{"check":null,"uid":"1974a8e553133bd0","title":"Steven Armstrong v The Information Commissioner","title_generated":false,"country":"Великобритания","organ":"Суды Англии и Уэльса","kind":"case","kind_name":"Судебная практика","lang":"en","date":"2026-08-05","summary":"Заявитель требовал у NHS Resolution копии экспертных медицинских заключений, собранных по его иску о врачебной небрежности, настаивая на ответе по Закону о свободе информации 2000, а не в режиме запроса субъекта данных. Трибунал отклонил апелляцию: запрошенное — его собственные персональные данные, поэтому ведомство обязано было отказаться подтверждать или опровергать их наличие по ст. 40(5A), а выдать их по FOIA мешает ст. 40(1). Раскрытие по FOIA считается раскрытием всему миру; ни выдача одному заявителю, ни его согласие, ни обезличивание этого не меняют.","snippet":"","topics":["Персональные данные"],"status":"ok","error":"","text_len":36182,"versions":1,"url":"https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/1123","first_seen":"2026-08-19","last_checked":"2026-09-17 01:44","relevance":"hit","score":38,"query":"","source_key":"caselaw_uk","verdict":{"relevance":"hit","score":38,"topics":["Персональные данные"],"need_body":3,"authorities":[{"kind":"орган","name":"Information Commissioner","topic":"Персональные данные"},{"kind":"акт","name":"Data Protection Act 2018","topic":"Персональные данные"}],"evidence":[{"topic":"Персональные данные","term":"персональн данн","weak":false,"pos":327,"ctx":"ежиме запроса субъекта данных. трибунал отклонил апелляцию: запрошенное — его собственные персональные данные, поэтому ведомство обязано было отказаться подтверждать или опровергать их наличие по ст.","zone":"название","weight":3},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":511,"ctx":"ssioner dated 9 july 2025, reference ic-374858-g4s4 , relating to the request.  dpa:  the data protection act 2018 .  duty to inform:  the duty of a public authority to confirm whether or not it","zone":"текст","weight":1},{"topic":"Персональные данные","term":"data protection","weak":false,"pos":1766,"ctx":"ich was requested by way of the request.  sar:  a subject access request under applicable data protection legislation.  sar response:  the authority’s treatment of the request as a sar, and its r","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":8368,"ctx":"f the appeal, were that (in essence):  a.  the requested information did not comprise his personal data – alternatively, if the commissioner considered that the requested information was the ap","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":8481,"ctx":"tively, if the commissioner considered that the requested information was the appellant’s personal data, then he must be entitled to receive it;  b.  the commissioner should not have concluded","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":9740,"ctx":"spect of the commissioner’s view that the requested information comprised the appellant’s personal data, the appellant stated that he gave his consent to release the requested information (albe","zone":"текст","weight":1},{"topic":"Персональные данные","term":"personal data","weak":false,"pos":16908,"ctx":"mation to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.  …  (5a)  the duty to confirm or deny does no","zone":"текст","weight":1},{"topic":"Персональные данные","term":"Information Commissioner","weak":false,"pos":23,"ctx":"Steven Armstrong v The Information Commissioner Заявитель требовал у NHS Resolution копии экспертных медицинских заключений, собранных по","zone":"орган","weight":3},{"topic":"Персональные данные","term":"Data Protection Act 2018","weak":false,"pos":1124,"ctx":"ssioner dated 9 July 2025, reference IC-374858-G4S4 , relating to the Request.  DPA:  The Data Protection Act 2018 .  Duty to Inform:  The duty of a public authority to confirm whether or not it holds inf","zone":"акт","weight":0}],"dropped":[]},"last_changed":"2026-08-19","meta":{"neutralCitation":"[2026] UKFTT 01123 (GRC)","court":"United Kingdom First-tier Tribunal (General Regulatory Chamber)"},"source_url":"https://caselaw.nationalarchives.gov.uk/ukftt/grc/2026/1123","text":"Preliminary matters\n\n1.\n\nIn this\ndecision,\nwe use the following terms to denote the meanings shown:\n\nAppellant:\n\nSteven Armstrong.\n\nAuthority:\n\nNHS Resolution.\n\nClaim:\n\nThe negligence claim, or potential negligence claim, referred to in paragraph 5.b and (where applicable) correspondence connected to it\n.\n\nCommissioner:\n\nThe Information Commissioner (the Respondent).\n\nDecision Notice:\n\nThe Decision Notice of the Commissioner dated 9 July 2025, reference\nIC-374858-G4S4\n, relating to the Request.\n\nDPA:\n\nThe\nData Protection Act 2018\n.\n\nDuty to Inform:\n\nThe duty of a public authority to confirm whether or not it holds information which is requested, pursuant to section 1(1)(a) (set out in paragraph 28).\n\nDuty to Disclose:\n\nThe duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 28).\n\nFOIA:\n\nThe\nFreedom of Information Act 2000\n.\n\nPublic Interest Test:\n\nAs applicable, either:\n\nthe test, pursuant to section 2(1)(b) (set out in paragraph 31), as to whether, in all the circumstances of the case, the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the public authority holds the information; or\n\nthe test, pursuant to section 2(2)(b) (set out in paragraph 34), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information.\n\nRequest:\n\nThe request for information made to the Authority by the Appellant dated 28 February 2025\n,\nas set out in paragraph 6.\n\nRequested Information:\n\nThe information which was requested by way of the Request.\n\nSAR:\n\nA subject access request under applicable data protection legislation.\n\nSAR Response:\n\nThe Authority’s treatment of the Request as a SAR, and its response in that regard.\n\nTribunal Rules:\n\nThe Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.\n\n2.\n\nUnless the context otherwise requires, or as otherwise expressly stated, references in this\ndecision\n:\n\na.\n\nto numbered paragraphs are references to paragraphs of this decision so numbered;\n\nb.\n\nto any section are references to the applicable section of FOIA; and\n\nc.\n\nto the Commissioner’s “investigation” mean his investigation, for the purposes of section 50, of the Appellant’s complaint relating to the\nAuthority’s\nresponse to the Request.\n\n3.\n\nNothing we say in this decision should be taken as an indication as to whether or not the Requested Information is held by the Authority.\n\nIntroduction\n\n4.\n\nThis was an appeal against the Decision Notice, which decided that section 40(5A) applied to the Request. The Commissioner concluded that the only correct response to the Request under FOIA would have been for the Authority to rely on that section to refuse to confirm or deny that it holds the Requested Information.\n\nBackground to the appeal\n\n5.\n\nThe background to the appeal is as follows. It may be helpful first to set out our understanding that:\n\na.\n\nthe Authority is responsible for investigating, responding to, resolving and (where appropriate) defending legal claims against the NHS;\n\nb.\n\nthe Appellant indicated an intention to bring a negligence claim against the NHS concerning the death of his mother;\n\nc.\n\nthe Authority commissioned expert medical opinions in connection with its evaluation of that claim; and\n\nd.\n\nsuch expert opinions are the subject matter of the Request\n.\n\nThe Request\n\n6.\n\nBy way of email dated 28 February 2025, the Appellant requested information in the following terms:\n\n“\nI’m writing to request the expert opinions [that] have been obtained as part of my claim.\n\n…\n\nI want…NHS RESOLUTIONS… to provide me with copies of the expert opinions obtained, ASAP, please. If necessary consider this as a data access/FOI request…\n”.\n\n7.\n\nThe Authority responded on 6 March 2025. It dealt with the Request as a SAR, which was largely refused on the basis the information was subject to legal professional privilege.\n\n8.\n\nThe Appellant contacted the Authority on 7 March 2025, seeking an internal review. He challenged the SAR Response, arguing that the Authority should not have treated the Request as a SAR and that it should instead have been considered under FOIA. He also suggested that it would be possible to make a restricted disclosure of the Requested Information to him alone, even under FOIA.\n\n9.\n\nThe Authority responded on 3 April 2025 with the outcome of its internal review. It upheld its decision on treating the Request as a SAR and noted that section 40(1) would have prevented it from disclosing to the Appellant any of his own personal information under FOIA.\n\n10.\n\nThe Appellant contacted the Commissioner on the same date to complain about the Authority’s response to the Request.\n\n11.\n\nThe Commissioner subsequently issued the Decision Notice.\n\nThe Decision Notice\n\n12.\n\nThe Commissioner commented in the Decision Notice that (in summary):\n\na.\n\nthe Appellant was seeking his own personal information pursuant to the Request and it was therefore appropriate for the Authority to deal with the Request as a SAR;\n\nb.\n\nbecause the Appellant had insisted on a FOIA response, the Commissioner had accordingly considered the position under FOIA;\n\nc.\n\nsection 40(1) allowed a public authority to withhold information if it was the personal information of the person requesting it, because disclosure of the information to that person through a SAR was more appropriate than disclosure to the world under FOIA; and\n\nd.\n\nsection 40(5A) allowed a public authority to refuse to confirm or deny that it holds any information, if that information (assuming it were held) would be the requester’s own personal information.\n\n13.\n\nThe Decision Notice recorded that the Authority had pointed out that the Requested Information was the Appellant’s\nown\npersonal information because it relates to a claim he made (namely, the Claim). The Commissioner’s view was that that\nalone\nwas sufficient for the Authority to refuse to confirm or deny if it holds the Requested Information.\n\n14.\n\nThe Commissioner also considered that if the Authority were to confirm (or deny) that it holds the Requested Information, then it would be confirming (or denying) that the Appellant had made a claim that it was dealing with (namely, the Claim). The Commissioner stated that that fact, in itself, was the Appellant’s own personal information, as it related to decisions made about him, had him as its focus and the Appellant had identified himself in making the Request.\n\n15.\n\nThe Commissioner therefore determined that the only correct response that the Authority could have given under FOIA was to rely on section 40(5A) to refuse to confirm or deny if it holds the Requested Information.\n\n16.\n\nThe Commissioner further commented that, whilst the Authority did not seem to have any intention of providing public confirmation under FOIA whether it holds the Requested Information, he considered that he should apply section 40(5A) himself, proactively, to put the matter beyond doubt.\n\n17.\n\nThe Commissioner accordingly concluded in the Decision Notice that section 40(5A) applied to the Request\nand that the correct response to it under FOIA would have been for the Authority to rely on that section to refuse to confirm or deny that it holds the Requested Information.\n\n18.\n\nThe Decision Notice did not require the Authority to take any further steps.\n\nThe appeal\n\nThe grounds of appeal\n\n19.\n\nThe Appellant advanced lengthy grounds of appeal which addressed various matters, including his views regarding:\n\na.\n\nthe Authority previously confirming to him, in the context of the Claim, that it would share the expert opinions with him on a ‘without prejudice’ basis;\n\nb.\n\nthe Authority persistently obstructed the progress of the Claim;\n\nc.\n\nunscrupulous actions taken by the NHS in respect of the Claim;\n\nd.\n\nthe need for expert opinions in clinical negligence disputes;\n\ne.\n\nthe merits of the Authority spending a significant amount of money with its lawyers in respect of the Claim; and\n\nf.\n\nwrongdoing on the part of the Commissioner in connection with his investigation.\n\n20.\n\nThe material aspects of the Appellant’s arguments, for the purposes of the appeal, were that (in essence):\n\na.\n\nthe Requested Information did not comprise his personal data – alternatively, if the Commissioner considered that the Requested Information was the Appellant’s personal data, then he must be entitled to receive it;\n\nb.\n\nthe Commissioner should not have concluded that the Authority could rely on section 40(5A) to refuse to confirm or deny whether it holds the Requested Information, because the Appellant already knew that it was held by the Authority and this was also acknowledged by the Authority (which had asserted that it could not be disclosed because of ‘legal professional privilege’);\n\nc.\n\nthe Commissioner did not address the Appellant’s concerns regarding the Authority’s reliance on ‘legal professional privilege’ to withhold the Requested Information;\n\nd.\n\nthe Commissioner was also wrong to suggest that the\nSAR Response\nwas ‘more appropriate’, as it was “\npure fiction\n” to assert that information given in response to a request under FOIA must be ‘published to ‘the world’ because it was possible for the Requested Information to be released on a ‘restricted disclosure’ basis (see also paragraph 21); and\n\ne.\n\nthe Authority did not itself ever rely on section 40(5A) and therefore the Commissioner should not have taken it upon himself to apply that section in respect of the Request.\n\n21.\n\nAdditionally, in respect of the Commissioner’s view that the Requested Information comprised the Appellant’s personal data, the Appellant stated that he gave his consent to release the Requested Information (albeit he stated that he would prefer that the release was undertaken on a ‘restricted disclosure’ basis, to him alone and not to the world at large). The Appellant also stated that he would permit anonymisation in respect of any such release of the Requested Information.\n\nThe Tribunal’s powers and role\n\n22.\n\nThe powers of the Tribunal in determining this appeal are set out in section 58, as follows:\n\n“(1)\n\nIf on an appeal under section 57 the Tribunal considers—\n\n(a)\n\nthat the notice against which the appeal is brought is not in accordance with the law, or\n\n(b)\n\nto the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,\n\nthe Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.\n\n(2)\n\nOn such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.\n”.\n\n23.\n\nIn summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal’s role is to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).\n\nMode of hearing\n\n24.\n\nThe proceedings were held by the cloud video platform. The Tribunal Panel and the Appellant joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way. There were no interruptions of note during the hearing.\n\n25.\n\nThe Commissioner did not attend the hearing and was not represented, having previously indicated that he was content to rely on the documentation in the appeal in his absence.\n\nThe evidence and submissions\n\n26.\n\nThe Tribunal read and took account of an open bundle of evidence and pleadings, as well as a separate written skeleton argument provided by the Appellant.\n\n27.\n\nAll of the contents of the bundle, including all of the submissions of the parties (as well as the Appellant’s submissions during the hearing) were taken into account, even if not directly referred to in this decision.\n\nThe\nrelevant statutory framework\n\nWe acknowledge the Practice Direction dated 4 June 2024 (\nhttps://www.judiciary.uk/guidance-and-resources/practice-direction-from-the-senior-president-of-tribunals-reasons-for-decisions/\n) and particularly paragraph 9, which refers to the First-tier Tribunal not needing to specifically refer to relevant authorities. We include references to the applicable legislative framework, to provide relevant context, but (apart from reference\ns\nto\nsome of the\nauthorities relied on in the\nparties’ arguments\n) have accordingly not referred to the applicable case law.\n\nand legal principles\n\nGeneral principles\n\n28.\n\nSection\n1(1) provides individuals with a general right of access to information held by public authorities. It provides:\n\n“\nAny person making a request for information to a public authority is entitled—\n\n(a)\n\nto be informed in writing by the public authority whether it holds information of the description specified in the request, and\n\n(b)\n\nif that is the case, to have that information communicated to him.\n”.\n\n29.\n\nIn essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides:\n\n“\nSubsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.\n”.\n\n30.\n\nAccordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.\n\n31.\n\nSection 2(1) addresses potential exclusions of the Duty to Inform. That section provides:\n\n“\nWhere any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—\n\n(a)\n\nthe provision confers absolute exemption, or\n\n(b)\n\nin all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information,\n\nsection 1(1)(a) does not apply.\n”.\n\n32.\n\nAccordingly, where there is an applicable exemption in Part II of FOIA then it negates the Duty to Inform. This means that the public authority is permitted to neither confirm nor deny that it holds the requested information.\n\n33.\n\nPursuant to the provisions of section 2(1), some of the\nexclusions of the Duty to Inform\nset out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exemptions are absolute). For the purposes of the appeal, the relevant exemption is section 40(5A), which is not included in that list.\n\n34.\n\nSection 2(2) addresses potential exemptions to the Duty to Disclose. That section provides:\n\n“\nIn respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—\n\n(a)\n\nthe information is exempt information by virtue of a provision conferring absolute exemption, or\n\n(b)\n\nin all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.\n”.\n\n35.\n\nThe effect of the above is that some exemptions to the Duty to Disclose which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). So far as relevant for current purposes, section 40(1) is included in that list.\n\n36.\n\nAccordingly, summarising the above:\n\na.\n\nthe exclusion of the Duty to Inform in section 40(5A) is subject to the Public Interest Test (see our comments in paragraphs 57 to 59); and\n\nb.\n\nthe exemption to the Duty to Disclose in section 40(1) is an absolute exemption.\n\nSection 40 – personal information\n\n37.\n\nSo far as is relevant for the purposes of the appeal, section 40 provides:\n\n“(1)\n\nAny information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.\n\n…\n\n(5A)\n\nThe duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).”\n.\n\n38.\n\nSection 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:\n\na.\n\nsection 3(2) of the DPA defines “personal data” as “\nany information relating to an identified or identifiable living individual\n”;\n\nb.\n\nthe “processing” of such information includes “\ndisclosure by transmission, dissemination or otherwise making available\n” (\nsection 3(4)\n(d) of the DPA) and so includes disclosure under FOIA; and\n\nc.\n\na “data subject” is defined in\nsection 3\nof the DPA and means “\nthe identified or identifiable living individual to whom personal data relates\n”.\n\nDiscussion and findings\n\nThe scope of the appeal/the Tribunal’s remit\n\n39.\n\nWe outlined in paragraph 20 the material issues from the Appellant’s grounds of appeal. In paragraph 19, we also referred to certain other matters which the Appellant addressed in his grounds of appeal.\n\n40.\n\nThe scope of the Tribunal’s jurisdiction is as set out in paragraph 22 (and summarised in paragraph 23) and, in essence, relates to the lawfulness of the Decision Notice. Accordingly, other issues are beyond the Tribunal’s powers to determine and fall outside of the scope of the appeal.\n\n41.\n\nTherefore the Tribunal’s jurisdiction (and consequently the scope of the appeal) does not extend to the matters we referred to in paragraph 19. We also have no jurisdiction to address matters in respect of the Authority’s response to the\nSAR Response\n. It is therefore outside of our remit to consider, or make any finding in respect of, such matters - and accordingly we have not addressed below any of the Appellant’s grounds of appeal insofar as they relate to those matters.\n\n42.\n\nHowever, as we have noted, the Tribunal may review any relevant findings of fact in the Decision Notice and may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).\n\nThe issues in the appeal\n\n43.\n\nIn accordance with the Tribunal’s remit, the fundamental issue which we needed to determine in the appeal was whether the Commissioner was correct to conclude, in the Decision Notice that section 40(5A) applied to the Request.\n\n44.\n\nHowever, we consider that it\nmay be helpful to address the following points, which the Appellant stated in his skeleton argument were the relevant issues for the Tribunal to decide:\n\na.\n\nwhether expert medical opinions derived from a deceased person’s medical records constitute the Appellant’s personal data within the meaning of section 40 and the DPA, given that the DPA applies only to living individuals (“Issue 1”);\n\nb.\n\nwhether section 40(5A) was lawfully applied without any assessment of the actual content of the Requested Information (“Issue 2”);\n\nc.\n\nwhether legal professional privilege is engaged where the dominant purpose was alternative dispute resolution rather than litigation, and litigation was not reasonably contemplated (“Issue 3”);\n\nd.\n\nwhether the Commissioner acted procedurally properly in substituting section 40(5A) when the Authority had cited legal professional privilege and section 40(1) (“Issue 4”); and\n\ne.\n\nwhether the Tribunal may direct restricted disclosure to the Appellant alone with appropriate safeguards (“Issue 5”).\n\n45.\n\nWe therefore address each of those issues in turn, before addressing any remaining points from the Appellant’s grounds of appeal which we outlined in paragraph 20.\n\nIssue 1 - whether expert medical opinions derived from a deceased person’s medical records constitute the Appellant’s personal data within the meaning of section 40 and the DPA, given that the DPA applies only to living individuals\n\n46.\n\nThe Appellant submitted that the Commissioner had conflated a procedural issue (the fact that the Appellant had made the Claim) with a biographical focus (data about the Appellant). In summary, the Appellant argued that, as the DPA applies only to living persons, information about his deceased mother was not ‘personal data’ and could not become so merely because the Appellant corresponded with the Authority or made the Claim.\n\n47.\n\nThe Appellant’s position was, essentially, that information about his late mother did not become his personal data merely because he made the Claim. Issue 1 was based on the Appellant’s view that the Commissioner had wrongly treated information about his late mother as the Appellant’s personal data.\n\n48.\n\nIn our view, Issue 1 reflects a misconception on the part of the Appellant. This is because we find that the Commissioner did not treat information relating to the Appellant’s late mother as the Appellant’s personal data. Rather, as reflected in paragraph 15 of the Decision Notice, the Commissioner considered that the personal data in question was information which would indicate whether or not the Appellant had made the Claim. The Commissioner determined, in essence, that this was the Appellant’s personal data because it related to the Claim, had the Appellant as its focus and the Appellant had identified himself in making the Request.\n\n49.\n\nAs we have noted, section 3(2) of the DPA defines “personal data” as “\nany information relating to an identified or identifiable living individual\n”. The test for what constitutes ‘personal data’ is whether or not a living individual is or could be identified, directly or indirectly, from such information. Also, case law has established that disclosure of information under FOIA comprises both the information sought and the request to which it responds. Consequently, potential disclosure of information under FOIA involves consideration of the information sought and the request for that information. This means that, when considering if disclosure of the Requested Information would make the data subject (the Appellant) ‘identifiable’, this involves an assessment as to whether release of the Requested Information, taken together with the Request, would identify the Appellant. Further, it is permissible, and indeed necessary, to consider the context in which the personal data appears.\n\n50.\n\nIn this case, the Request sought the expert reports which the Appellant understood had been obtained by the Authority “\nas part of my claim\n”. Given that the Request was made to the Authority (which has responsibility for dealing with claims against the NHS) and referred to a claim made by the Appellant, we find that any FOIA response to the Request by the Authority would reveal whether or not the Appellant had made a claim against the NHS. We also consider that it is self-explanatory that the Appellant is identified or identifiable by the Authority.\n\n51.\n\nAccordingly, we find that the Request relates to the Appellant, as an identified or identifiable individual and, in referring to the Claim, comprises information relating to him.\n\nIssue 2 - whether section 40(5A) was lawfully applied without any assessment of the actual content of the Requested Information\n\n52.\n\nThe Appellant argued that the Commissioner had not examined the actual content of the Requested Information and that the Decision Notice did not contain any description or analysis of what the expert opinions contain. He accordingly submitted that the Commissioner relied entirely on assumptions about the Requested Information.\n\n53.\n\nIn the context of a ‘neither confirm nor deny’ exemption under FOIA, it is not appropriate to comment on whether or not any information which has been requested has been assessed, because this of itself could indicate whether or not the information is held.\n\n54.\n\nIn any event, Issue 2 is largely addressed by way of our comments in respect of Issue 1. For the reasons we have given, the Request constitutes the Appellant’s personal data. It follows that, even if the Requested Information is held by the Authority, we do not need to assess it (nor did the Commissioner need to assess it) in order to form a conclusion that section 40(5A) could be engaged.\n\n55.\n\nRelated to this point (and see our comments on Issue 4), we also find that the Commissioner was correct to conclude in the Decision Notice that section 40(5A) was engaged in respect of the Request. As we have noted:\n\na.\n\nsection 40(5A) excludes the Duty to Inform if information which is requested is (or if it were held, would be) exempt information under section 40(1); and\n\nb.\n\nsection 40(1) provides that information is exempt from the Duty to Disclose if it constitutes the requestor’s personal data.\n\n56.\n\nTherefore, for the reasons we have given, the Request constitutes the Appellant’s personal data and accordingly the Requested Information would be exempt from the Duty to Disclose under section 40(1), and consequently the\nexclusion of the Duty to Inform\npursuant to section 40(5A) is engaged.\n\n57.\n\nThe Decision Notice did not address the question of whether the application of the exemption under section 40(5A) is absolute or subject to the Public Interest Test, nor did the Commissioner address this in his response to the appeal. We are aware, however, that the Commissioner’s published guidance states that the Commissioner considers section 40(5A) to be an absolute exemption.\n\nhttps://ico.org.uk/for-organisations/foi/section-40-and-regulation-13-personal-information/part-two-can-you-confirm-or-deny-holding-the-requested-information/\n\nThe Appellant also did not address this question in his submissions.\n\n58.\n\nAs we have noted (see paragraph 33), section 40(5A) is not listed as an absolute exemption in section 2. However, because section 40(1) is an absolute exemption and because section 40(5A) provides for an\nexclusion of the Duty to Inform\nwhere the information is (or would be) exempt under section 40(1), it follows that the exclusion of the Duty to the Inform under section 40(5A) would also be an absolute exemption.\n\n59.\n\nNevertheless, we have applied the Public Interest Test for the purposes of section 40(5A) in any event, and our findings are follows.\n\n60.\n\nIn respect of factors favouring disclosure of\nwhether the Authority holds the Requested Information,\nwe consider that there is a general, broad public interest in transparency in respect of public authorities. We also consider that there is a general public interest regarding any alleged negligence involving the NHS, although in this case we find that the Request is principally concerned with the Appellant’s private interests in respect of the Claim.\n\n61.\n\nIn our view, the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interests outlined above, because we consider maintaining rights to privacy of personal data is paramount. This is because case law has established that the guiding principle should be the protection of the right to privacy with respect to the processing of personal data. As we\nreferred to in paragraph 38.b, responding to the Request would nevertheless involve the ‘processing’ of that personal data by the Authority,\nby way of disclosure of the Requested Information under FOIA. In this regard, we are also mindful that disclosure of information under FOIA is disclosure to the world at large, which we comment on further below.\n\n62.\n\nWe therefore find that the Commissioner was correct to conclude in the Decision Notice that section 40(5A) was engaged in respect of the Request. We also find that the Public Interest Test favours maintaining the\nexclusion of the Duty to Inform\npursuant to that section.\n\nIssue 3 - whether legal professional privilege is engaged where the dominant purpose was alternative dispute resolution rather than litigation, and litigation was not reasonably contemplated\n\n63.\n\nThe Appellant made various submissions relating to the Authority’s reliance on legal professional privilege. However, this issue was not relevant for the purposes of the appeal. This is because legal professional privilege was not relied on by the Authority in response to the Request under FOIA, nor did the Commissioner make any finding in the Decision Notice regarding legal professional privilege.\n\n64.\n\nRather, the Authority cited legal professional privilege as a basis for withholding information pursuant to the\nSAR Response\nand, as we have noted, we have no jurisdiction to address matters relating to the\nSAR Response\n.\n\nIssue 4 - whether the Commissioner acted procedurally properly in substituting section 40(5A) when the Authority had cited legal professional privilege and section 40(1)\n\n65.\n\nIssue 4 fundamentally relates to a procedural question regarding the Commissioner’s investigation. For the reasons we have referred to, it was not within our remit to address matters relating to the manner in which the Commissioner conducted his investigation. However, we make the following observations.\n\n66.\n\nIt was open to the Commissioner, following his investigation, to make whatever findings he considered appropriate for the purposes of the Decision Notice. In doing so, the Commissioner was not constrained to consider only the exemptions cited by the Authority.\n\n67.\n\nLikewise, when dealing with the appeal, the Tribunal was also not constrained to consider only the exemptions cited by the Authority, or by the Commissioner in the Decision Notice.\n\n68.\n\nIn cases involving the potential disclosure of personal data under FOIA, it may also be incumbent on the Commissioner or the Tribunal to raise potential exemptions under section 40 proactively if such exemptions were not raised by the public authority. This is because if the Commissioner or the Tribunal were to order disclosure of personal date simply because the public authority had omitted to cite any exemption under section 40, then the Commissioner or the Tribunal could effectively be ordering a disclosure which contravenes applicable data protection law.\n\n69.\n\nFor the above reasons, we find that there was nothing unlawful in the Commissioner electing to apply, by way of the Decision Notice, an exemption which was not relied on by the Authority.\n\n70.\n\nHowever, as we have noted, the Tribunal’s role in the appeal was to determine whether or not the Decision Notice (and therefore any applicable finding of the Commissioner within it) was in accordance with the law. That is what we have done.\n\nIssue 5 - whether the Tribunal may direct restricted disclosure to the Appellant alone with appropriate safeguards\n\n71.\n\nAs we have noted, the grounds of appeal included the Appellant’s view that it was “\npure fiction\n” for the Commissioner to assert that information given in response to a request under FOIA must be ‘published to ‘the world’.\n\n72.\n\nThe Appellant is mistaken in that view. It is an established legal principle that disclosure of information under FOIA is, effectively, disclosure to the public (in other words, to the ‘world at large’). Indeed, case law has also established that, when considering the consequences of potential disclosure of information under FOIA, it is an error of law to ignore disclosure to persons other than the requester of the information in question.\n\n73.\n\nConsequently, disclosure of the Requested Information cannot be restricted to the Appellant as the person making the Request.\n\n74.\n\nThe Appellant also argued that, aside from FOIA, restricted disclosure of the Requested Information could be permitted pursuant to the Tribunal’s case management powers under the Tribunal Rules, including for reasons of procedural fairness. However, the relevant Tribunal Rules relate to the management of the proceedings before it and do not entitle the Tribunal to require disclosure of information requested under FOIA by alternative means. Further, a response to a request for information under FOIA has to be responded to by the public authority, not by the Tribunal.\n\n75.\n\nThe Appellant also suggested that the Requested Information could be disclosed to him with appropriate safeguards, including pursuant to a confidentiality undertaking from the Appellant. Again, this is not permissible under FOIA, for the reasons we have given. Therefore this is not a reflection on any assurances the Appellant would be willing to give about disclosure of the Requested Information but is simply how FOIA operates.\n\n76.\n\nWith regard to the Appellant’s suggestion that\nthe Requested Information could be anonymised to permit disclosure, this is not possible because (as we have explained) the Request constitutes the Appellant’s personal data and any purported anonymisation would not change that. Again, as we have noted, responding to the Request\nunder FOIA\nwould nevertheless involve the ‘processing’ of that personal data by the Authority\n.\n\nOther points from the Appellant’s grounds of appeal\n\n77.\n\nWe turn now to address the remaining items from the Appellant's grounds of appeal which are not covered by the points above.\n\n78.\n\nThe Appellant argued that if the Requested Information was the Appellant’s personal data, then he must be entitled to receive it. However, under FOIA any request for the Appellant’s own personal data would be subject to the exemption in section 40(1). Related to this point was the Commissioner’s reference in the Decision Notice that\ndisclosure through a SAR was appropriate.\n\n79.\n\nFurther, the result of the finding that section 40(5A) is engaged is that the Request must instead be dealt with as a SAR (which the Authority has already done). As we have already commented, the\nSAR Response\n(including any reasons given by the Authority for withholding information pursuant to the\nSAR Response\n) is outside of the scope of the appeal.\n\n80.\n\nFinally, the Appellant also argued that the Commissioner should not have concluded that the Authority could rely on section 40(5A) to refuse to confirm or deny whether it holds the Requested Information, because the Appellant already knew that it was held by the Authority and this was also acknowledged by the Authority. The Appellant also stated that both he and the Authority knew that he had made the Claim.\n\n81.\n\nHowever, for the reasons we have referred to, as the Request sought the Appellant’s own personal data then it would be exempt under section 40(1). As we have noted, the appropriate way to respond to the Request would be to refuse to confirm or deny that the Authority holds the Requested Information under section 40(5A), rather than respond to the Request under FOIA, which would involve disclosure to the world at large. This is so irrespective of whether the Appellant or the Authority knows or believes that the Requested Information is held by the Authority.\n\nFinal conclusions\n\n82.\n\nFor all of the reasons we have given, we find that the Decision Notice was correct to conclude that section 40(5A) applied to the Request and that the correct response to it under FOIA would have been for the Authority to rely on that section to refuse to confirm or deny that it holds the Requested Information.\n\n83.\n\nWe therefore dismiss the appeal.\n\nSigned:\nStephen Roper\nDate: 5 August 2026\n\nJudge of the First-tier Tribunal","changes":[]}