with that. However, we are entitled to consider the adequacy of such searches in our wider assessment of whether, on the balance of probabilities, the CPS held further material responsive to the 2019 Request. It was only in 2023 that the CPS, apparently stimulated by the prospect of the spotlight of Tribunal proceedings, and by dint of Ms Hillary’s efforts, located the LPD. Focused searches brought relevant material to light. 109. We bear in mind the CPS’s submission that the inherent unlikelihood of the CPS holding responsive information may be so strong that the adequacy of the CPS’s searches is irrelevant; for the Tribunal to be satisfied on the balance of probabilities that the CPS somewhere holds responsive recorded information, requires a series of unlikely things to have had to have happened: that neither the CPS lawyer’s manager nor IT actioned deletion of the CPS lawyer’s emails; somehow the CPS lawyer’s emails survived the change of IT provider; and somehow the transactional data was missed by the IAT. 110. In our view, that submission is readily countered by a sensible acknowledgement that humans in large corporations are inefficient and overlook all sorts of administrative tasks. It is evident from Ms Hillary’s investigations that she and her colleagues recognise that, and that, no matter what corporate policies for deletion of electronic data may exist, they may not be followed, and data may continue to exist somewhere. 111. Ms Hillary’s colleague told her on 24 January 2023 that if a leaver’s line manager did not complete the relevant paperwork, then the account should have been picked up and disabled using procedures looking at unused accounts, that is to say, her colleague appeared to accept that that may not have happened. The same colleague noted that in any event the policy material Ms Hillary had identified did not actually address the subsequent issue of deletion, and they were unable to say “with any confidence” whether disabled accounts were, in fact, deleted after 3 months. We consider that to be a pragmatic assessment of matters grounded in experience. Moreover, it is not fanciful to consider that the CPS lawyer’s emails may have survived the change of IT provider. It appears that it was only in 2023 that focused thought was given to that. There is no evidence before us that anyone has yet searched for potentially responsive transactional data. 112. In any event, the submission requires us to ignore real and evidenced issues as to the adequacy of (1) the CPS searches for electronic data responsive to the Appellants’ requests from 2015 onwards, (2) the CPS’s explanations of the scope of those searches, and (3) the conclusions consequently drawn and presented both by the CPS and the Commissioner as to whether the CPS, on the balance of probabilities, held potentially responsive data. We reject the submission. 113. We are not satisfied on all the evidence before us that such searches as have been undertaken in relation to the 2019 Request alone, have been adequate. Matters identified in those searches have raised significant questions yet to be answered. The CPS has discovered that it still holds electronic data relating to IT operational policy in 2014. There is no evidence that it has conducted a search for relevant transactional data in the same period. Accordingly, in all the circumstances, we find it more likely than not that the CPS held further material potentially responsive to the 2019 Request. Metadata 114. In our view there was nothing in the letter or spirit of the 2019 Request as to when, how and why the emails of the CPS lawyer were deleted, which required the CPS to disclose the metadata of any document which substantiated the information it provided in response to that request. 115. None of the metadata we have seen is information directly responsive to the 2019 Request. The fact that the metadata of the LPD may show its content was created at a time which might be taken to suggest that the policy espoused by the LPD was in operation at the time of the CPS lawyer’s retirement, does not itself establish when or how his emails were deleted, even if it might enable a reasonable inference as to why, that is to say, because that was the policy which was “in theory”, as Ms Hillary put it, then in operation. 116. It would be extraordinary, in our view, if every time a public authority was presented with a request for information recorded in such a way as to have meant that the creation of that record generated metadata, the request should be taken inevitably to require the metadata behind the form of record. Not only would that give rise to potentially significant administrative burdens but, more fundamentally, the exercise might effectively entail the provision of information which has not, in fact, been requested: the metadata is, itself, different information from the information in the record, even where it is prima facie the same: for example, the date of a document on its face and the date shown by the metadata as the date of the document’s creation, are different information: the former informs the reader of the date of creation of the record the author is intending to convey, the latter establishes when the document was created. 117. We understand that the Appellant seeks to temper the prospect of that being the result of her submissions, by reference to the facts of this case: because the 2019 Request was about deletion and was made in the context of the CPS’s explanations about deletion being contradictory and lacking credibility, the metadata was required. She says that the metadata might aid an understanding of what she described as the “value and cogency” of other information disclosed and prevent that information potentially creating a false impression of what took place and when. 118. That may be right, but those things do not make the metadata itself responsive to the 2019 Request. A person is entitled to have communicated to them information specified in their request, which can comprise an explanation of when, how or why particular documents have been processed. It would be sufficient for the public authority to provide that information simply by stating the when, the how or the why. To assume as a rule, however, that the public authority must, at the same time as providing that information, disclose, as if by way of proof of the accuracy of its statement of the requested information, the metadata behind the creation of the record of that information, is unsustainable. 119. We accept, nevertheless, that it may be that an objective reading of a request entails the provision of metadata, even if the request does not expressly seek it: each request must be construed on its own terms. The 2019 Request was not, however, in our view, such a request. Conclusion 120. For the reasons we have given, we find that the Commissioner was wrong to conclude that the CPS complied with its duties under s1(1) of the Freedom of Information Act 2000 by its response to the 2019 Request, and that, on the balance of probabilities, the CPS did not hold further recorded information responsive to the 2019 Request. To that extent the appeal is allowed, and we issue a Substituted Decision Notice. 121. We find that the Commissioner did not err in deciding that the CPS’s disclosure of information to the Appellant in PDF format in response to the 2019 Request was reasonable, and to that extent the appeal is dismissed. Signed: Judge Foss Dated: 2 January 2025