{"check":null,"uid":"16f7e6945fc1718f","title":"Richard Holt v The Information Commissioner & Anor","title_generated":false,"country":"Великобритания","organ":"Суды Англии и Уэльса","kind":"case","kind_name":"Судебная практика","lang":"en","date":"2026-09-01","summary":"Заявитель требовал у NHS England копию страницы Регистра 1939 года — переписи, которую служба здравоохранения с 1948 года использовала для учёта перемещений пациентов. Ведомство отказало по ст. 21 Закона о свободе информации 2000 года, сославшись на доступность данных через сторонние сервисы.\nТрибунал счёл это основание неприменимым: без номера страницы данные не найти. Но раскрытие нарушило бы первый принцип UK GDPR (ст. 40(2)), поскольку это персональные данные живых людей, а сведения о медицинских назначениях защищены как конфиденциальная информация по ст. 41(1) даже после смерти пациента.\nАпелляция удовлетворена частично: комиссару велено вынести новое решение, но отказ раскрыть данные по ст. 40(2) и 41(1) признан законным, а сроки ответа — 20 рабочих дней по ст. 10(1) — ведомство нарушило.","snippet":"","topics":["Персональные данные"],"status":"ok","error":"","text_len":56387,"versions":1,"url":"https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/1240","first_seen":"2026-09-02","last_checked":"2026-09-17 01:34","relevance":"hit","score":72,"query":"personal data","source_key":"caselaw_uk","verdict":{"relevance":"hit","score":72,"topics":["Персональные данные"],"need_body":3,"authorities":[{"kind":"орган","name":"Information Commissioner","topic":"Персональные данные"},{"kind":"акт","name":"General Data Protection Regulation","topic":"Персональные данные"},{"kind":"акт","name":"GDPR","topic":"Персональные данные"},{"kind":"акт","name":"2016/679","topic":"Персональные данные"},{"kind":"акт","name":"UK GDPR","topic":"Персональные данные"},{"kind":"акт","name":"Data Protection Act 2018","topic":"Персональные данные"}],"evidence":[{"topic":"Персональные данные","term":"gdpr","weak":false,"pos":467,"ctx":"именимым: без номера страницы данные не найти. но раскрытие нарушило бы первый принцип uk gdpr (ст. 40(2)), поскольку это персональные данные живых людей, а сведения о медицинских назн","zone":"название","weight":3},{"topic":"Персональные данные","term":"персональн данн","weak":false,"pos":499,"ctx":"нные не найти. но раскрытие нарушило бы первый принцип uk gdpr (ст. 40(2)), поскольку это персональные данные живых людей, а сведения о медицинских назначениях защищены как конфиденциальная информаци","zone":"название","weight":3},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":486,"ctx":"ssioner dated 11 july 2025, reference ic-374934-w0f4, relating to the request.  dpa:  the data protection act 2018.  duty to disclose:  the duty of a public authority to communicate requested inf","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":817,"ctx":"general register office.  legitimate interests basis:  the basis for lawful processing of personal data specified in article 6(1)(f), as set out in paragraph 47.  legitimate interests test:  th","zone":"текст","weight":1},{"topic":"Персональные данные","term":"gdpr","weak":false,"pos":1810,"ctx":".  requested information:  the information which was requested by way of the request.  uk gdpr:  the general data protection regulation (eu) 2016/679, as it forms part of domestic law","zone":"текст","weight":1},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":1829,"ctx":"ation:  the information which was requested by way of the request.  uk gdpr:  the general data protection regulation (eu) 2016/679, as it forms part of domestic law in the united kingdom by virtu","zone":"текст","weight":1},{"topic":"Персональные данные","term":"gdpr","weak":false,"pos":2259,"ctx":"cision so numbered;  b.  to an article are references to the applicable article of the uk gdpr;  c.  to a section are references to the applicable section of foia; and  d.  to the comm","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":10235,"ctx":"registration data (date of death, district code, and sub-district code) under section 21, personal data under section 40(2) and medical records data relating to deceased individuals under secti","zone":"текст","weight":1},{"topic":"Персональные данные","term":"Information Commissioner","weak":false,"pos":19,"ctx":"Richard Holt v The Information Commissioner & Anor Заявитель требовал у NHS England копию страницы Регистра 1939 года — переписи, кот","zone":"орган","weight":3},{"topic":"Персональные данные","term":"General Data Protection Regulation","weak":false,"pos":2678,"ctx":"d Information:  The information which was requested by way of the Request.  UK GDPR:  The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of sectio","zone":"акт","weight":0},{"topic":"Персональные данные","term":"GDPR","weak":false,"pos":467,"ctx":"именимым: без номера страницы данные не найти. Но раскрытие нарушило бы первый принцип UK GDPR (ст. 40(2)), поскольку это персональные данные живых людей, а сведения о медицинских назн","zone":"акт","weight":0},{"topic":"Персональные данные","term":"2016/679","weak":false,"pos":2718,"ctx":"s requested by way of the Request.  UK GDPR:  The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the Eur","zone":"акт","weight":0},{"topic":"Персональные данные","term":"UK GDPR","weak":false,"pos":464,"ctx":"еприменимым: без номера страницы данные не найти. Но раскрытие нарушило бы первый принцип UK GDPR (ст. 40(2)), поскольку это персональные данные живых людей, а сведения о медицинских назн","zone":"акт","weight":0},{"topic":"Персональные данные","term":"Data Protection Act 2018","weak":false,"pos":1343,"ctx":"ssioner dated 11 July 2025, reference IC-374934-W0F4, relating to the Request.  DPA:  The Data Protection Act 2018.  Duty to Disclose:  The duty of a public authority to communicate requested information","zone":"акт","weight":0}],"dropped":[]},"last_changed":"2026-09-03","meta":{"neutralCitation":"[2026] UKFTT 01240 (GRC)","court":"United Kingdom First-tier Tribunal (General Regulatory Chamber)"},"source_url":"https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/1240","text":"Preliminary matters\n\n1.\n\nIn this decision, we use the following terms to denote the meanings shown:\n\nAppellant:\n\nRichard Holt.\n\nAuthority:\n\nNHS England (the Second Respondent).\n\nBalancing Test:\n\nThe last limb of the Legitimate Interests Test, as referred to in paragraph 50.\n\nCommissioner :\n\nThe Information Commissioner (the First Respondent).\n\nDecision Notice:\n\nThe Decision Notice of the Commissioner dated 11 July 2025, reference IC-374934-W0F4, relating to the Request.\n\nDPA:\n\nThe Data Protection Act 2018.\n\nDuty to Disclose:\n\nThe duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 36).\n\nFOIA:\n\nThe\nFreedom of Information Act 2000.\n\nGRO:\n\nThe General Register Office.\n\nLegitimate Interests Basis:\n\nThe basis for lawful processing of personal data specified in Article 6(1)(f), as set out in paragraph 47.\n\nLegitimate Interests Test:\n\nThe three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 49.\n\nPage:\n\nThe right-hand page from the specific Transcript Book, forming part of the Register, which was the subject of the Request (as referred to in paragraph 8).\n\nPublic Interest Test:\n\nThe test, pursuant to section 2(2)(b) (set out in paragraph 39), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information.\n\nRegister:\n\nThe 1939 Register held by the Authority, as described in paragraph 6.\n\nRelevant Information:\n\nAs defined in paragraph 19.\n\nRequest:\n\nThe request for information made to the Authority by the Appellant dated 20 December 2023, as referred to in paragraph 7.\n\nRequested Information:\n\nThe information which was requested by way of the Request.\n\nUK GDPR:\n\nThe General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.\n\n2.\n\nUnless the context otherwise requires (or as otherwise expressly stated), references in this decision:\n\na.\n\nto numbered paragraphs are references to paragraphs of this decision so numbered;\n\nb.\n\nto an Article are references to the applicable Article of the UK GDPR;\n\nc.\n\nto a section are references to the applicable section of FOIA; and\n\nd.\n\nto the Commissioner’s “investigation” mean the Commissioner’s investigation, for the purposes of section 50, of the Appellant’s complaint relating to the Authority’s response to the Request.\n\n3.\n\nWe considered whether it was necessary for us to provide a closed decision. We concluded that it would not be necessary, on the basis that the reasoning behind this decision can be sufficiently understood without us needing to refer to the specific details of, or disclose any sensitive aspects of, the material in the closed bundle.\n\nIntroduction\n\n4.\n\nThis is an appeal against the Decision Notice, which (in summary) held that the Authority was entitled to withhold most of the Requested Information which the Authority had withheld pursuant to section 21 (information accessible to applicant by other means).\n\nBackground to the appeal\n\n5.\n\nThe background to the appeal is as follows.\n\n6.\n\nIt may be helpful to first explain that the Request related to a copy of a specific page from a Transcript Book which forms part of the 1939 Register records held by the Authority. The following explanations about the Register were set out in the Authority’s skeleton argument in the appeal:\n\n“\nThe 1939 Register… is essentially a manual record of census-like information, which was created to record the movements of the population of England and Wales until 1952. It was adopted by the NHS in 1948, on the NHS’s creation, as a means of recording patient information, such as patient movement, changes to patient details such as names, and patient involvement in certain medical research. The Register was updated using codes and continued to be updated until the digitisation of NHS records in 1991.\n\nThe Register was transferred to the Health and Social Care Information Centre (“\nHSCIC\n”) in 2008, which then became NHS Digital in 2016, and which then merged through legislation with NHS England in 2023. NHS England is therefore the current holder of the Register for the purposes of FOIA but does not actively use the Register for any purposes.\n\n…\n\nEach entry in the Register is extended across two pages and there is one entry/ row for each individual. The left hand page and the first column on the right hand page generally contain the census-like information recorded before the NHS took over use of the Register. This includes information such as names, birth dates and addresses. It also sometimes includes annotations, many added by the NHS, such as where an individual changed their name (usually due to marriage). The remainder of the right hand page (the ‘postings’ column) was used by the NHS and contains information sought by the Appellant…\n”.\n\nThe Request\n\n7.\n\nOn 20 December 2023, the Appellant contacted the Authority (further to an earlier request) and requested information in the following terms (original emphasis retained):\n\n“\n… Please provide me with the information at point d) of my request. To be clear, I am asking for one specific page of a Transcript Book. I have provided the schedule and sub-schedule numbers to help you locate the exact page, as the page number is not available in the records available on websites such as via FindMyPast. The page numbers for the double page spreads are found in the top right had [sic] corner of the right hand page. I know this having viewed a sample Transcript Book held at The National Archives. Page numbers were not copied from the physical records held by NHS Digital (now NHS England) when digitised by FindMyPast, so I cannot provide a page number.\n\n… to help ensure that I have made things even clearer, please provide a copy of the page in question which captures information on the following individuals; with the four entries with the National Registration numbers DWRB 100/4, DWRB 104/3, DWRB 110/3 and DWRB 110/4 redacted:\n\nNote:\nThe information below follows the format National Registration Number, Name and Surname, Date of Birth\n\nResidence:\nBledlow Ridge, Buckinghamshire\n\nDWRB 99/2, Evert H. BARGER, 28 August 1910\n\nDWRB 100/1, Charles ROGERS, 3 August 1899\n\nDWRB 100/2, Una G. ROGERS, 22 August 1905\n\nDWRB 100/3 Charles S. R. ROGERS, 9 October 1936\n\nDWRB 100/4 -\nPlease redact any information for this entry.\n\nDWRB 101/1, Cecilia T. F. THORNTON, 14 December 1861\n\nDWRB 101/2, Cecilia M. THORNTON, 17 November 1891\n\nDWRB 102/1, Albert G, BIRKS, 6 November 1876\n\nDWRB 102/2, Elsie BIRKS, 18 April 1914\n\nDWRB 102/3, George MOODY-STUART, 27 October 1851\n\nDWRB 102/4, Stuart [Ron] Marion S. MOODY, 1 December 1892\n\nDWRB 102/5, George H. MOODY-STUART, 9 March 1931\n\nDWRB 103/1, Ellen BATTING, 14 March 1868\n\nDWRB 103/2, Eliza HARRIS, 14 July 1866\n\nDWRB 103/3, Eric N. BATTING, 19 March 1914\n\nDWRB 103/4, Alfred R. BATTING, 7 September 1898\n\nDWRB 104/1, Stanley A. ANDREWS, 15 September 1907\n\nDWRB 104/2, Jessie ANDREWS, 28 July 1902\n\nDWRB 104/3 -\nPlease redact any information for this entry.\n\nDWRB 104/4, Peggy D. BATTING [ASHBY], 2 April 1923\n\nDWRB 105/1, Charles LAMBURN, 7 November 1892\n\nDWRB 105/2, Edith LAMBURN, 18 March 1889\n\nDWRB 106/1, Evelyn C. E. ROBERTS, 5 January 1903\n\nDWRB 107/1, Ernest C. CHLTON, 2 June 1878\n\nDWRB 107/2, Mary A. CHILTON, 10 August 1888\n\nDWRB 108/1, Frederick D. O. ROBERTS, 1 November 1870\n\nDWRB 108/2, Mary A. ROBERTS, 28 August 1864\n\nDWRB 108/3, Evelyn M. McDOUGALL, 17 December 1872\n\nDWRB 108/4, Caroline SEDGWICK, 1 November 1837\n\nDWRB 108/5, Agnes MORGAN, 12 August 1887\n\nDWRB 110/1, Francis R. KEEN, 20 November 1896\n\nDWRB 110/2, Elizabeth M. KEEN, 27 September 1898\n\nDWRB 110/3 -\nPlease redact any information for this entry.\n\nDWRB 110/4 -\nPlease redact any information for this entry.\n\nDWRB 111/1, Ernest W. JAMES, 31 December 1886\n\nDWRB 111/2, Kathleen N. JAMES, 1 December 1885\n\nDWRB 111/3, William H. JAMES, 3 June 1915\n\nDWRB 112/1, George P. G. BARNES, 19 April 1898\n\nDWRB 112/2, Ivy M. BARNES, 10 July 1902\n\nDWRB 112/3, Basil A. APPS, 7 May 1908\n\nDWRB 112/4, Kathleen APPS, 15 June 1913\n\nDWRB 112/5, Elvira A. PEREZ, 29 July 1859\n\nDWRB 113/1, Frederick G. BENNION, 10 April 1905\n\nDWRB 113/2, Jessie BENNION, 10 April 1908\n”\n\n8.\n\nIn summary, therefore, the Request sought a copy of one page of the Transcript Book contained in the Register. That page captures information relating to 44 individuals but the Request only sought information about 40 of those individuals.\n\n9.\n\nThe Request was the subject of a previous decision notice issued by the Commissioner dated 12 November 2024 (reference IC-308783-G5R3). The Authority originally responded to the Request on 2 February 2024. It provided a black and white microfiche version of the Requested Information, with some redactions pursuant to section 40(2). The Authority later relied on section 14 (vexatious or repeated requests), on the basis that the Appellant was seeking a copy of the information in its original (colour) form.\n\n10.\n\nIn that previous decision notice, the Commissioner concluded that the Authority was not entitled to rely on section 14 and required the Authority to issue a fresh response which did not rely on that exemption.\n\n11.\n\nFollowing that previous decision notice, the Authority issued its revised response to the Request (on 12 December 2024). The Authority provided some of the Requested Information in its original (colour) form but withheld the remainder, citing section 40 (personal information) and section 41 (information provided in confidence).\n\n12.\n\nThe Appellant complained to the Commissioner following receipt of that revised response and the Commissioner agreed with the Authority that the internal review process would be bypassed to enable him to investigate the Authority’s latest position.\n\n13.\n\nDuring the Commissioner’s investigation, the Authority issued a further, revised response to the Appellant (on 26 March 2025). It disclosed an image copy of the Page, but redacted death registration data (date of death, district code, and sub-district code) under section 21, personal data under section 40(2) and medical records data relating to deceased individuals under section 41.\n\n14.\n\nThe Commissioner subsequently issued the Decision Notice.\n\nThe Decision Notice\n\n15.\n\nThe Decision Notice recorded that the Appellant only wished to challenge the Authority’s application of section 21 to the Request. The Commissioner accordingly concluded that the scope of his investigation was to determine whether the Authority was entitled to rely on section 21 in respect of the death registration data which had been withheld by the Authority.\n\n16.\n\nIn summary, the Commissioner concluded in the Decision Notice that:\n\na.\n\nthe Appellant could marry up information publicly available from the GRO with information in the\nPage\nmarked with the letter ‘D’ (which is part of the overall code), the district code of registration, and the date of death;\n\nb.\n\nthe Authority was accordingly entitled to rely on section 21 in respect of such information in the\nPage;\n\nc.\n\nhowever, the Appellant could not marry up the sub-district codes with any other information and therefore the sub-district codes were not reasonable accessible by other means; and\n\nd.\n\naccordingly, the Authority could not rely on section 21 in respect of the sub-district codes.\n\n17.\n\nThe Decision Notice therefore required the Authority to disclose the sub-district codes for the death information which had been withheld by the Authority.\n\nSubsequent disclosure of further information\n\n18.\n\nPursuant to the Decision Notice, the Authority contacted the Appellant (on 1 August 2025) and made disclosure of the sub-district codes within the scope of the Request.\n\n19.\n\nIn its response dated 1 August 2025, the Authority stated the following with regard to the remaining information which it withheld in reliance on section 21 (the “Relevant Information”):\n\n“\nPart of the death registration information is available via the General Register Office (GRO) (there is charge for this information). Online indexes are available which can help the applicant to identify the correct reference details to be able to apply for a death certificate. For example: https://www.freebmd.org.uk\n\nYou are able to request copies of the individuals’ death certificates from GRO. These will contain the same date of death and registration district details recorded in our records.\n\nIf you are not able to identify the reference details, you are able to provide the information you do have to the GRO for them to perform a search for the relevant death certificate. Certificates can be ordered from GRO at: https://www.gov.uk/order-copy-birth-death-marriage-certificate\n”.\n\nThe appeal\n\nThe grounds of appeal\n\n20.\n\nThe Appellant advanced thorough grounds of appeal, which included detailed comments on why he considered that the Relevant Information was not reasonably accessible by other means.\n\n21.\n\nIn summary, the material aspects of the Appellant’s arguments were that:\n\na.\n\nthe Relevant Information included handwritten information which would convey additional information which was not otherwise reasonably accessible;\n\nb.\n\nthe Requested Information needs to be read as a whole and in context to provide a full picture;\n\nc.\n\nthe ‘death cyphers’ (see paragraph 72) contain information which is not available from GRO records;\n\nd.\n\neven the typed equivalent of the Relevant Information was not reasonably accessible elsewhere;\n\ne.\n\naccordingly, in coming to his conclusion in the Decision Notice, the Commissioner adopted an unduly narrow interpretation of ‘recorded information’ and in doing so failed to apply the correct interpretation that term.\n\nReferring\nto the view taken by the Upper Tribunal in\nIndependent Parliamentary Authority (IPSA) v Information\nCommissioner\nand Leapman\nUKUT 0033 (ACC)\n.\n\n22.\n\nThe Appellant also argued that section 40(2) was not engaged in respect of some of the Requested Information which had been redacted in reliance on that section. This was on the basis that the Lord Chancellor’s Advisory Council on National Records and Archives considered, in February 2004, that a lifetime of 100 years should be assumed. The Appellant accordingly argued that the Authority was wrong to apply section 40(2) to individuals who are presumed dead based on an assumed life expectancy of 100 years.\n\nFurther disclosure of information\n\n23.\n\nIn responding to the appeal, the Authority determined that some further information could be disclosed, on the basis that the Authority could not be certain that entries merely consisting of a ‘D’ or a ‘D’ and a date between 1939 and 1952 was information otherwise reasonably accessible to the Appellant. The Authority stated that this was because the origin of the information was unclear (as the deaths may have occurred outside of England and Wales). The Authority accordingly disclosed further aspects of the Requested Information to the Appellant with its response to the appeal dated 24 September 2025.\n\nThe Tribunal’s powers and role\n\n24.\n\nThe powers of the Tribunal in determining the appeal are set out in section 58, as follows:\n\n“(1)\n\nIf on an appeal under section 57 the Tribunal considers—\n\n(a)\n\nthat the notice against which the appeal is brought is not in accordance with the law, or\n\n(b)\n\nto the extent that the notice involved an exercise of discretion by the Commissioner , that he ought to have exercised his discretion differently,\n\nthe Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner ; and in any other case the Tribunal shall dismiss the appeal.\n\n(2)\n\nOn such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.\n”.\n\n25.\n\nIn summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).\n\nMode of hearing\n\n26.\n\nThe proceedings were held by the cloud video platform over two separate dates; the first session was held on 20 January 2026 and the second session was held on 15 April 2026. The Tribunal Panel, the Appellant, Mr Fitzsimons (on behalf of the Authority) and the witness (see paragraph 31) joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.\n\n27.\n\nThe Commissioner did not attend the hearing and was not represented (having previously indicated that he would be content to rely on his written submissions if there was an oral hearing).\n\n28.\n\nThere were some minor interruptions during the first session of the hearing, including instances where the Judge’s connection momentarily froze or his connection was lost and he needed to rejoin the hearing. The parties and the other members of the Panel had been aware of the connection problems and proceedings were continued from the point when the connection had been lost or frozen and the Tribunal was satisfied that nothing had been missed. There were no other interruptions of note during the hearing.\n\nThe evidence and submissions\n\n29.\n\nThe Tribunal read and took account of an open bundle of evidence and pleadings, as well as a closed bundle and a written skeleton argument from the Authority.\n\n30.\n\nAfter the first session of the hearing (and prior to the second session of the hearing), the Panel also received a full copy of the Authority’s response to the Request dated 2 February 2024. This included the microfiche which had been attached to that response which had not been included in the open bundle.\n\n31.\n\nThe open bundle contained a witness statement provided on behalf of the Authority. The witness’s statement was given in their capacity as Operations Manager in the Personal Demographics Service National Back Office. The witness also gave evidence in person during the hearing. It is not necessary for us to identify this witness by name in this decision - therefore we merely refer to them below as “the witness” and we mean no disrespect to them in doing so.\n\n32.\n\nThe closed bundle contained a complete (unredacted) copy of the Requested Information.\n\n33.\n\nWe heard from the Appellant directly, as well as oral evidence from the witness. We heard oral submissions from Mr Fitzsimons on behalf of the Authority.\n\n34.\n\nAll of the contents of the bundles and the skeleton argument were read and considered, and all of the submissions from the parties and the witness’s evidence were taken into account, even if not directly referred to in this decision.\n\n35.\n\nDuring the hearing, the Tribunal held a closed session. A gist of the closed session (approved by the Tribunal) was provided to the Appellant on the resumption of the open session.\n\nThe statutory framework\n\nWe acknowledge the Practice Direction dated 4 June 2024 (\nhttps://www.judiciary.uk/guidance-and-resources/practice-direction-from-the-senior-president-of-tribunals-reasons-for-decisions/\n) and particularly paragraph 9, which refers to the First-tier Tribunal not needing to specifically refer to relevant authorities. We include\nreferences to the applicable legislative framework, to provide relevant context, but (apart from some\nreferences to authorities to reflect the parties’ arguments or\nwhich we\notherwise\nconsider may be helpful) have accordingly not referred to the applicable case law.\n\nGeneral principles\n\n36.\n\nSection 1(1) provides individuals with a general right of access to information held by public authorities. It provides:\n\n“\nAny person making a request for information to a public authority is entitled—\n\n(a)\n\nto be informed in writing by the public authority whether it holds information of the description specified in the request, and\n\n(b)\n\nif that is the case, to have that information communicated to him.\n”.\n\n37.\n\nIn essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides:\n\n“\nSubsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.\n”.\n\n38.\n\nAccordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.\n\n39.\n\nSection 2(2) addresses potential exemptions to the Duty to Disclose. That section provides:\n\n“\nIn respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—\n\n(a)\n\nthe information is exempt information by virtue of a provision conferring absolute exemption, or\n\n(b)\n\nin all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.\n”.\n\n40.\n\nThe effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). For the purposes of the appeal, section 21 and section 41 are included in that list, and section 40(2) is included in that list so far as relating to cases where the first condition referred to in that section is satisfied.\n\n41.\n\nAccordingly, summarising the above:\n\na.\n\nthe exemption to the Duty to Disclose in section 21 is an absolute exemption (therefore if this exemption is engaged then the Public Interest Test does not need to be applied);\n\nb.\n\nthe exemption to the Duty to Disclose in section 40(2) is an absolute exemption in cases where that first condition is satisfied (and, if so, then the Public Interest Test does not need to be applied), otherwise the exemption is subject to the Public Interest Test; and\n\nc.\n\nthe exemption to the Duty to Disclose in section 41 is an absolute exemption (therefore if this exemption is engaged then the Public Interest Test does not need to be applied – but see paragraph 64).\n\nSection 21 -\nInformation accessible to applicant by other means.\n\n42.\n\nSection 21 provides:\n\n“(1)\n\nInformation which is reasonably accessible to the applicant otherwise than under section 1 is exempt information.\n\n(2)\n\nFor the purposes of subsection (1)—\n\n(a)\n\ninformation may be reasonably accessible to the applicant even though it is accessible only on payment, and\n\n(b)\n\ninformation is to be taken to be reasonably accessible to the applicant if it is information which the public authority or any other person is obliged by or under any enactment to communicate (otherwise than by making the information available for inspection) to members of the public on request, whether free of charge or on payment.\n\n(3)\n\nFor the purposes of subsection (1), information which is held by a public authority and does not fall within subsection (2)(b) is not to be regarded as reasonably accessible to the applicant merely because the information is available from the public authority itself on request, unless the information is made available in accordance with the authority’s publication scheme and any payment required is specified in, or determined in accordance with, the scheme.\n”.\n\nSection 40 – personal information\n\n43.\n\nSo far as is relevant for the purposes of the appeal, section 40 provides:\n\n“\n…(2) Any information to which a request for information relates is also exempt information if—\n\n(a)\n\nit constitutes personal data which does not fall within subsection (1), and\n\n(b)\n\nthe first, second or third condition below is satisfied.\n\n(3A)\n\nThe first condition is that the disclosure of the information to a member of the public otherwise than under\nthis Act\n—\n\n(a)\n\nwould contravene any of the data protection principles…”\n.\n\n44.\n\nSection 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:\n\na.\n\nSection 3(2) of the DPA defines “personal data” as “\nany information relating to an identified or identifiable living individual\n”. The “processing” of such information includes “\ndisclosure by transmission, dissemination or otherwise making available\n” (\nsection 3(4)\n(d) of the DPA) and so includes disclosure under FOIA.\n\nb.\n\nThe “data protection principles” are those set out in Article 5(1) and section 34(1) of the DPA.\n\nc.\n\nThe first data protection principle, in Article 5(1)(a), is that personal data shall be: “\nprocessed lawfully, fairly and in a transparent manner in relation to the data subject\n”.\n\nd.\n\nA “data subject” is defined in\nsection 3\nof the DPA and means “\nthe identified or identifiable living individual to whom personal data relates\n”.\n\nLawful basis of processing\n\n45.\n\nTo be lawful, processing of personal data must meet one of the bases for lawful processing, which are set out in Article 6(1).\n\nLawful basis – legitimate interests\n\n46.\n\nOne lawful basis for processing of personal data is the Legitimate Interests Basis. This is potentially the only relevant basis for processing for current purposes (but see also paragraph 55).\n\n47.\n\nArticle 6(1)(f) provides: “\nprocessing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child\n”.\n\n48.\n\nArticle 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.\n\nThe Legitimate Interests Test\n\n49.\n\nThe Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of\n\nSouth Lanarkshire Council v Scottish Information Commissioner\n\n[2013] UKSC 55, paragraph 18\n\n:\n\n“(i)\n\nIs the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?\n\n(ii)\n\nIs the processing involved necessary for the purposes of those interests?\n\n(iii)\n\nIs the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?\n”.\n\n50.\n\nThe wording of question (iii) is taken from the\nData Protection Act 1998\n, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be: ‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.\n\n51.\n\nIt may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.\n\n52.\n\nThe question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb (the Balancing Test) can be considered.\n\n53.\n\nFor the purposes of the second limb of the Legitimate Interests Test, case law has established that the term “necessary” means something which is more than desirable but less than an indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive”, or the “least intrusive”, means of achieving the legitimate interest in question).\n\n54.\n\nRegarding the Balancing Test, when considering the potential disclosure of personal data under FOIA, case law has established that the guiding principle is the protection of privacy with respect to the processing of personal data. However, all of the circumstances of the case need to be taken into account in determining whether or not the legitimate interests being pursued (in the second limb of the Legitimate Interests Test) are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.\n\nLawful basis – consent\n\n55.\n\nThe only other lawful basis for processing of personal data which might arguably be relevant on the facts of this case is consent. Consent is defined in Article 4(11) as:\n\n“\nany freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.\n”.\n\n56.\n\nIn summary, for consent to be a valid lawful basis for the processing of personal data, the relevant data subject must have freely and clearly given consent for the use of their personal data for a specific purpose.\n\nArticle 9 – special categories of personal data\n\n57.\n\nArticle 9 addresses some particular categories of personal data (set out in Article 9(1) and known as ‘special categories of personal data’) which are prohibited from being processed unless certain conditions (set out in Article 9(2)) are met. Pursuant to Article 9(1), the special categories of personal data are defined as:\n\n“\n…personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation…\n”.\n\n58.\n\nSo far as is relevant for current purposes, therefore, the special categories of personal data include “data concerning health”. Article 4 (15) defines “data concerning health” as:\n\n“\npersonal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.\n”.\n\n59.\n\nRecital 35 of the UK GDPR also specifies that personal data concerning health:\n\n“\nshould include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject.\n”.\n\n60.\n\nRecital 35 of the UK GDPR also goes on to provide that this includes:\n\n“\nany information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source…\n”.\n\nSection 41(1) – Information provided in confidence\n\n61.\n\nSection 41(1) provides:\n\n“\nInformation is exempt information if—\n\n(a)\n\nit was obtained by the public authority from any other person (including another public authority), and\n\n(b)\n\nthe disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.\n”.\n\n62.\n\nIn summary, the exception under section 41 applies where the relevant information was provided to a public authority by another person and there would be an actionable breach of confidence if that information was disclosed.\n\n63.\n\nThe starting point for assessing whether there is an actionable breach of confidence is the following three-fold test\n:\n\nEstablished in the case of\nCoco v AN Clark (Engineers) Ltd\n[1969] RPC 41\n\na.\n\nDoes the information have the necessary quality of confidence?\n\nb.\n\nWas it imparted in circumstances importing an obligation of confidence?\n\nc.\n\nIs there an unauthorised use to the detriment of the party communicating it?\n\n64.\n\nAlthough the exemption to the Duty to Disclose under section 41 is an absolute exemption, it is a defence to an action for breach of confidence to show that it was in the public interest for the information in question to be disclosed. This is different from the Public Interest Test, however, and there is a presumption that confidentiality should be maintained and that purely private interests in maintaining confidentiality can properly be taken into account.\n\nDiscussion and findings\n\nPreliminary points\n\n65.\n\nWe start by noting that the positions of both the Authority and the Commissioner were largely aligned, with the Authority agreeing with and adopting the Commissioner’s reasoning in the Decision Notice and his submissions in the appeal.\n\n66.\n\nConsequently, partly for convenience and partly because of the Authority’s representation in person at the hearing, the remainder of this decision generally refers only to the position or views of the Authority, but this should be taken as including reference to the Commissioner’s position or views to the extent applicable - and no disrespect to the Commissioner is intended by this approach.\n\nThe scope of the appeal/the Tribunal’s remit\n\n67.\n\nThe scope of the Tribunal’s jurisdiction is as set out in paragraph 24 (and summarised in paragraph 25) and, in essence, relates to the lawfulness of the Decision Notice. This involves an assessment as to whether the Commissioner was correct to conclude that the Authority was entitled to rely on section 21 in order to withhold the Relevant Information.\n\n68.\n\nHowever, as we have noted, in its various correspondence relating to the Request (including during the course of the Commissioner’s investigation), the Authority sought to rely on the exemptions under section 40(2) and section 41(1) in withholding aspects of the Requested Information, in addition to its reliance on section 21 in withholding the Relevant Information. The Authority maintained its reliance on those other exemptions before the Tribunal during the course of the appeal.\n\n69.\n\nCase law has established that a public authority is entitled to rely on exemptions (including exemptions not previously cited by it) at any point before an appeal is determined by the First-tier Tribunal.\n\n70.\n\nIt was therefore permissible for the Authority to continue to rely on those further exemptions in respect of the appeal. It has therefore been necessary for us to consider the application of those exemptions as part of our determination of the appeal, notwithstanding that the Commissioner did not address them in the Decision Notice.\n\nThe relevant issues in the appeal\n\n71.\n\nIn light of our comments above:\n\na.\n\nthe primary issue which we needed to determine in the appeal was whether the Decision Notice was correct to conclude that the Authority was entitled to rely on section 21 in order to withhold the Relevant Information;\n\nb.\n\nwe also needed to determine whether the Authority could rely on the exemptions in section 40(2) and section 41(1) to withhold the applicable aspects of the Requested Information.\n\nWhether section 21 was engaged in respect of the Relevant Information\n\n72.\n\nIt may be helpful for us to start by setting out the following extract from the Authority’s response to the appeal (which was referring to its revised response to the Request on 26 March 2025):\n\n“\nNHS England applied s. 21 FOIA to death registration information, which may be as little as indicating the individual is deceased or may contain what is referred to by the Appellant as a ‘death cypher’, consisting of the fact the individual was deceased (denoted by the letter ‘D’), the individual’s date of death and district and sub-district codes, indicating where the civil death registration was undertaken (in most cases, this will be proximate to the place of death, however, there is scope for deaths to be registered out of area).\n”.\n\n73.\n\nThe Appellant and the Authority each produced detailed arguments, citing various specific examples of Register entries, in support of their respective positions regarding the potential application of section 21 to the Relevant Information. Examples were also addressed in the witness statement and the Appellant provided submissions in respect of those. Some of the examples were considered during the course of the hearing. We have not considered it necessary to cite any of the specific examples in this decision, on the basis that our reasoning can be understood without that detail.\n\n74.\n\nIn summary, the Authority’s position was that (in accordance with the Decision Notice), the death registration information in the Page, as referred to above, was all available elsewhere (apart from the sub-district codes, which had since been disclosed to the Appellant).\n\n75.\n\nWe accept that some of the constituent elements of the Relevant Information can be derived from materials available through the GRO (even if only accessible on payment of a fee, which is permissible under section 21(2)(a)).\n\n76.\n\nHowever, we find that not all of the Relevant Information is otherwise reasonably accessible to the Appellant, for the following reasons.\n\n77.\n\nWe accept the Appellant’s arguments that:\n\na.\n\nin respect of the Relevant Information, although it was possible to locate the GRO death index for some of the entries on the Page using the information from the Register, the information in both sources did not always match; and\n\nb.\n\naccordingly, it would not be possible to marry up the information without also having access to the ‘death cyphers’ on the Page.\n\n78.\n\nThis point was also accepted by the Authority in its submissions, where it stated:\n\n“\nThroughout this appeal, the Appellant has pointed to slight discrepancies between the information held by the GRO and the information in the Register. There are circa 7,000 volumes of the Register and each one was being manually updated by a team of people. There are of course going to be errors; this is human nature. In applying s21, the Authority cannot be expected to check every single entry in the Register to confirm it is the exact same information held by the GRO. That would create an undue burden and strip s21 of its practical utility.\n”.\n\n79.\n\nThe Authority also submitted that it was “\nneither practicable nor desirable\n” for it to cross-check every entry with the GRO before applying section 21.\n\n80.\n\nThe witness also conceded during the hearing that there may be errors in the information recorded by the GRO. They stated that they had no first-hand knowledge of records being updated and that there were now very few people who had been involved in updating the records, so the witness could only get anecdotal information.\n\n81.\n\nThe witness’s written statement had also stated that the Relevant Information “should” be the same as that held by the GRO, but they did not provide any emphatic statement or evidence that it was the same. On the contrary, they stated, in essence, that an exercise had been undertaken using a sample of the Relevant Information to check for consistency with records held by the GRO and that an “assumption” was made that other information (beyond the samples used) would also be consistent. The witness stated that such an exercise had been undertaken because, essentially, it was “\ntoo burdensome\n” to check all the records to ensure that they reflected what was held by the GRO.\n\n82.\n\nIt is worth reiterating that if the exemption in section 21 is to be engaged, the information which has been requested must be reasonably accessible to the applicant. In our view, the Authority cannot rely on section 21 if it does not know that the Requested Information held by it is the same information which is available elsewhere (via the GRO). In this case, the Authority accepted in its submissions that there will be “errors”, by way of inconsistencies between the Relevant Information and the information available via the GRO. As we have noted, the witness also conceded that, essentially, there may be discrepancies between the Relevant Information and the information recorded by the GRO. Accordingly, the Authority cannot be certain that all of the Relevant Information is otherwise available to the Appellant.\n\n83.\n\nWe are also aware that the Commissioner’s published guidance\n\nhttps://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/section-21-information-accessible-to-the-applicant-by-other-means/\n\n(which was also referred to by the Appellant during the hearing) states that if a public authority is to rely on the exemption in section 21, it should be able to show that the information in the public domain matches what the applicant asked for. This is consistent with principles reflected in relevant case law. In this case, the Authority has not been able to demonstrate that Relevant Information matches the information which it asserts is available to the Appellant by other means.\n\n84.\n\nThe Appellant also provided evidence to show that the GRO, which was responsible for linking death registrations to entries in the NHS Central Register, was not always able to confirm a match without reference to, in some cases, multiple additional sources of information. The Appellant submitted that interpreting the ‘death cypher’ provides information which is not recorded elsewhere, as it relates to which NHS Central Register death registration matched to a Register entry. The Appellant provided detailed arguments, supported by examples, to demonstrate that the ‘death cyphers’ convey information beyond that contained in the GRO.\n\n85.\n\nThe Authority stated, in its response to the appeal, that the death registration information being withheld was supplied to the NHS Central Register by the Registrar of Births and Deaths for the relevant district, who took that information from the civil death registration, which is held by the GRO. The Authority accordingly submitted that the information in the Register should be the same information that is held by the GRO. In addition to our comments in paragraph 81, we note that the Appellant challenged the accuracy of this statement. He submitted that the information was taken from the\ndraft\ndeath registration provided by local Registrars and that the NHS Central Register had to match the draft death registration with an entry in the registers, which was not always straightforward and often required other information to be consulted.\n\n86.\n\nThe Appellant also argued that the information provided by the informant of the death may be di\nff\nerent to the information contained in the Register entries, meaning that matching a GRO death index reference number to information in the Register, or indeed to the same class of information in any other document, can become a di\nffi\ncult task. The Appellant provided examples in which the existence of death registration information elsewhere would not permit an individual, even one experienced in genealogical research, to identify with confidence the registration used by the authorities.\n\n87.\n\nThe Appellant also provided detailed arguments about various practices and policies which were used over time to record an individual’s death in the Transcript Books. He stated that it was clear that the practice varied, as the Authority’s disclosures in response to the Request (following the Decision Notice) showed that some of the Relevant Information included a sub-district number whereas others do not.\n\n88.\n\nThe witness was not able to refute the relevant arguments of the Appellant. In particular, the witness’s written statement included the following:\n\n“\nThere is a lot of information in the Appellant’s Reply regarding how NHS Central Register (NHSCR), which is now the NBO team, were sent death notifications and how those notifications were linked to Register entries. The Register has not been updated since the early 1990s, long before my time in the NBO team. Although I understand the information in the Register, my knowledge of the processes outlined by the Appellant are limited. The Appellant has access to a lot of documents and information, which were once held by NHSCR, but have since been sent to the National Archives (as we no longer needed them) and short of going to the National Archives and studying every relevant document, I cannot comment on whether the process outlined by the Appellant (e.g. at paragraph 12 of his Reply) is correct or not. Either way, this does not change the fact that NHSCR and the GRO were both provided with the same death registration information from the Registrar.\n”.\n\n89.\n\nTaking into account all of the above, we conclude that:\n\na.\n\nthe ‘death cyphers’ and associated annotations in the Relevant Information convey information beyond that contained in the GRO;\n\nb.\n\nseeking to identify the relevant information from other public sources would involve a degree of difficulty such that (even if the information was available) it could not be said that the information was reasonably accessible to the Appellant;\n\nc.\n\nthere may be discrepancies in the Relevant Information and other publicly available information and, in any event, the Authority cannot be certain that the Relevant Information matches the information which it asserted is accessible to the Appellant by other means; and\n\nd.\n\naccordingly, section 21 is not engaged in respect of the Relevant Information.\n\nWhether section 40(2) was engaged in respect of the applicable Requested Information\n\n90.\n\nThe Authority submitted, in essence, that the Requested Information contained personal data because individuals were identifiable taking into account the information on the left hand page from the specific Transcript Book, which was publicly available census information containing the names of the individuals (and which were also contained in the Request).\n\n91.\n\nThe Authority stated that, where section 40(2) was relied on, it was on the basis that the Authority holds no information allowing it to safely conclude that the individual in question is deceased.\n\n92.\n\nThe Authority also submitted that the wording of the Request must also be taken into account when considering the question of whether personal data would be processed in responding to the Request. In this case, the Request specified the name and date of birth of the relevant individuals.\n\n93.\n\nWe agree that the relevant aspects of the Requested Information constituted (or could constitute) personal data, for the reasons submitted by the Authority. Also, in some instances, the relevant personal data concerns health information of the data subjects in question and therefore constitutes ‘special category’ personal data.\n\n94.\n\nThe dispute between the parties regarding the engagement of section 40(2) was whether the Authority was entitled to conclude that relevant individuals were deceased.\n\n95.\n\nThe Authority’s position was that if it was unable to confirm, despite taking reasonable steps, whether the individuals whose personal data is contained in the Requested Information are deceased then it worked on the assumption that the individual is alive. For these purposes, it assumed that an individual under the age of 116 would be alive in the absence of a death certificate.\n\n96.\n\nAs we have noted, the Appellant argued that the Lord Chancellor’s Advisory Council on National Records and Archives considered that a lifetime of 100 years should be assumed. The Appellant’s position, therefore, was that the Authority was wrong to use an assumed age of 116 years.\n\n97.\n\nAs submitted by the Authority, case law has confirmed that an age of 116 should be used before applying an assumption that a person is deceased in the absence of any evidence to the contrary.\n\nSee\nthe Fir\ns\nt\n-\ntier Tribunal’s decision in\nEwa Sygulska v Information\nCommissioner\nEA/2017/0271\n\nand the Upper Tribunal’s decision regarding permission to appeal that decision in\nEwa Sygulska v Information\nCommissioner\n& Ministry of Defence\n\n[2019] UKUT 269 (AAC).\n\nFor current purposes, we are bound to follow case law, rather than any advice of guidance issued by the Lord Chancellor’s Advisory Council. Accordingly we find that the Authority correctly concluded that, in the absence of any evidence to confirm that an individual was deceased (after taking reasonable steps to determine this) an individual should be assumed to be alive up to the age of 116 years.\n\n98.\n\nConsequently, we find that the relevant aspects of the Requested Information which were withheld under section 40(2) comprise the personal data of the individuals in question.\n\n99.\n\nWe also conclude that section 40(2) is engaged in respect of the relevant Requested Information, for the following reasons.\n\n100.\n\nAs we have noted:\n\na.\n\nthe first data protection principle requires personal data to be processed lawfully, which means that there must be a lawful basis for such processing;\n\nb.\n\napart from the Legitimate Interests Basis, the only other potentially relevant lawful basis for processing of personal data is consent.\n\n101.\n\nThere was no evidence before us that any data subject had given consent to the processing (by way of disclosure under FOIA in response to the Request) of their personal data. Accordingly, only the Legitimate Interests Basis would be applicable to such processing and we therefore turn to consider the Legitimate Interests Test.\n\n102.\n\nIt\nmay\nbe helpful at this stage to reiterate the Legitimate Interests Basis. As we have noted, it\nprovides\n: “\nprocessing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...\n”. Translating that language to the context of the appeal:\n\na.\n\nthe disclosure of the relevant aspects of the Requested Information would be ‘processing’;\n\nb.\n\nthe Appellant is the ‘third party’; and\n\nc.\n\nthe individuals whose personal data is included in the relevant aspects of the Requested Information are the ‘data subjects’.\n\n103.\n\nThere were limited submissions before us regarding the Legitimate Interests Test. However, in our opinion:\n\na.\n\nin respect of the first limb of the Legitimate Interests Test, the Appellant was pursuing a legitimate interest in making the Request, relating to genealogy research;\n\nb.\n\nin respect of the second limb of the Legitimate Interests Test (which, as we have noted, is a test of ‘reasonable necessity’), the relevant processing (disclosure of the relevant personal data under FOIA) is necessary for the purposes of the Appellant’s legitimate interest, because we do not consider that that legitimate interest could be achieved by something less (especially given our findings about the relevant Requested Information not being reasonably accessible by other means);\n\nc.\n\nin respect of the Balancing Test, the potential disclosure of the relevant personal data for the purposes of the Appellant’s legitimate interest in genealogy is overridden by the interests or fundamental rights and freedoms of the data subjects. This is because we consider that maintaining rights to privacy of personal data is paramount and, in that regard, we are also mindful that disclosure of information under FOIA constitutes disclosure to the world at large. We therefore find that the Balancing Test favours protecting the interests or fundamental rights and freedoms of the relevant data subjects.\n\n104.\n\nFor the reasons we have given, we find that disclosure, pursuant to the Request, of the personal data which was withheld by the Authority would breach the first data protection principle. Accordingly, we find that the Authority was entitled to rely on section 40(2) in respect of such personal data. Given that finding, it is not necessary for us to address the question of whether any of the relevant personal data also comprised ‘special category’ personal data.\n\nWhether section 41(1) was engaged in respect of the applicable Requested Information\n\n105.\n\nThe Authority sought to rely on section 41(1) in respect of the relevant aspects of the Requested Information on the basis that it comprised confidential medical information and related to someone who is, or could be, deceased.\n\n106.\n\nThe Appellant did not challenge the Authority’s reliance on section 41(1) but, for completeness, we briefly set out our conclusions in respect of this.\n\n107.\n\nWe find that the relevant aspects of the Requested Information comprise medical information and therefore that it had the necessary quality of confidence and that it was imparted in circumstances which gave rise to a duty of confidence. We agree with the Authority’s submission that the general principle is that medical confidentiality continues beyond the death of a patient and such information is covered by section 41(1).\n\n108.\n\nThere was no evidence before us that there would be a public interest defence to an actionable breach of confidence regarding any potential disclosure of the relevant aspects of the Requested Information.\n\n109.\n\nWe therefore find that the Authority could rely on section 41(1) to withhold the aspects of the Requested Information which it withheld in reliance on the exemption in that section.\n\nOther matters\n\n110.\n\nAs we have noted:\n\na.\n\nthe Request was dated 20 December 2023; and\n\nb.\n\nthe Authority originally responded to the Request on 2 February 2024.\n\n111.\n\nSection 10(1) provides that a public authority must respond to a request for information no later than 20 working days following the date of receipt of the request. Pursuant to section 17(1), where a public authority also refuses the request or part of the request, it must also issue a refusal notice within the same timeframe.\n\n112.\n\nGiven the Authority’s delay in responding to the Request and in issuing a refusal notice, we find that the Authority breached section 10(1) and section 17(1). We also find that the Decision Notice involved an error of law in not addressing this.\n\nFinal conclusions\n\n113.\n\nFor all of the reasons we have given, we find that the Decision Notice erred in determining that the Authority was entitled to rely on section 21 to refuse to disclose the Relevant Information.\n\n114.\n\nWe also find that the Authority is entitled to rely on section 40(2) and section 41(1) to withhold the relevant aspects of the Requested Information which it withheld in reliance on the exemptions in those sections.\n\n115.\n\nWe therefore allow the appeal in part and we make the Substituted Decision Notice set out above.\n\nSigned:\nStephen Roper\nDate: 25 August 2026\n\nJudge of the First-tier Tribunal","changes":[]}