Трибунал по информационным правам: доступ к странице Регистра 1939 года ограничен защитой персональных данных

Preliminary matters

1.In this decision, we use the following terms to denote the meanings shown:

Appellant:

Richard Holt.

Authority:

NHS England (the Second Respondent).

Balancing Test:

The last limb of the Legitimate Interests Test, as referred to in paragraph 50.

Commissioner :

The Information Commissioner (the First Respondent).

Decision Notice:

The Decision Notice of the Commissioner dated 11 July 2025, reference IC-374934-W0F4, relating to the Request.

DPA:

The Data Protection Act 2018.

Duty to Disclose:

The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 36).

FOIA:

The Freedom of Information Act 2000.

GRO:

The General Register Office.

Legitimate Interests Basis:

The basis for lawful processing of personal data specified in Article 6(1)(f), as set out in paragraph 47.

Legitimate Interests Test:

The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 49.

Page:

The right-hand page from the specific Transcript Book, forming part of the Register, which was the subject of the Request (as referred to in paragraph 8).

Public Interest Test:

The test, pursuant to section 2(2)(b) (set out in paragraph 39), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information.

Register:

The 1939 Register held by the Authority, as described in paragraph 6.

Relevant Information:

As defined in paragraph 19.

Request:

The request for information made to the Authority by the Appellant dated 20 December 2023, as referred to in paragraph 7.

Requested Information:

The information which was requested by way of the Request.

UK GDPR:

The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.

2.Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:

a.

to numbered paragraphs are references to paragraphs of this decision so numbered;

b.

to an Article are references to the applicable Article of the UK GDPR;

c.

to a section are references to the applicable section of FOIA; and d.

to the Commissioner’s “investigation” mean the Commissioner’s investigation, for the purposes of section 50, of the Appellant’s complaint relating to the Authority’s response to the Request.

3.We considered whether it was necessary for us to provide a closed decision. We concluded that it would not be necessary, on the basis that the reasoning behind this decision can be sufficiently understood without us needing to refer to the specific details of, or disclose any sensitive aspects of, the material in the closed bundle.

Introduction

4.This is an appeal against the Decision Notice, which (in summary) held that the Authority was entitled to withhold most of the Requested Information which the Authority had withheld pursuant to section 21 (information accessible to applicant by other means).

Background to the appeal

5.The background to the appeal is as follows.

6.It may be helpful to first explain that the Request related to a copy of a specific page from a Transcript Book which forms part of the 1939 Register records held by the Authority. The following explanations about the Register were set out in the Authority’s skeleton argument in the appeal:

“ The 1939 Register… is essentially a manual record of census-like information, which was created to record the movements of the population of England and Wales until 1952. It was adopted by the NHS in 1948, on the NHS’s creation, as a means of recording patient information, such as patient movement, changes to patient details such as names, and patient involvement in certain medical research. The Register was updated using codes and continued to be updated until the digitisation of NHS records in 1991.

The Register was transferred to the Health and Social Care Information Centre (“ HSCIC ”) in 2008, which then became NHS Digital in 2016, and which then merged through legislation with NHS England in 2023. NHS England is therefore the current holder of the Register for the purposes of FOIA but does not actively use the Register for any purposes.

…

Each entry in the Register is extended across two pages and there is one entry/ row for each individual. The left hand page and the first column on the right hand page generally contain the census-like information recorded before the NHS took over use of the Register. This includes information such as names, birth dates and addresses. It also sometimes includes annotations, many added by the NHS, such as where an individual changed their name (usually due to marriage). The remainder of the right hand page (the ‘postings’ column) was used by the NHS and contains information sought by the Appellant… ”.

The Request

7.On 20 December 2023, the Appellant contacted the Authority (further to an earlier request) and requested information in the following terms (original emphasis retained):

“ … Please provide me with the information at point d) of my request. To be clear, I am asking for one specific page of a Transcript Book. I have provided the schedule and sub-schedule numbers to help you locate the exact page, as the page number is not available in the records available on websites such as via FindMyPast. The page numbers for the double page spreads are found in the top right had [sic] corner of the right hand page. I know this having viewed a sample Transcript Book held at The National Archives. Page numbers were not copied from the physical records held by NHS Digital (now NHS England) when digitised by FindMyPast, so I cannot provide a page number.

… to help ensure that I have made things even clearer, please provide a copy of the page in question which captures information on the following individuals; with the four entries with the National Registration numbers DWRB 100/4, DWRB 104/3, DWRB 110/3 and DWRB 110/4 redacted:

Note: The information below follows the format National Registration Number, Name and Surname, Date of Birth

Residence: Bledlow Ridge, Buckinghamshire

DWRB 99/2, Evert H. BARGER, 28 August 1910

DWRB 100/1, Charles ROGERS, 3 August 1899

DWRB 100/2, Una G. ROGERS, 22 August 1905

DWRB 100/3 Charles S. R. ROGERS, 9 October 1936

DWRB 100/4 - Please redact any information for this entry.

DWRB 101/1, Cecilia T. F. THORNTON, 14 December 1861

DWRB 101/2, Cecilia M. THORNTON, 17 November 1891

DWRB 102/1, Albert G, BIRKS, 6 November 1876

DWRB 102/2, Elsie BIRKS, 18 April 1914

DWRB 102/3, George MOODY-STUART, 27 October 1851

DWRB 102/4, Stuart [Ron] Marion S. MOODY, 1 December 1892

DWRB 102/5, George H. MOODY-STUART, 9 March 1931

DWRB 103/1, Ellen BATTING, 14 March 1868

DWRB 103/2, Eliza HARRIS, 14 July 1866

DWRB 103/3, Eric N. BATTING, 19 March 1914

DWRB 103/4, Alfred R. BATTING, 7 September 1898

DWRB 104/1, Stanley A. ANDREWS, 15 September 1907

DWRB 104/2, Jessie ANDREWS, 28 July 1902

DWRB 104/3 - Please redact any information for this entry.

DWRB 104/4, Peggy D. BATTING [ASHBY], 2 April 1923

DWRB 105/1, Charles LAMBURN, 7 November 1892

DWRB 105/2, Edith LAMBURN, 18 March 1889

DWRB 106/1, Evelyn C. E. ROBERTS, 5 January 1903

DWRB 107/1, Ernest C. CHLTON, 2 June 1878

DWRB 107/2, Mary A. CHILTON, 10 August 1888

DWRB 108/1, Frederick D. O. ROBERTS, 1 November 1870

DWRB 108/2, Mary A. ROBERTS, 28 August 1864

DWRB 108/3, Evelyn M. McDOUGALL, 17 December 1872

DWRB 108/4, Caroline SEDGWICK, 1 November 1837

DWRB 108/5, Agnes MORGAN, 12 August 1887

DWRB 110/1, Francis R. KEEN, 20 November 1896

DWRB 110/2, Elizabeth M. KEEN, 27 September 1898

DWRB 110/3 - Please redact any information for this entry.

DWRB 110/4 - Please redact any information for this entry.

DWRB 111/1, Ernest W. JAMES, 31 December 1886

DWRB 111/2, Kathleen N. JAMES, 1 December 1885

DWRB 111/3, William H. JAMES, 3 June 1915

DWRB 112/1, George P. G. BARNES, 19 April 1898

DWRB 112/2, Ivy M. BARNES, 10 July 1902

DWRB 112/3, Basil A. APPS, 7 May 1908

DWRB 112/4, Kathleen APPS, 15 June 1913

DWRB 112/5, Elvira A. PEREZ, 29 July 1859

DWRB 113/1, Frederick G. BENNION, 10 April 1905

DWRB 113/2, Jessie BENNION, 10 April 1908 ”

8.In summary, therefore, the Request sought a copy of one page of the Transcript Book contained in the Register. That page captures information relating to 44 individuals but the Request only sought information about 40 of those individuals.

9.The Request was the subject of a previous decision notice issued by the Commissioner dated 12 November 2024 (reference IC-308783-G5R3). The Authority originally responded to the Request on 2 February 2024. It provided a black and white microfiche version of the Requested Information, with some redactions pursuant to section 40(2). The Authority later relied on section 14 (vexatious or repeated requests), on the basis that the Appellant was seeking a copy of the information in its original (colour) form.

10.In that previous decision notice, the Commissioner concluded that the Authority was not entitled to rely on section 14 and required the Authority to issue a fresh response which did not rely on that exemption.

11.Following that previous decision notice, the Authority issued its revised response to the Request (on 12 December 2024). The Authority provided some of the Requested Information in its original (colour) form but withheld the remainder, citing section 40 (personal information) and section 41 (information provided in confidence).

12.The Appellant complained to the Commissioner following receipt of that revised response and the Commissioner agreed with the Authority that the internal review process would be bypassed to enable him to investigate the Authority’s latest position.

13.During the Commissioner’s investigation, the Authority issued a further, revised response to the Appellant (on 26 March 2025). It disclosed an image copy of the Page, but redacted death registration data (date of death, district code, and sub-district code) under section 21, personal data under section 40(2) and medical records data relating to deceased individuals under section 41.

14.The Commissioner subsequently issued the Decision Notice.

The Decision Notice

15.The Decision Notice recorded that the Appellant only wished to challenge the Authority’s application of section 21 to the Request. The Commissioner accordingly concluded that the scope of his investigation was to determine whether the Authority was entitled to rely on section 21 in respect of the death registration data which had been withheld by the Authority.

16.In summary, the Commissioner concluded in the Decision Notice that:

a.

the Appellant could marry up information publicly available from the GRO with information in the Page marked with the letter ‘D’ (which is part of the overall code), the district code of registration, and the date of death;

b.

the Authority was accordingly entitled to rely on section 21 in respect of such information in the Page;

c.

however, the Appellant could not marry up the sub-district codes with any other information and therefore the sub-district codes were not reasonable accessible by other means; and d.

accordingly, the Authority could not rely on section 21 in respect of the sub-district codes.

17.The Decision Notice therefore required the Authority to disclose the sub-district codes for the death information which had been withheld by the Authority.

Subsequent disclosure of further information

18.Pursuant to the Decision Notice, the Authority contacted the Appellant (on 1 August 2025) and made disclosure of the sub-district codes within the scope of the Request.

19.In its response dated 1 August 2025, the Authority stated the following with regard to the remaining information which it withheld in reliance on section 21 (the “Relevant Information”):

“ Part of the death registration information is available via the General Register Office (GRO) (there is charge for this information). Online indexes are available which can help the applicant to identify the correct reference details to be able to apply for a death certificate. For example: https://www.freebmd.org.uk

You are able to request copies of the individuals’ death certificates from GRO. These will contain the same date of death and registration district details recorded in our records.

If you are not able to identify the reference details, you are able to provide the information you do have to the GRO for them to perform a search for the relevant death certificate. Certificates can be ordered from GRO at: https://www.gov.uk/order-copy-birth-death-marriage-certificate ”.

The appeal

The grounds of appeal

20.The Appellant advanced thorough grounds of appeal, which included detailed comments on why he considered that the Relevant Information was not reasonably accessible by other means.

21.In summary, the material aspects of the Appellant’s arguments were that:

a.

the Relevant Information included handwritten information which would convey additional information which was not otherwise reasonably accessible;

b.

the Requested Information needs to be read as a whole and in context to provide a full picture;

c.

the ‘death cyphers’ (see paragraph 72) contain information which is not available from GRO records;

d.

even the typed equivalent of the Relevant Information was not reasonably accessible elsewhere;

e.

accordingly, in coming to his conclusion in the Decision Notice, the Commissioner adopted an unduly narrow interpretation of ‘recorded information’ and in doing so failed to apply the correct interpretation that term.

Referring to the view taken by the Upper Tribunal in Independent Parliamentary Authority (IPSA) v Information Commissioner and Leapman UKUT 0033 (ACC) .

22.The Appellant also argued that section 40(2) was not engaged in respect of some of the Requested Information which had been redacted in reliance on that section. This was on the basis that the Lord Chancellor’s Advisory Council on National Records and Archives considered, in February 2004, that a lifetime of 100 years should be assumed. The Appellant accordingly argued that the Authority was wrong to apply section 40(2) to individuals who are presumed dead based on an assumed life expectancy of 100 years.

Further disclosure of information

23.In responding to the appeal, the Authority determined that some further information could be disclosed, on the basis that the Authority could not be certain that entries merely consisting of a ‘D’ or a ‘D’ and a date between 1939 and 1952 was information otherwise reasonably accessible to the Appellant. The Authority stated that this was because the origin of the information was unclear (as the deaths may have occurred outside of England and Wales). The Authority accordingly disclosed further aspects of the Requested Information to the Appellant with its response to the appeal dated 24 September 2025.

The Tribunal’s powers and role

24.The powers of the Tribunal in determining the appeal are set out in section 58, as follows:

“(1)

If on an appeal under section 57 the Tribunal considers— (a)

that the notice against which the appeal is brought is not in accordance with the law, or (b)

to the extent that the notice involved an exercise of discretion by the Commissioner , that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner ; and in any other case the Tribunal shall dismiss the appeal.

(2)On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based. ”.

25.In summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).

Mode of hearing

26.The proceedings were held by the cloud video platform over two separate dates; the first session was held on 20 January 2026 and the second session was held on 15 April 2026. The Tribunal Panel, the Appellant, Mr Fitzsimons (on behalf of the Authority) and the witness (see paragraph 31) joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

27.The Commissioner did not attend the hearing and was not represented (having previously indicated that he would be content to rely on his written submissions if there was an oral hearing).

28.There were some minor interruptions during the first session of the hearing, including instances where the Judge’s connection momentarily froze or his connection was lost and he needed to rejoin the hearing. The parties and the other members of the Panel had been aware of the connection problems and proceedings were continued from the point when the connection had been lost or frozen and the Tribunal was satisfied that nothing had been missed. There were no other interruptions of note during the hearing.

The evidence and submissions

29.The Tribunal read and took account of an open bundle of evidence and pleadings, as well as a closed bundle and a written skeleton argument from the Authority.

30.After the first session of the hearing (and prior to the second session of the hearing), the Panel also received a full copy of the Authority’s response to the Request dated 2 February 2024. This included the microfiche which had been attached to that response which had not been included in the open bundle.

31.The open bundle contained a witness statement provided on behalf of the Authority. The witness’s statement was given in their capacity as Operations Manager in the Personal Demographics Service National Back Office. The witness also gave evidence in person during the hearing. It is not necessary for us to identify this witness by name in this decision - therefore we merely refer to them below as “the witness” and we mean no disrespect to them in doing so.

32.The closed bundle contained a complete (unredacted) copy of the Requested Information.

33.We heard from the Appellant directly, as well as oral evidence from the witness. We heard oral submissions from Mr Fitzsimons on behalf of the Authority.

34.All of the contents of the bundles and the skeleton argument were read and considered, and all of the submissions from the parties and the witness’s evidence were taken into account, even if not directly referred to in this decision.

35.During the hearing, the Tribunal held a closed session. A gist of the closed session (approved by the Tribunal) was provided to the Appellant on the resumption of the open session.

The statutory framework

We acknowledge the Practice Direction dated 4 June 2024 ( https://www.judiciary.uk/guidance-and-resources/practice-direction-from-the-senior-president-of-tribunals-reasons-for-decisions/ ) and particularly paragraph 9, which refers to the First-tier Tribunal not needing to specifically refer to relevant authorities. We include references to the applicable legislative framework, to provide relevant context, but (apart from some references to authorities to reflect the parties’ arguments or which we otherwise consider may be helpful) have accordingly not referred to the applicable case law.

General principles

36.Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides:

“ Any person making a request for information to a public authority is entitled— (a)

to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b)

if that is the case, to have that information communicated to him. ”.

37.In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides:

“ Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14. ”.

38.Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.

39.Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides:

“ In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that— (a)

the information is exempt information by virtue of a provision conferring absolute exemption, or (b)

in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. ”.

40.The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). For the purposes of the appeal, section 21 and section 41 are included in that list, and section 40(2) is included in that list so far as relating to cases where the first condition referred to in that section is satisfied.

41.Accordingly, summarising the above:

a.

the exemption to the Duty to Disclose in section 21 is an absolute exemption (therefore if this exemption is engaged then the Public Interest Test does not need to be applied);

b.

the exemption to the Duty to Disclose in section 40(2) is an absolute exemption in cases where that first condition is satisfied (and, if so, then the Public Interest Test does not need to be applied), otherwise the exemption is subject to the Public Interest Test; and c.

the exemption to the Duty to Disclose in section 41 is an absolute exemption (therefore if this exemption is engaged then the Public Interest Test does not need to be applied – but see paragraph 64).

Section 21 - Information accessible to applicant by other means.

42.Section 21 provides:

“(1)

Information which is reasonably accessible to the applicant otherwise than under section 1 is exempt information.

(2)For the purposes of subsection (1)— (a)

information may be reasonably accessible to the applicant even though it is accessible only on payment, and (b)

information is to be taken to be reasonably accessible to the applicant if it is information which the public authority or any other person is obliged by or under any enactment to communicate (otherwise than by making the information available for inspection) to members of the public on request, whether free of charge or on payment.

(3)For the purposes of subsection (1), information which is held by a public authority and does not fall within subsection (2)(b) is not to be regarded as reasonably accessible to the applicant merely because the information is available from the public authority itself on request, unless the information is made available in accordance with the authority’s publication scheme and any payment required is specified in, or determined in accordance with, the scheme. ”.

Section 40 – personal information

43.So far as is relevant for the purposes of the appeal, section 40 provides:

“ …(2) Any information to which a request for information relates is also exempt information if— (a)

it constitutes personal data which does not fall within subsection (1), and (b)

the first, second or third condition below is satisfied.

(3A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act — (a)

would contravene any of the data protection principles…” .

44.Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:

a.

Section 3(2) of the DPA defines “personal data” as “ any information relating to an identified or identifiable living individual ”. The “processing” of such information includes “ disclosure by transmission, dissemination or otherwise making available ” ( section 3(4) (d) of the DPA) and so includes disclosure under FOIA.

b.

The “data protection principles” are those set out in Article 5(1) and section 34(1) of the DPA.

c.

The first data protection principle, in Article 5(1)(a), is that personal data shall be: “ processed lawfully, fairly and in a transparent manner in relation to the data subject ”.

d.

A “data subject” is defined in section 3 of the DPA and means “ the identified or identifiable living individual to whom personal data relates ”.

Lawful basis of processing

45.To be lawful, processing of personal data must meet one of the bases for lawful processing, which are set out in Article 6(1).

Lawful basis – legitimate interests

46.One lawful basis for processing of personal data is the Legitimate Interests Basis. This is potentially the only relevant basis for processing for current purposes (but see also paragraph 55).

47.Article 6(1)(f) provides: “ processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child ”.

48.Article 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.

The Legitimate Interests Test

49.The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Council v Scottish Information Commissioner

[2013] UKSC 55, paragraph 18

:

“(i)

Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii)

Is the processing involved necessary for the purposes of those interests?

(iii)

Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? ”.

50.The wording of question (iii) is taken from the Data Protection Act 1998 , which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be: ‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.

51.It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.

52.The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb (the Balancing Test) can be considered.

53.For the purposes of the second limb of the Legitimate Interests Test, case law has established that the term “necessary” means something which is more than desirable but less than an indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive”, or the “least intrusive”, means of achieving the legitimate interest in question).

54.Regarding the Balancing Test, when considering the potential disclosure of personal data under FOIA, case law has established that the guiding principle is the protection of privacy with respect to the processing of personal data. However, all of the circumstances of the case need to be taken into account in determining whether or not the legitimate interests being pursued (in the second limb of the Legitimate Interests Test) are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Lawful basis – consent

55.The only other lawful basis for processing of personal data which might arguably be relevant on the facts of this case is consent. Consent is defined in Article 4(11) as:

“ any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. ”.

56.In summary, for consent to be a valid lawful basis for the processing of personal data, the relevant data subject must have freely and clearly given consent for the use of their personal data for a specific purpose.

Article 9 – special categories of personal data

57.Article 9 addresses some particular categories of personal data (set out in Article 9(1) and known as ‘special categories of personal data’) which are prohibited from being processed unless certain conditions (set out in Article 9(2)) are met. Pursuant to Article 9(1), the special categories of personal data are defined as:

“ …personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation… ”.

58.So far as is relevant for current purposes, therefore, the special categories of personal data include “data concerning health”. Article 4 (15) defines “data concerning health” as:

“ personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. ”.

59.Recital 35 of the UK GDPR also specifies that personal data concerning health:

“ should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. ”.

60.Recital 35 of the UK GDPR also goes on to provide that this includes:

“ any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source… ”.

Section 41(1) – Information provided in confidence

61.Section 41(1) provides:

“ Information is exempt information if— (a)

it was obtained by the public authority from any other person (including another public authority), and (b)

the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person. ”.

62.In summary, the exception under section 41 applies where the relevant information was provided to a public authority by another person and there would be an actionable breach of confidence if that information was disclosed.

63.The starting point for assessing whether there is an actionable breach of confidence is the following three-fold test :

Established in the case of Coco v AN Clark (Engineers) Ltd [1969] RPC 41 a.

Does the information have the necessary quality of confidence?

b.

Was it imparted in circumstances importing an obligation of confidence?

c.

Is there an unauthorised use to the detriment of the party communicating it?

64.Although the exemption to the Duty to Disclose under section 41 is an absolute exemption, it is a defence to an action for breach of confidence to show that it was in the public interest for the information in question to be disclosed. This is different from the Public Interest Test, however, and there is a presumption that confidentiality should be maintained and that purely private interests in maintaining confidentiality can properly be taken into account.

Discussion and findings

Preliminary points

65.We start by noting that the positions of both the Authority and the Commissioner were largely aligned, with the Authority agreeing with and adopting the Commissioner’s reasoning in the Decision Notice and his submissions in the appeal.

66.Consequently, partly for convenience and partly because of the Authority’s representation in person at the hearing, the remainder of this decision generally refers only to the position or views of the Authority, but this should be taken as including reference to the Commissioner’s position or views to the extent applicable - and no disrespect to the Commissioner is intended by this approach.

The scope of the appeal/the Tribunal’s remit

67.The scope of the Tribunal’s jurisdiction is as set out in paragraph 24 (and summarised in paragraph 25) and, in essence, relates to the lawfulness of the Decision Notice. This involves an assessment as to whether the Commissioner was correct to conclude that the Authority was entitled to rely on section 21 in order to withhold the Relevant Information.

68.However, as we have noted, in its various correspondence relating to the Request (including during the course of the Commissioner’s investigation), the Authority sought to rely on the exemptions under section 40(2) and section 41(1) in withholding aspects of the Requested Information, in addition to its reliance on section 21 in withholding the Relevant Information. The Authority maintained its reliance on those other exemptions before the Tribunal during the course of the appeal.

69.Case law has established that a public authority is entitled to rely on exemptions (including exemptions not previously cited by it) at any point before an appeal is determined by the First-tier Tribunal.

70.It was therefore permissible for the Authority to continue to rely on those further exemptions in respect of the appeal. It has therefore been necessary for us to consider the application of those exemptions as part of our determination of the appeal, notwithstanding that the Commissioner did not address them in the Decision Notice.

The relevant issues in the appeal

71.In light of our comments above:

a.

the primary issue which we needed to determine in the appeal was whether the Decision Notice was correct to conclude that the Authority was entitled to rely on section 21 in order to withhold the Relevant Information;

b.

we also needed to determine whether the Authority could rely on the exemptions in section 40(2) and section 41(1) to withhold the applicable aspects of the Requested Information.

Whether section 21 was engaged in respect of the Relevant Information

72.It may be helpful for us to start by setting out the following extract from the Authority’s response to the appeal (which was referring to its revised response to the Request on 26 March 2025):

“ NHS England applied s. 21 FOIA to death registration information, which may be as little as indicating the individual is deceased or may contain what is referred to by the Appellant as a ‘death cypher’, consisting of the fact the individual was deceased (denoted by the letter ‘D’), the individual’s date of death and district and sub-district codes, indicating where the civil death registration was undertaken (in most cases, this will be proximate to the place of death, however, there is scope for deaths to be registered out of area). ”.

73.The Appellant and the Authority each produced detailed arguments, citing various specific examples of Register entries, in support of their respective positions regarding the potential application of section 21 to the Relevant Information. Examples were also addressed in the witness statement and the Appellant provided submissions in respect of those. Some of the examples were considered during the course of the hearing. We have not considered it necessary to cite any of the specific examples in this decision, on the basis that our reasoning can be understood without that detail.

74.In summary, the Authority’s position was that (in accordance with the Decision Notice), the death registration information in the Page, as referred to above, was all available elsewhere (apart from the sub-district codes, which had since been disclosed to the Appellant).

75.We accept that some of the constituent elements of the Relevant Information can be derived from materials available through the GRO (even if only accessible on payment of a fee, which is permissible under section 21(2)(a)).

76.However, we find that not all of the Relevant Information is otherwise reasonably accessible to the Appellant, for the following reasons.

77.We accept the Appellant’s arguments that:

a.

in respect of the Relevant Information, although it was possible to locate the GRO death index for some of the entries on the Page using the information from the Register, the information in both sources did not always match; and b.

accordingly, it would not be possible to marry up the information without also having access to the ‘death cyphers’ on the Page.

78.This point was also accepted by the Authority in its submissions, where it stated:

“ Throughout this appeal, the Appellant has pointed to slight discrepancies between the information held by the GRO and the information in the Register. There are circa 7,000 volumes of the Register and each one was being manually updated by a team of people. There are of course going to be errors; this is human nature. In applying s21, the Authority cannot be expected to check every single entry in the Register to confirm it is the exact same information held by the GRO. That would create an undue burden and strip s21 of its practical utility. ”.

79.The Authority also submitted that it was “ neither practicable nor desirable ” for it to cross-check every entry with the GRO before applying section 21.

80.The witness also conceded during the hearing that there may be errors in the information recorded by the GRO. They stated that they had no first-hand knowledge of records being updated and that there were now very few people who had been involved in updating the records, so the witness could only get anecdotal information.

81.The witness’s written statement had also stated that the Relevant Information “should” be the same as that held by the GRO, but they did not provide any emphatic statement or evidence that it was the same. On the contrary, they stated, in essence, that an exercise had been undertaken using a sample of the Relevant Information to check for consistency with records held by the GRO and that an “assumption” was made that other information (beyond the samples used) would also be consistent. The witness stated that such an exercise had been undertaken because, essentially, it was “ too burdensome ” to check all the records to ensure that they reflected what was held by the GRO.

82.It is worth reiterating that if the exemption in section 21 is to be engaged, the information which has been requested must be reasonably accessible to the applicant. In our view, the Authority cannot rely on section 21 if it does not know that the Requested Information held by it is the same information which is available elsewhere (via the GRO). In this case, the Authority accepted in its submissions that there will be “errors”, by way of inconsistencies between the Relevant Information and the information available via the GRO. As we have noted, the witness also conceded that, essentially, there may be discrepancies between the Relevant Information and the information recorded by the GRO. Accordingly, the Authority cannot be certain that all of the Relevant Information is otherwise available to the Appellant.

83.We are also aware that the Commissioner’s published guidance https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-21-information-accessible-to-the-applicant-by-other-means/ (which was also referred to by the Appellant during the hearing) states that if a public authority is to rely on the exemption in section 21, it should be able to show that the information in the public domain matches what the applicant asked for. This is consistent with principles reflected in relevant case law. In this case, the Authority has not been able to demonstrate that Relevant Information matches the information which it asserts is available to the Appellant by other means.

84.The Appellant also provided evidence to show that the GRO, which was responsible for linking death registrations to entries in the NHS Central Register, was not always able to confirm a match without reference to, in some cases, multiple additional sources of information. The Appellant submitted that interpreting the ‘death cypher’ provides information which is not recorded elsewhere, as it relates to which NHS Central Register death registration matched to a Register entry. The Appellant provided detailed arguments, supported by examples, to demonstrate that the ‘death cyphers’ convey information beyond that contained in the GRO.

85.The Authority stated, in its response to the appeal, that the death registration information being withheld was supplied to the NHS Central Register by the Registrar of Births and Deaths for the relevant district, who took that information from the civil death registration, which is held by the GRO. The Authority accordingly submitted that the information in the Register should be the same information that is held by the GRO. In addition to our comments in paragraph 81, we note that the Appellant challenged the accuracy of this statement. He submitted that the information was taken from the draft death registration provided by local Registrars and that the NHS Central Register had to match the draft death registration with an entry in the registers, which was not always straightforward and often required other information to be consulted.

86.The Appellant also argued that the information provided by the informant of the death may be di ff erent to the information contained in the Register entries, meaning that matching a GRO death index reference number to information in the Register, or indeed to the same class of information in any other document, can become a di ffi cult task. The Appellant provided examples in which the existence of death registration information elsewhere would not permit an individual, even one experienced in genealogical research, to identify with confidence the registration used by the authorities.

87.The Appellant also provided detailed arguments about various practices and policies which were used over time to record an individual’s death in the Transcript Books. He stated that it was clear that the practice varied, as the Authority’s disclosures in response to the Request (following the Decision Notice) showed that some of the Relevant Information included a sub-district number whereas others do not.

88.The witness was not able to refute the relevant arguments of the Appellant. In particular, the witness’s written statement included the following:

“ There is a lot of information in the Appellant’s Reply regarding how NHS Central Register (NHSCR), which is now the NBO team, were sent death notifications and how those notifications were linked to Register entries. The Register has not been updated since the early 1990s, long before my time in the NBO team. Although I understand the information in the Register, my knowledge of the processes outlined by the Appellant are limited. The Appellant has access to a lot of documents and information, which were once held by NHSCR, but have since been sent to the National Archives (as we no longer needed them) and short of going to the National Archives and studying every relevant document, I cannot comment on whether the process outlined by the Appellant (e.g. at paragraph 12 of his Reply) is correct or not. Either way, this does not change the fact that NHSCR and the GRO were both provided with the same death registration information from the Registrar. ”.

89.Taking into account all of the above, we conclude that:

a.

the ‘death cyphers’ and associated annotations in the Relevant Information convey information beyond that contained in the GRO;

b.

seeking to identify the relevant information from other public sources would involve a degree of difficulty such that (even if the information was available) it could not be said that the information was reasonably accessible to the Appellant;

c.

there may be discrepancies in the Relevant Information and other publicly available information and, in any event, the Authority cannot be certain that the Relevant Information matches the information which it asserted is accessible to the Appellant by other means; and d.

accordingly, section 21 is not engaged in respect of the Relevant Information.

Whether section 40(2) was engaged in respect of the applicable Requested Information

90.The Authority submitted, in essence, that the Requested Information contained personal data because individuals were identifiable taking into account the information on the left hand page from the specific Transcript Book, which was publicly available census information containing the names of the individuals (and which were also contained in the Request).

91.The Authority stated that, where section 40(2) was relied on, it was on the basis that the Authority holds no information allowing it to safely conclude that the individual in question is deceased.

92.The Authority also submitted that the wording of the Request must also be taken into account when considering the question of whether personal data would be processed in responding to the Request. In this case, the Request specified the name and date of birth of the relevant individuals.

93.We agree that the relevant aspects of the Requested Information constituted (or could constitute) personal data, for the reasons submitted by the Authority. Also, in some instances, the relevant personal data concerns health information of the data subjects in question and therefore constitutes ‘special category’ personal data.

94.The dispute between the parties regarding the engagement of section 40(2) was whether the Authority was entitled to conclude that relevant individuals were deceased.

95.The Authority’s position was that if it was unable to confirm, despite taking reasonable steps, whether the individuals whose personal data is contained in the Requested Information are deceased then it worked on the assumption that the individual is alive. For these purposes, it assumed that an individual under the age of 116 would be alive in the absence of a death certificate.

96.As we have noted, the Appellant argued that the Lord Chancellor’s Advisory Council on National Records and Archives considered that a lifetime of 100 years should be assumed. The Appellant’s position, therefore, was that the Authority was wrong to use an assumed age of 116 years.

97.As submitted by the Authority, case law has confirmed that an age of 116 should be used before applying an assumption that a person is deceased in the absence of any evidence to the contrary.

See the Fir s t tier Tribunal’s decision in Ewa Sygulska v Information Commissioner EA/2017/0271 and the Upper Tribunal’s decision regarding permission to appeal that decision in Ewa Sygulska v Information Commissioner & Ministry of Defence

[2019] UKUT 269 (AAC).

For current purposes, we are bound to follow case law, rather than any advice of guidance issued by the Lord Chancellor’s Advisory Council. Accordingly we find that the Authority correctly concluded that, in the absence of any evidence to confirm that an individual was deceased (after taking reasonable steps to determine this) an individual should be assumed to be alive up to the age of 116 years.

98.Consequently, we find that the relevant aspects of the Requested Information which were withheld under section 40(2) comprise the personal data of the individuals in question.

99.We also conclude that section 40(2) is engaged in respect of the relevant Requested Information, for the following reasons.

100.As we have noted:

a.

the first data protection principle requires personal data to be processed lawfully, which means that there must be a lawful basis for such processing;

b.

apart from the Legitimate Interests Basis, the only other potentially relevant lawful basis for processing of personal data is consent.

101.There was no evidence before us that any data subject had given consent to the processing (by way of disclosure under FOIA in response to the Request) of their personal data. Accordingly, only the Legitimate Interests Basis would be applicable to such processing and we therefore turn to consider the Legitimate Interests Test.

102.It may be helpful at this stage to reiterate the Legitimate Interests Basis. As we have noted, it provides : “ processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data... ”. Translating that language to the context of the appeal:

a.

the disclosure of the relevant aspects of the Requested Information would be ‘processing’;

b.

the Appellant is the ‘third party’; and c.

the individuals whose personal data is included in the relevant aspects of the Requested Information are the ‘data subjects’.

103.There were limited submissions before us regarding the Legitimate Interests Test. However, in our opinion:

a.

in respect of the first limb of the Legitimate Interests Test, the Appellant was pursuing a legitimate interest in making the Request, relating to genealogy research;

b.

in respect of the second limb of the Legitimate Interests Test (which, as we have noted, is a test of ‘reasonable necessity’), the relevant processing (disclosure of the relevant personal data under FOIA) is necessary for the purposes of the Appellant’s legitimate interest, because we do not consider that that legitimate interest could be achieved by something less (especially given our findings about the relevant Requested Information not being reasonably accessible by other means);

c.

in respect of the Balancing Test, the potential disclosure of the relevant personal data for the purposes of the Appellant’s legitimate interest in genealogy is overridden by the interests or fundamental rights and freedoms of the data subjects. This is because we consider that maintaining rights to privacy of personal data is paramount and, in that regard, we are also mindful that disclosure of information under FOIA constitutes disclosure to the world at large. We therefore find that the Balancing Test favours protecting the interests or fundamental rights and freedoms of the relevant data subjects.

104.For the reasons we have given, we find that disclosure, pursuant to the Request, of the personal data which was withheld by the Authority would breach the first data protection principle. Accordingly, we find that the Authority was entitled to rely on section 40(2) in respect of such personal data. Given that finding, it is not necessary for us to address the question of whether any of the relevant personal data also comprised ‘special category’ personal data.

Whether section 41(1) was engaged in respect of the applicable Requested Information

105.The Authority sought to rely on section 41(1) in respect of the relevant aspects of the Requested Information on the basis that it comprised confidential medical information and related to someone who is, or could be, deceased.

106.The Appellant did not challenge the Authority’s reliance on section 41(1) but, for completeness, we briefly set out our conclusions in respect of this.

107.We find that the relevant aspects of the Requested Information comprise medical information and therefore that it had the necessary quality of confidence and that it was imparted in circumstances which gave rise to a duty of confidence. We agree with the Authority’s submission that the general principle is that medical confidentiality continues beyond the death of a patient and such information is covered by section 41(1).

108.There was no evidence before us that there would be a public interest defence to an actionable breach of confidence regarding any potential disclosure of the relevant aspects of the Requested Information.

109.We therefore find that the Authority could rely on section 41(1) to withhold the aspects of the Requested Information which it withheld in reliance on the exemption in that section.

Other matters

110.As we have noted:

a.

the Request was dated 20 December 2023; and b.

the Authority originally responded to the Request on 2 February 2024.

111.Section 10(1) provides that a public authority must respond to a request for information no later than 20 working days following the date of receipt of the request. Pursuant to section 17(1), where a public authority also refuses the request or part of the request, it must also issue a refusal notice within the same timeframe.

112.Given the Authority’s delay in responding to the Request and in issuing a refusal notice, we find that the Authority breached section 10(1) and section 17(1). We also find that the Decision Notice involved an error of law in not addressing this.

Final conclusions

113.For all of the reasons we have given, we find that the Decision Notice erred in determining that the Authority was entitled to rely on section 21 to refuse to disclose the Relevant Information.

114.We also find that the Authority is entitled to rely on section 40(2) and section 41(1) to withhold the relevant aspects of the Requested Information which it withheld in reliance on the exemptions in those sections.

115.We therefore allow the appeal in part and we make the Substituted Decision Notice set out above.

Signed: Stephen Roper Date: 25 August 2026

Judge of the First-tier Tribunal