Copies of receipts for claims by former MP, Imran Ahmad Khan

I can confirm that we hold information relevant to your request. In considering your request for copies of all invoices or receipts from December 2019 to date, we estimate that this would exceed the appropriate limit as defined under section 12(1) of the FOIA.

We have therefore concentrated on your revised list of claims, redacted copies of which accompany this letter.

There are no invoices or receipts for two claims:

• 4001777-1 is for a subscription to the Policy Research Unit. As this is a payment made directly by IPSA to a registered pooled service, there is no accompanying invoice or receipt.

• 60082211-1 the receipt appears to have been removed from the system. IPSA is in the process of requesting another copy as part of the MP’s winding-up process. I can confirm that this is a card payment made for the amount of £71.74 to Bannerbox on 28 June 2021.

The redacted information is subject to a Refusal Notice under sections 31, 38 and 40 of the FOIA and in accordance with section c of IPSA’s Publication Policy

Section 31(1)(a) – law enforcement

This exemption applies where the disclosure of information would or would be likely to prejudice the prevention of crime. IPSA relies on this exemption to withhold the banking details of suppliers and other transactional references. IPSA believes that the disclosure of these details could leave those concerned more vulnerable to financial crime, in particular fraud and electronic crime, especially with the increase in cyber attacks.

This exemption is subject to a public interest test. IPSA does not consider that the withholding of this information has a negative impact on the understanding of these claims.

We, therefore, find that the public interest in withholding this information outweighs the public interest in disclosure at this time.

Section 38(1)(b) - health and safety

This exemption applies where disclosure of the information would, or would be likely to endanger the safety of any individual. IPSA relies on this exemption to withhold any information which could identify accommodation used by the former MP, including the contact details or names of staff. IPSA maintains that the disclosure of this information carries a risk of endangering the safety of anyone associated with the property.

IPSA understands how disclosure would enable the public to understand more about the services and suppliers in receipt of public money. In considering disclosure we also have to consider our duty of care which extends to members of the public and any consequences which may arise from our response.

There has been an increase in reports of the threats made to MPs, their staff and individuals associated with MPs. Not all reports relate to physical attacks, but the fear which can be felt from receiving a threat or harassment can be mentally and physically damaging.

IPSA, therefore, maintains that the public interest in withholding this information outweighs the public interest in disclosure at this time.

Sections 40(2) and 40(3A)(a) – personal data

This exemption applies to information which IPSA considers to be personal data within the meaning of Article 4(1) of the UK General Data Protection Regulation 2016 (UK GDPR) which states,

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly.

IPSA considered that the following are personal data within this definition: banking and financial information of suppliers; personal information of the former MP and their former staff, and suppliers and their staff, individuals living at the accommodation rented by the former MP. We then considered whether disclosure of this personal data would breach any of the Principles relating to the processing of personal data in the UK GDPR.

The relevant principle falls at Article 5(1)(a),

Personal data shall be:

a. Processed lawfully, fairly and in a transparent manner in relation to the data subject

As IPSA was unable to find a lawful basis on which it could rely, within Article 6 of the UK GDPR, it therefore finds that the information is exempt under section 40.