Anthony Peter Clark v The Information Commissioner [2025] UKFTT 350 (GRC)

Case Reference: FT/EA/2024/0244[2025] UKFTT 00350 (GRC)
First-tier Tribunal
(General Regulatory Chamber)
Date 26 March 2025
Information Rights
Decided without a hearing
Before
JUDGE SHENAZ MUZAFFERMEMBER ANNE CHAFERMEMBER AIMEE GASSTON
Between
ANTHONY PETER CLARKAppellantTHE INFORMATION COMMISSIONERRespondentDecision: The appeal is dismissed.REASONS
[1]This is an appeal against a decision of the Information Commissioner (the “Commissioner”) dated 21 June 2024, reference IC-295547-Q9H3 (the “Decision Notice”).[2]The parties opted for a paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing in accordance with rule 2 and rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal)(General Regulatory Chamber) Rules 2009 (as amended).

Factual background

[3]The appeal relates to the application of the Freedom of Information Act 2000 (“the FOIA”). It concerns information held by the Torbay and South Devon NHS Foundation Trust (“the Trust”).

The request and responses

[4]The Appellant made the request which is the subject of this appeal on 09 January 2024 in writing as follows [sic]:
“What I want to know is The Trust as per [name redacted] Letter to me dated the 8th of April 2022 whch stated that the Trust was managing one of its surgeons a [name redacted] behaviour, “The department leads had already commenced the process of investigationwithin the Trusts unacceptable behaviours policy, I would like to assure you that we do take complaints such as yours extremly seriously and it appears that there was an evolving pattern of behaviour which had begun to be managed”
. What I want to know is what behavoiur of [name redacted] was being managed and why and what had led to it being managed. [name redacted] as retired for the Trust, why?”.[5]The Trust responded on 16 January 2024 in writing, stating that they did hold the information but that they considered that it was exempt from disclosure pursuant to section 40(2) FOIA.[6]The Appellant requested an internal review of the decision to withhold the requested information on 20 January 2024. He stated that his request fell within the scope of FOIA as the Chief Executive of the Trust had effectively put the information requested into the public domain by informing the Appellant in a letter that the named surgeon was under investigation and was being monitored, and by intimating that the investigation had “something to do with” the surgery that had been performed by the named surgeon. He stated that he had a right to know what the investigation was about and what was being done to monitor the named surgeon’s behaviour, as it had a direct impact on the surgeon’s performance when that surgeon operated on him.[7]The Trust conducted an internal review and issued a response to the Appellant on 01 February 2024. The Trust upheld their initial decision, stating that: “On this occasion, we cannot provide you with this information as it is outside of the remit of Freedom of Information Act 2000. Under Section 40(2) of the Freedom of Information Act 2000 we are unable to provide personal data relating to another person. There is no route for a member of the public to request personal data relating to another person without a legal basis to access the information. An exemption to this is where there is an overriding substantial public interest in disclosing this information. However, it is important to note that the public interest is not the same as what is of interesting [sic] to the public”.[8]On 06 February 2024, the Appellant sent an email to the Trust, stating that the Trust were ignoring the fact that the Chief Executive had stated in correspondence to him that the surgeon was under investigation and that the investigation was apparently to do with the surgeon’s behaviour. The Appellant stated that his complaint to the Trust involved the surgeon’s behaviour towards him and how that had impacted on his surgery and care, and so he was therefore entitled to the information as to how the surgeon was being managed and how that impacted on how the named surgeon had treated the Appellant.[9]On 22 February 2024, the Appellant sent a further email to the Trust, repeating the text of his email on 06 February 2024, and seeking a response from the Trust.[10]On 13 March 2024, the Trust emailed the Appellant to inform him that he had “exhausted all internal complaint routes”, advising him that he could appeal to the Information Commissioner if he was not content with the outcome of the internal review.[11]On 18 March 2024, the Appellant made a complaint to the Information Commissioner on the basis that he disagreed with the decision of the Trust to refuse to provide the information that he had requested to him.

Decision notice

[12]The Commissioner decided that, before he could determine whether information had been correctly withheld, he should first look at whether the Trust should have confirmed or denied holding any relevant information in the first place. The Commissioner decided that the Trust should not have confirmed or denied that it held the requested information. The Commissioner therefore applied section 40(5B) FOIA proactively, to avoid accidental revelation of personal information. He did not require the Trust to take any further steps.[13]In summary, the reasons for the Commissioner’s decision are:a. Considering the application of section 40 FOIA, a public authority should only be confirming or denying that it holds such information if to do so would be lawful, fair and transparent. In particular, publishing the fact that this personal information is held should be necessary to achieve a legitimate interest and, if there are less intrusive means of achieving the aim than publishing the personal information, then publication is not necessary;b. Section 40(5B) FOIA permits a public authority to refuse to confirm or deny that particular information is held, if confirming or denying that particular recorded information was held would reveal personal information about an individual;c. The index request asked about a named surgeon and any steps that had been taken by the Trust to manage that surgeon’s behaviour. By confirming that it holds such information, the Trust is publishing, to the world at large, the fact that the named surgeon had been subject to internal proceedings to manage their behaviour. The named surgeon was identifiable from the request and the information amounted to personal information.d. Whilst it appeared that the Appellant had previously been told, in response to an earlier complaint, that the surgeon had been subject to some form of management, the Commissioner found no evidence to demonstrate that such fact was widely known by the general public.e. The Commissioner recognised that the Appellant had a legitimate interest, albeit a largely private one, in establishing the steps taken by the Trust and the impact that his previous complaint has had on the surgeon. The Commissioner also identified the general public interest in ensuring that NHS staff behave appropriately and that any inappropriate behaviour is addressed.f. The Commissioner did not consider that providing confirmation or denial that this particular information was held was necessary to meet the legitimate interests that may exist in confirming or denying that the particular information is held.g. The Commissioner also considered that the more general public interest in ensuring transparency in relation to the behaviour of NHS staff could be managed by the public authority’s own internal processes and by the publication of more generalised and anonymised statistics.h. The Commissioner held that confirming or denying that the information was held would not be lawful, as confirming or denying that a specific individual has or has not been subject to internal behaviour management was not the least intrusive means of achieving the legitimate interest test.i. The Commissioner therefore considers it appropriate to apply section 40(5B) FOIA proactively, to prevent the Trust from providing confirmation or denial that the information is held.

Grounds of Appeal

[14]The Appellant appealed on 22 June 2024.[15]The Grounds of Appeal outline the Appellant’s concerns regarding the conduct of the data subject, the response taken by the Trust, and the impact on the Appellant’s treatment. The Grounds of Appeal do not set out why the Commissioner’s Decision Notice is not in accordance with the law or assert that the Commissioner ought to have exercised his discretion differently.

The response of the Commissioner

[16]The Commissioner’s response, dated 05 July 2024, maintains that the Decision Notice was correct. The response stated:
“The Commissioner notes that the Appellant fails to address any of the Commissioner’s reasoning. The Commissioner has reviewed the grounds and still maintains that confirmation or denial would disclose whether or not the Data Subject had been subject to management action given the terms of the request (which referred to the Data Subject by name and referenced such management conduct). Such information is clearly personal data. Confirmation or denial that information is held in this case would be free from any duty of confidence, or any restriction on subsequent use. The Commissioner maintains that confirmation or denial is not necessary for the reasons set out in this Decision Notice”
.

The Appellant’s reply to the Commissioner’s response

[17]In his reply dated 28 August 2024, the Appellant asserted that he had initially been informed by the Trust that the data subject had retired, and so the Trust had been unable to pursue their investigation into the data subject’s behaviour. The Appellant stated that he had recently been informed that the data subject had not, in fact, retired. The initial information that had been provided to him about the data subject’s retirement therefore appeared to be false and the Trust had instead covered up the data subject’s behaviour by stating that he had retired.

Legal Framework

[18]The general right of access to information held by public authorities is contained within section 1 FOIA as follows: s.1 General right of access to information held by public authorities (1) Any person making a request for information to a public authority is entitled – (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him. (2)-(5) ….. (6) In this Act, the duty of a public authority to comply with subsection 1(a) is referred to as “the duty to confirm or deny”.[19]Those rights are subject to certain exemptions, set out in Part II FOIA. The relevant provisions of section 40 FOIA are as follows: s.40 Personal information(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if – (a) it constitutes personal data which does not fall within subsection (1), and (b) either the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act – (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B)-(5A) ….. (5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies – (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) – (i) would (apart from this Act) contravene any of the data protection principles, or (ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b) giving a member of the public the confirmation or denial that would have to be given to comply with section (1)(1)(a) would (apart from this Act) contravene Article 21 of the UK GDPR (general processing: right to object to processing); (c) on a request under Article 15(1) of the UK GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a); (d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section. (7)-(8) …..[20]Section 3(2) Data Protection Act 2018 contains terms relating to the processing of personal data as follows: s.3 Terms relating to the processing of personal data(1) This section defines some terms used in this Act.(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to – (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.[21]In the same section, “processing” in relation to information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d)), which therefore includes disclosure under FOIA. The term “data subject” is defined as “the identified or identifiable living individual to whom the personal data relates” (section 3(5)).[22]For the purposes of section 40(3A)(a), the “data protection principles” are set out in Article 5(1) UK GDPR. The first of those principles is that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)” (Article 5(1)(a)).[23]Information can therefore only be disclosed (or processed) if it would be lawful, fair and transparent to do so. Processing shall only be lawful if it meets one the conditions of lawful processing as set out in Article 6(1) UK GDPR.[24]The only potentially applicable processing condition in this case is the condition contained within Article 6(1)(f) UK GDPR, namely that the “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.[25]In considering the application of Article 6(1)(f) UK GDPR in the context of a request for information under FOIA, it is necessary to consider a three-part test:(i) The legitimate interests test: Whether a legitimate interest is being pursued by the request for information;(ii) The necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; and(iii) The balancing test: Whether the above interests of those to whom the data would be disclosed (ie. members of the public) outweigh or override the prejudice to the rights, freedoms and legitimate interests of the data subject.[26]Referring to Article 6(1)(f)’s slightly differently worded predecessor in the Data Protection Act 1998, Lady Hale said the following in South Lanarkshire Council v The Scottish Information Commissioner [2013] 1 WLR 2421: “... It is well established in community law that, at least in the context of justification rather than derogation, ‘necessary’ means ‘reasonably’ rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ... “.[27]Section 40(2) FOIA is an absolute exemption and therefore the separate public interest balancing test under FOIA does not apply.

The role of the Tribunal

[28]The Tribunal’s remit is governed by section 58 FOIA. This requires the Tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved an exercise of his discretion, whether he ought to have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

Issues

[29]The issue for the tribunal to determine are:(i) Is the requested information personal data?(ii) Is the data controller or a third party pursuing a legitimate interest by the request for information?(iii) Is disclosure of the information necessary for the purposes of meeting that legitimate interest?(iv) Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?

Evidence

[30]We read and took account of a Closed Bundle comprising of 63 pages (including indexes). Somewhat unusually, the Closed Bundle had been disclosed to the Appellant, given that he was fully aware of the name of the data subject and Chief Executive of the Trust, which was the only redacted material. Discussions and conclusions Is the requested information personal data?

Discussions and conclusions

[31]It is clear that the information requested is personal data, as it relates to a named individual and any steps that were taken by the Trust to manage their behaviour.

Legitimate interest

[32]We recognise that there may be a wide range of interests that may be legitimate interests, which can include the own interests of the requestor of the information, even where such information is of very little public interest.[33]We accept that the Appellant’s wish to understand about an ongoing investigation into the data subject relating to the data subject’s behaviour, and the way in which the Trust was seeking to address and manage that behaviour is a legitimate interest, albeit largely a private one that is directly linked to his own complaint against the Trust and his concerns about the impact of the behaviour of the data subject on his (the Appellant’s) treatment. We do also recognise the wider, legitimate public interest in ensuring that NHS staff behave appropriately and that any inappropriate behaviour is addressed via proper processes.

Reasonable necessity

[34]We have considered whether the disclosure of the requested information is reasonably necessary for the purposes of the identified legitimate interest. Disclosure must be more than desirable, but less than indispensable or an absolute necessity. Disclosure must be the least intrusive means of achieving the legitimate aim in question, because it would not be reasonably necessary if it could be achieved by anything less. We must consider whether the legitimate aim could be achieved by means that interfere less with the privacy of the data subject.[35]We deal firstly with the Appellant’s private legitimate interest in any ongoing investigation into the behaviour of the data subject and the Trust’s management of that behaviour.[36]We do not accept that disclosure under FOIA to the world is reasonably necessary for the purposes of the Appellant’s complaint against the Trust. The Appellant is able to make further complaints through, for example, the Trust, the GMC or PHSO, if he believes that his complaint has not been dealt with properly.[37]We also do not accept that disclosure under FOIA to the world is reasonably necessary for the purposes of dealing with the wider public legitimate interest in ensuring that NHS staff act in an appropriate manner. We are satisfied that transparency and accountability can be achieved through steps such as the publication of anonymised statistics and reports, including NHS Trust annual reports and performance reports, which is a much less intrusive way of meeting the legitimate aim in question.[38]Confirming or denying that an identifiable individual has or has not been subject to internal investigation and management processes is therefore not the least intrusive means of achieving either of the legitimate interests in this case. As a consequence, confirming or denying that the information was held by the Trust would not be lawful. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?[39]Having concluded that disclosure is not necessary for the purposes of the legitimate interests, we have not gone on to undertake the balancing exercise to determine whether such legitimate interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Conclusion

[40]We are satisfied that the Commissioner was correct to apply section 40(5B) FOIA proactively, notwithstanding the information that has previously been provided by the Trust, to prevent the Trust from providing confirmation or denial that the information is held.[41]The Tribunal dismisses the appeal for the reasons given above.