Steven Armstrong v The Information Commissioner [2026] UKFTT 1123 (GRC)
Preliminary matters
[1]In this decision, we use the following terms to denote the meanings shown: Appellant: Steven Armstrong. Authority: NHS Resolution. Claim: The negligence claim, or potential negligence claim, referred to in paragraph 5.b and (where applicable) correspondence connected to it. Commissioner: The Information Commissioner (the Respondent). Decision Notice: The Decision Notice of the Commissioner dated 9 July 2025, reference IC-374858-G4S4, relating to the Request. DPA: The Data Protection Act 2018. Duty to Inform: The duty of a public authority to confirm whether or not it holds information which is requested, pursuant to section 1(1)(a) (set out in paragraph 28). Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 28). FOIA: The Freedom of Information Act 2000. Public Interest Test: As applicable, either: the test, pursuant to section 2(1)(b) (set out in paragraph 31), as to whether, in all the circumstances of the case, the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interest in disclosing whether the public authority holds the information; or the test, pursuant to section 2(2)(b) (set out in paragraph 34), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information. Request: The request for information made to the Authority by the Appellant dated 28 February 2025, as set out in paragraph 6. Requested Information: The information which was requested by way of the Request. SAR: A subject access request under applicable data protection legislation. SAR Response: The Authority’s treatment of the Request as a SAR, and its response in that regard. Tribunal Rules: The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.[2]Unless the context otherwise requires, or as otherwise expressly stated, references in this decision:a. to numbered paragraphs are references to paragraphs of this decision so numbered;b. to any section are references to the applicable section of FOIA; andc. to the Commissioner’s “investigation” mean his investigation, for the purposes of section 50, of the Appellant’s complaint relating to the Authority’s response to the Request.[3]Nothing we say in this decision should be taken as an indication as to whether or not the Requested Information is held by the Authority.Introduction
[4]This was an appeal against the Decision Notice, which decided that section 40(5A) applied to the Request. The Commissioner concluded that the only correct response to the Request under FOIA would have been for the Authority to rely on that section to refuse to confirm or deny that it holds the Requested Information.Background to the appeal
[5]The background to the appeal is as follows. It may be helpful first to set out our understanding that:a. the Authority is responsible for investigating, responding to, resolving and (where appropriate) defending legal claims against the NHS;b. the Appellant indicated an intention to bring a negligence claim against the NHS concerning the death of his mother;c. the Authority commissioned expert medical opinions in connection with its evaluation of that claim; andd. such expert opinions are the subject matter of the Request.The Request
[6]By way of email dated 28 February 2025, the Appellant requested information in the following terms: “I’m writing to request the expert opinions [that] have been obtained as part of my claim. … I want…NHS RESOLUTIONS… to provide me with copies of the expert opinions obtained, ASAP, please. If necessary consider this as a data access/FOI request…”.[7]The Authority responded on 6 March 2025. It dealt with the Request as a SAR, which was largely refused on the basis the information was subject to legal professional privilege.[8]The Appellant contacted the Authority on 7 March 2025, seeking an internal review. He challenged the SAR Response, arguing that the Authority should not have treated the Request as a SAR and that it should instead have been considered under FOIA. He also suggested that it would be possible to make a restricted disclosure of the Requested Information to him alone, even under FOIA.[9]The Authority responded on 3 April 2025 with the outcome of its internal review. It upheld its decision on treating the Request as a SAR and noted that section 40(1) would have prevented it from disclosing to the Appellant any of his own personal information under FOIA.[10]The Appellant contacted the Commissioner on the same date to complain about the Authority’s response to the Request.[11]The Commissioner subsequently issued the Decision Notice.The Decision Notice
[12]The Commissioner commented in the Decision Notice that (in summary):a. the Appellant was seeking his own personal information pursuant to the Request and it was therefore appropriate for the Authority to deal with the Request as a SAR;b. because the Appellant had insisted on a FOIA response, the Commissioner had accordingly considered the position under FOIA;c. section 40(1) allowed a public authority to withhold information if it was the personal information of the person requesting it, because disclosure of the information to that person through a SAR was more appropriate than disclosure to the world under FOIA; andd. section 40(5A) allowed a public authority to refuse to confirm or deny that it holds any information, if that information (assuming it were held) would be the requester’s own personal information.[13]The Decision Notice recorded that the Authority had pointed out that the Requested Information was the Appellant’s own personal information because it relates to a claim he made (namely, the Claim). The Commissioner’s view was that that alone was sufficient for the Authority to refuse to confirm or deny if it holds the Requested Information.[14]The Commissioner also considered that if the Authority were to confirm (or deny) that it holds the Requested Information, then it would be confirming (or denying) that the Appellant had made a claim that it was dealing with (namely, the Claim). The Commissioner stated that that fact, in itself, was the Appellant’s own personal information, as it related to decisions made about him, had him as its focus and the Appellant had identified himself in making the Request.[15]The Commissioner therefore determined that the only correct response that the Authority could have given under FOIA was to rely on section 40(5A) to refuse to confirm or deny if it holds the Requested Information.[16]The Commissioner further commented that, whilst the Authority did not seem to have any intention of providing public confirmation under FOIA whether it holds the Requested Information, he considered that he should apply section 40(5A) himself, proactively, to put the matter beyond doubt.[17]The Commissioner accordingly concluded in the Decision Notice that section 40(5A) applied to the Request and that the correct response to it under FOIA would have been for the Authority to rely on that section to refuse to confirm or deny that it holds the Requested Information.[18]The Decision Notice did not require the Authority to take any further steps. The appeal The grounds of appeal[19]The Appellant advanced lengthy grounds of appeal which addressed various matters, including his views regarding:a. the Authority previously confirming to him, in the context of the Claim, that it would share the expert opinions with him on a ‘without prejudice’ basis;b. the Authority persistently obstructed the progress of the Claim;c. unscrupulous actions taken by the NHS in respect of the Claim;d. the need for expert opinions in clinical negligence disputes;e. the merits of the Authority spending a significant amount of money with its lawyers in respect of the Claim; andf. wrongdoing on the part of the Commissioner in connection with his investigation.[20]The material aspects of the Appellant’s arguments, for the purposes of the appeal, were that (in essence):a. the Requested Information did not comprise his personal data – alternatively, if the Commissioner considered that the Requested Information was the Appellant’s personal data, then he must be entitled to receive it;b. the Commissioner should not have concluded that the Authority could rely on section 40(5A) to refuse to confirm or deny whether it holds the Requested Information, because the Appellant already knew that it was held by the Authority and this was also acknowledged by the Authority (which had asserted that it could not be disclosed because of ‘legal professional privilege’);c. the Commissioner did not address the Appellant’s concerns regarding the Authority’s reliance on ‘legal professional privilege’ to withhold the Requested Information;d. the Commissioner was also wrong to suggest that the SAR Response was ‘more appropriate’, as it was “pure fiction” to assert that information given in response to a request under FOIA must be ‘published to ‘the world’ because it was possible for the Requested Information to be released on a ‘restricted disclosure’ basis (see also paragraph 21); ande. the Authority did not itself ever rely on section 40(5A) and therefore the Commissioner should not have taken it upon himself to apply that section in respect of the Request.[21]Additionally, in respect of the Commissioner’s view that the Requested Information comprised the Appellant’s personal data, the Appellant stated that he gave his consent to release the Requested Information (albeit he stated that he would prefer that the release was undertaken on a ‘restricted disclosure’ basis, to him alone and not to the world at large). The Appellant also stated that he would permit anonymisation in respect of any such release of the Requested Information.The Tribunal’s powers and role
[22]The powers of the Tribunal in determining this appeal are set out in section 58, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[23]In summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal’s role is to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).Mode of hearing
[24]The proceedings were held by the cloud video platform. The Tribunal Panel and the Appellant joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way. There were no interruptions of note during the hearing.[25]The Commissioner did not attend the hearing and was not represented, having previously indicated that he was content to rely on the documentation in the appeal in his absence.The evidence and submissions
[26]The Tribunal read and took account of an open bundle of evidence and pleadings, as well as a separate written skeleton argument provided by the Appellant.[27]All of the contents of the bundle, including all of the submissions of the parties (as well as the Appellant’s submissions during the hearing) were taken into account, even if not directly referred to in this decision. The relevant statutory framework General principlesThe relevant statutory framework
[28]Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[29]In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[30]Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.[31]Section 2(1) addresses potential exclusions of the Duty to Inform. That section provides: “Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—(a) the provision confers absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.”.[32]Accordingly, where there is an applicable exemption in Part II of FOIA then it negates the Duty to Inform. This means that the public authority is permitted to neither confirm nor deny that it holds the requested information.[33]Pursuant to the provisions of section 2(1), some of the exclusions of the Duty to Inform set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exemptions are absolute). For the purposes of the appeal, the relevant exemption is section 40(5A), which is not included in that list.[34]Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[35]The effect of the above is that some exemptions to the Duty to Disclose which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). So far as relevant for current purposes, section 40(1) is included in that list.[36]Accordingly, summarising the above:a. the exclusion of the Duty to Inform in section 40(5A) is subject to the Public Interest Test (see our comments in paragraphs 57 to 59); andb. the exemption to the Duty to Disclose in section 40(1) is an absolute exemption.Section 40 – personal information
[37]So far as is relevant for the purposes of the appeal, section 40 provides: “(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject. … (5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).”.[38]Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”;b. the “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA; andc. a “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”. Discussion and findings The scope of the appeal/the Tribunal’s remitDiscussion and findings
[39]We outlined in paragraph 20 the material issues from the Appellant’s grounds of appeal. In paragraph 19, we also referred to certain other matters which the Appellant addressed in his grounds of appeal.[40]The scope of the Tribunal’s jurisdiction is as set out in paragraph 22 (and summarised in paragraph 23) and, in essence, relates to the lawfulness of the Decision Notice. Accordingly, other issues are beyond the Tribunal’s powers to determine and fall outside of the scope of the appeal.[41]Therefore the Tribunal’s jurisdiction (and consequently the scope of the appeal) does not extend to the matters we referred to in paragraph 19. We also have no jurisdiction to address matters in respect of the Authority’s response to the SAR Response. It is therefore outside of our remit to consider, or make any finding in respect of, such matters - and accordingly we have not addressed below any of the Appellant’s grounds of appeal insofar as they relate to those matters.[42]However, as we have noted, the Tribunal may review any relevant findings of fact in the Decision Notice and may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned). The issues inThe appeal
[43]In accordance with the Tribunal’s remit, the fundamental issue which we needed to determine in the appeal was whether the Commissioner was correct to conclude, in the Decision Notice that section 40(5A) applied to the Request.[44]However, we consider that it may be helpful to address the following points, which the Appellant stated in his skeleton argument were the relevant issues for the Tribunal to decide:a. whether expert medical opinions derived from a deceased person’s medical records constitute the Appellant’s personal data within the meaning of section 40 and the DPA, given that the DPA applies only to living individuals (“Issue 1”);b. whether section 40(5A) was lawfully applied without any assessment of the actual content of the Requested Information (“Issue 2”);c. whether legal professional privilege is engaged where the dominant purpose was alternative dispute resolution rather than litigation, and litigation was not reasonably contemplated (“Issue 3”);d. whether the Commissioner acted procedurally properly in substituting section 40(5A) when the Authority had cited legal professional privilege and section 40(1) (“Issue 4”); ande. whether the Tribunal may direct restricted disclosure to the Appellant alone with appropriate safeguards (“Issue 5”).[45]We therefore address each of those issues in turn, before addressing any remaining points from the Appellant’s grounds of appeal which we outlined in paragraph 20. Issue 1 - whether expert medical opinions derived from a deceased person’s medical records constitute the Appellant’s personal data within the meaning of section 40 and the DPA, given that the DPA applies only to living individuals[46]The Appellant submitted that the Commissioner had conflated a procedural issue (the fact that the Appellant had made the Claim) with a biographical focus (data about the Appellant). In summary, the Appellant argued that, as the DPA applies only to living persons, information about his deceased mother was not ‘personal data’ and could not become so merely because the Appellant corresponded with the Authority or made the Claim.[47]The Appellant’s position was, essentially, that information about his late mother did not become his personal data merely because he made the Claim. Issue 1 was based on the Appellant’s view that the Commissioner had wrongly treated information about his late mother as the Appellant’s personal data.[48]In our view, Issue 1 reflects a misconception on the part of the Appellant. This is because we find that the Commissioner did not treat information relating to the Appellant’s late mother as the Appellant’s personal data. Rather, as reflected in paragraph 15 of the Decision Notice, the Commissioner considered that the personal data in question was information which would indicate whether or not the Appellant had made the Claim. The Commissioner determined, in essence, that this was the Appellant’s personal data because it related to the Claim, had the Appellant as its focus and the Appellant had identified himself in making the Request.[49]As we have noted, section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The test for what constitutes ‘personal data’ is whether or not a living individual is or could be identified, directly or indirectly, from such information. Also, case law has established that disclosure of information under FOIA comprises both the information sought and the request to which it responds. Consequently, potential disclosure of information under FOIA involves consideration of the information sought and the request for that information. This means that, when considering if disclosure of the Requested Information would make the data subject (the Appellant) ‘identifiable’, this involves an assessment as to whether release of the Requested Information, taken together with the Request, would identify the Appellant. Further, it is permissible, and indeed necessary, to consider the context in which the personal data appears.[50]In this case, the Request sought the expert reports which the Appellant understood had been obtained by the Authority “as part of my claim”. Given that the Request was made to the Authority (which has responsibility for dealing with claims against the NHS) and referred to a claim made by the Appellant, we find that any FOIA response to the Request by the Authority would reveal whether or not the Appellant had made a claim against the NHS. We also consider that it is self-explanatory that the Appellant is identified or identifiable by the Authority.[51]Accordingly, we find that the Request relates to the Appellant, as an identified or identifiable individual and, in referring to the Claim, comprises information relating to him. Issue 2 - whether section 40(5A) was lawfully applied without any assessment of the actual content of the Requested Information[52]The Appellant argued that the Commissioner had not examined the actual content of the Requested Information and that the Decision Notice did not contain any description or analysis of what the expert opinions contain. He accordingly submitted that the Commissioner relied entirely on assumptions about the Requested Information.[53]In the context of a ‘neither confirm nor deny’ exemption under FOIA, it is not appropriate to comment on whether or not any information which has been requested has been assessed, because this of itself could indicate whether or not the information is held.[54]In any event, Issue 2 is largely addressed by way of our comments in respect of Issue 1. For the reasons we have given, the Request constitutes the Appellant’s personal data. It follows that, even if the Requested Information is held by the Authority, we do not need to assess it (nor did the Commissioner need to assess it) in order to form a conclusion that section 40(5A) could be engaged.[55]Related to this point (and see our comments on Issue 4), we also find that the Commissioner was correct to conclude in the Decision Notice that section 40(5A) was engaged in respect of the Request. As we have noted:a. section 40(5A) excludes the Duty to Inform if information which is requested is (or if it were held, would be) exempt information under section 40(1); andb. section 40(1) provides that information is exempt from the Duty to Disclose if it constitutes the requestor’s personal data.[56]Therefore, for the reasons we have given, the Request constitutes the Appellant’s personal data and accordingly the Requested Information would be exempt from the Duty to Disclose under section 40(1), and consequently the exclusion of the Duty to Inform pursuant to section 40(5A) is engaged.[57]The Decision Notice did not address the question of whether the application of the exemption under section 40(5A) is absolute or subject to the Public Interest Test, nor did the Commissioner address this in his response to the appeal. We are aware, however, that the Commissioner’s published guidance states that the Commissioner considers section 40(5A) to be an absolute exemption. https://ico.org.uk/for-organisations/foi/section-40-and-regulation-13-personal-information/part-two-can-you-confirm-or-deny-holding-the-requested-information/ The Appellant also did not address this question in his submissions.[58]As we have noted (see paragraph 33), section 40(5A) is not listed as an absolute exemption in section 2. However, because section 40(1) is an absolute exemption and because section 40(5A) provides for an exclusion of the Duty to Inform where the information is (or would be) exempt under section 40(1), it follows that the exclusion of the Duty to the Inform under section 40(5A) would also be an absolute exemption.[59]Nevertheless, we have applied the Public Interest Test for the purposes of section 40(5A) in any event, and our findings are follows.[60]In respect of factors favouring disclosure of whether the Authority holds the Requested Information, we consider that there is a general, broad public interest in transparency in respect of public authorities. We also consider that there is a general public interest regarding any alleged negligence involving the NHS, although in this case we find that the Request is principally concerned with the Appellant’s private interests in respect of the Claim.[61]In our view, the public interest in maintaining the exclusion of the Duty to Inform outweighs the public interests outlined above, because we consider maintaining rights to privacy of personal data is paramount. This is because case law has established that the guiding principle should be the protection of the right to privacy with respect to the processing of personal data. As we referred to in paragraph 38.b, responding to the Request would nevertheless involve the ‘processing’ of that personal data by the Authority, by way of disclosure of the Requested Information under FOIA. In this regard, we are also mindful that disclosure of information under FOIA is disclosure to the world at large, which we comment on further below.[62]We therefore find that the Commissioner was correct to conclude in the Decision Notice that section 40(5A) was engaged in respect of the Request. We also find that the Public Interest Test favours maintaining the exclusion of the Duty to Inform pursuant to that section. Issue 3 - whether legal professional privilege is engaged where the dominant purpose was alternative dispute resolution rather than litigation, and litigation was not reasonably contemplated[63]The Appellant made various submissions relating to the Authority’s reliance on legal professional privilege. However, this issue was not relevant for the purposes of the appeal. This is because legal professional privilege was not relied on by the Authority in response to the Request under FOIA, nor did the Commissioner make any finding in the Decision Notice regarding legal professional privilege.[64]Rather, the Authority cited legal professional privilege as a basis for withholding information pursuant to the SAR Response and, as we have noted, we have no jurisdiction to address matters relating to the SAR Response. Issue 4 - whether the Commissioner acted procedurally properly in substituting section 40(5A) when the Authority had cited legal professional privilege and section 40(1)[65]Issue 4 fundamentally relates to a procedural question regarding the Commissioner’s investigation. For the reasons we have referred to, it was not within our remit to address matters relating to the manner in which the Commissioner conducted his investigation. However, we make the following observations.[66]It was open to the Commissioner, following his investigation, to make whatever findings he considered appropriate for the purposes of the Decision Notice. In doing so, the Commissioner was not constrained to consider only the exemptions cited by the Authority.[67]Likewise, when dealing with the appeal, the Tribunal was also not constrained to consider only the exemptions cited by the Authority, or by the Commissioner in the Decision Notice.[68]In cases involving the potential disclosure of personal data under FOIA, it may also be incumbent on the Commissioner or the Tribunal to raise potential exemptions under section 40 proactively if such exemptions were not raised by the public authority. This is because if the Commissioner or the Tribunal were to order disclosure of personal date simply because the public authority had omitted to cite any exemption under section 40, then the Commissioner or the Tribunal could effectively be ordering a disclosure which contravenes applicable data protection law.[69]For the above reasons, we find that there was nothing unlawful in the Commissioner electing to apply, by way of the Decision Notice, an exemption which was not relied on by the Authority.[70]However, as we have noted, the Tribunal’s role in the appeal was to determine whether or not the Decision Notice (and therefore any applicable finding of the Commissioner within it) was in accordance with the law. That is what we have done. Issue 5 - whether the Tribunal may direct restricted disclosure to the Appellant alone with appropriate safeguards[71]As we have noted, the grounds of appeal included the Appellant’s view that it was “pure fiction” for the Commissioner to assert that information given in response to a request under FOIA must be ‘published to ‘the world’.[72]The Appellant is mistaken in that view. It is an established legal principle that disclosure of information under FOIA is, effectively, disclosure to the public (in other words, to the ‘world at large’). Indeed, case law has also established that, when considering the consequences of potential disclosure of information under FOIA, it is an error of law to ignore disclosure to persons other than the requester of the information in question.[73]Consequently, disclosure of the Requested Information cannot be restricted to the Appellant as the person making the Request.[74]The Appellant also argued that, aside from FOIA, restricted disclosure of the Requested Information could be permitted pursuant to the Tribunal’s case management powers under the Tribunal Rules, including for reasons of procedural fairness. However, the relevant Tribunal Rules relate to the management of the proceedings before it and do not entitle the Tribunal to require disclosure of information requested under FOIA by alternative means. Further, a response to a request for information under FOIA has to be responded to by the public authority, not by the Tribunal.[75]The Appellant also suggested that the Requested Information could be disclosed to him with appropriate safeguards, including pursuant to a confidentiality undertaking from the Appellant. Again, this is not permissible under FOIA, for the reasons we have given. Therefore this is not a reflection on any assurances the Appellant would be willing to give about disclosure of the Requested Information but is simply how FOIA operates.[76]With regard to the Appellant’s suggestion that the Requested Information could be anonymised to permit disclosure, this is not possible because (as we have explained) the Request constitutes the Appellant’s personal data and any purported anonymisation would not change that. Again, as we have noted, responding to the Request under FOIA would nevertheless involve the ‘processing’ of that personal data by the Authority.Other points from the Appellant’s grounds of appeal
[77]We turn now to address the remaining items from the Appellant's grounds of appeal which are not covered by the points above.[78]The Appellant argued that if the Requested Information was the Appellant’s personal data, then he must be entitled to receive it. However, under FOIA any request for the Appellant’s own personal data would be subject to the exemption in section 40(1). Related to this point was the Commissioner’s reference in the Decision Notice that disclosure through a SAR was appropriate.[79]Further, the result of the finding that section 40(5A) is engaged is that the Request must instead be dealt with as a SAR (which the Authority has already done). As we have already commented, the SAR Response (including any reasons given by the Authority for withholding information pursuant to the SAR Response) is outside of the scope of the appeal.[80]Finally, the Appellant also argued that the Commissioner should not have concluded that the Authority could rely on section 40(5A) to refuse to confirm or deny whether it holds the Requested Information, because the Appellant already knew that it was held by the Authority and this was also acknowledged by the Authority. The Appellant also stated that both he and the Authority knew that he had made the Claim.[81]However, for the reasons we have referred to, as the Request sought the Appellant’s own personal data then it would be exempt under section 40(1). As we have noted, the appropriate way to respond to the Request would be to refuse to confirm or deny that the Authority holds the Requested Information under section 40(5A), rather than respond to the Request under FOIA, which would involve disclosure to the world at large. This is so irrespective of whether the Appellant or the Authority knows or believes that the Requested Information is held by the Authority.Final conclusions
[82]For all of the reasons we have given, we find that the Decision Notice was correct to conclude that section 40(5A) applied to the Request and that the correct response to it under FOIA would have been for the Authority to rely on that section to refuse to confirm or deny that it holds the Requested Information.[83]We therefore dismiss the appeal. Signed: Stephen Roper Date: 5 August 2026 84. Judge of the First-tier Tribunal