David Tindell v The Information Commissioner & Anor [2026] UKFTT 281 (GRC)

[2026] UKFTT 00281 (GRC)

Case Reference: FT/EA/2025/0235

First-tier Tribunal

(General Regulatory Chamber)

Hearing Heard on the papers: 12 th January 2026

Date 02 March 2026

Information Rights

Before

JUDGE ARMSTRONG-HOLMES

MEMBER COSGRAVE

MEMBER SAUNDERS

Between

DAVID TINDELLAppellant

THE INFORMATION COMMISSIONERRespondent

THE CHIEF CONSTABLE OF SUSSEX POLICERespondent

Decision: The appeal is dismissed.

REASONS

Background and Chronology

[1]This is an appeal against the Decision Notice of the Information Commissioner (“the Commissioner”), dated 16th June 2025 and referenced IC-354802-W9W3.

[2]On 23rd July 2024, the Appellant wrote to Sussex Police and requested information in the following terms:

“A secured by design assessment has been carried out by Sussex Police (ref: NW/M/19/006B SBD) for St Peter’s Health Centre, 30-36 Oxford Street, Brighton BN1 4LA I would like a copy and also provide email address to contact.”

I would like a copy and also provide email address to contact.”

[3]Sussex Police respondent to this request on 30th October 2024, withholding the Secured by Design (“SBD”) crime prevention assessment and placing reliance upon section 31(1)(a) of the Freedom of Information Act 2000 (“FOIA”). The Appellant subsequently requested an internal review of that decision.

[4]On 2nd January 2025, the Sussex Police wrote to the Appellant, upholding its original decision in relation to the SBD assessment. The Appellant was, at that stage, provided with an email address for contacting the police force in relation to the request.

Decision Notice of the Commissioner

[5]The complainant contacted the Commissioner on 8th January 2025 to complain about the way their request for information had been handled. In his Decision Notice of 16th June 2025, the Commissioner decided that Sussex Police was entitled to rely upon the section 31(1)(a) exemption. Additionally, the Commissioner determined that Sussex Police had breached section 10(1) FOIA, having failed to comply with section 1(1) FOIA within 20 days. In summary, his conclusions were as follows:(i) That the envisaged harm relates to the law enforcement interests protected by section 31(1)(a) FOIA, namely the prevention of crime.

(ii) That the SBD assessment, if disclosed would have a detrimental effect on the prevention of crime at the premises concerned.

(iii) That the outcome of disclosure predicted by Sussex Police would be likely to occur and he is therefore satisfied that section 31(1)(a) FOIA is engaged.

(iv) That he accepts that disclosure of the SBD assessment would to some extent help to increase openness and transparency of police measures in relation to safety and public’s awareness of available safety measures, and that its disclosure would go towards increasing public trust and confidence in Sussex Police’s security measures, whilst providing reassurance that it is proactive in seeking to prevent crime. However, beyond the general public interest in transparency, the Commissioner does not consider that any public interest arguments have been raised which serve to counterbalance the public interest in preventing crime.

(v) That it would be counter to the public interest for criminals to be given material which could potentially make the premises less secure and enable crime. The Commissioner considers this argument to be of considerable weight in favour of maintaining the exemption.

(vi) That having considered all of the arguments, both in favour and against disclosure, he concludes that the public interest in maintaining the exemption outweighs the public interest in disclosure.

(vii) That section 31(1)(a) FOIA was correctly applied to the withheld information.

Appeal to the Tribunal

[6]The Appellant’s Notice of Appeal, dated 26th June 2025, was submitted on form GRC1 and was accompanied by a number of documents, including a 15-page document entitled ‘Response to Decision Notice’ which sets out his reasons for this appeal. These reasons are summarised as follows:(i) That there is a public interest in promoting transparency about the UK government and public authorities, and St Peter’s Health Centre is the Appellant’s General Practitioner Health Centre, which has had a major redevelopment and there are some issues with this.

(ii) That there is a public interest in providing the SBD assessment.

(iii) By reference to the Information Commissioner’s guidance on applying the prejudice test, dated 15th March 2024, to claim that prejudice ‘would be likely to apply’, it must be established that: (1) There is a plausible causal link between disclosing the information in question and the argued prejudice; (2) That there is a real possibility that the circumstances giving rise to prejudice would occur (i.e. the causal link should not be purely hypothetical); and (3) the opportunity for prejudice to arise is not so limited that the chance of prejudice is in fact remote. This test is not met for the following reasons: (a) There is not a plausible causal link in that a criminal would know about the SBD document. It is a design guide and there is information on the SBD website. (b) There is no real possibility that the circumstances giving rise prejudice would occur, in that a criminal would have to know about the document. (c) That the chance of prejudice is remote, in that there is no reason for a criminal to read the document when there is information on the SBD website. (d) The criminal would not know what steps the Trust or developer has taken to correct any of the issues highlighted in the SBD assessment (i.e. nobody knows what measures have been put in place). (e) That a criminal downloading the document would leave a digital trace which might enable the police to trace the criminal. (f) All commercial properties are potential targets for criminals and not just health centres.

(iv) Noting the case of Pauline Reith v Information Commissioner and London Borough of Hammersmith and Fulham (EA/2006/0058), that Sussex Police has provided no evidence to support there being a causal link between disclosure of the information and the prejudice concerned.

(v) That if the SBD assessment was disclosed, the public would be able to challenge the Trust and/or the developer as to the extent of the security measures that have been implemented.

(vi) That the SBD assessment is a set of guidelines to be followed, and if the assessment is not made available to the public then there is no way of holding the Trust and/or the developer to account if they have not implemented the recommendations identified within the assessment.

(vii) Disclosing the SBD assessment will not help a ‘motivated offender’, as they would not know what measures have been implemented. However, if the assessment is disclosed, then the Trust and/or the developer would be more likely to ensure that any security issues have been dealt with.

(viii) That the Commissioner’s decision in relation to section 31(1)(a) FOIA is flawed.

(ix) That the public interest favours disclosure.

[7]The Appellant invites the Tribunal to set aside the Decision Notice and substitute it with a Decision Notice which requires Sussex Police to disclose the SBD assessment.

Commissioner’s Response to the Notice of Appeal

[8]The Commissioner’s Response, dated 21st July 2025, submits that the appeal should be dismissed and relies upon his Decision Notice as setting out his findings and the reasons for those findings. Additionally, the Commissioner submits the following:(i) That the assessment of likelihood is often a predictive judgment and it was appropriate for the Commissioner to accept the submissions of Sussex Police in light of its expertise and experience.

(ii) That the Appellant’s arguments are insufficient to undermine the engagement of the exemption.

(iii) That the Commissioner correctly concluded that the exemption contained within section 31(1)(a) FOIA was engaged.

(iv) That the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

Chief Constable of Sussex Police’s Response to the Notice of Appeal

[9]The Chief Constable’s response relies upon the letter, dated 30th October 2024 (p.A89 of the OPEN bundle), provided to the Appellant following his request for a copy of the SBD assessment, and additionally, the internal review response of 2nd January 2025 (p.A92 of the OPEN bundle). A summary of his submissions is as follows:(i) There are concerns associated with the release of any information that would identify or jeopardize security measures and increased vulnerability to crime, as law enforcement could be adversely affected.

(ii) The release of the SBD assessment would enable individuals involved in criminal activity to bypass those security measures implemented, increasing the risk of criminal activity.

(iii) The information within the SBD assessment relates to a specific location and details potential points of security weaknesses, and as such, should that information be disclosed to the public, it would enable the criminal fraternity to target those weaknesses for the purpose of committing crime.

(iv) The Appellant has not requested generic information and has asked for a specific SBD assessment which relates to a particular building, St Peter’s Health Centre. Whilst guides are available to the public, the assessment carried out was specifically to identify weaknesses at that location.

(v) Sussex Police has a duty of care to the community and public safety is of paramount importance. Disclosing the SBD assessment to the world would give the criminal fraternity a possible advantage, assisting them with the knowledge to bypass security measures. Consequently, this would have a negative impact upon the police’s ability to enforce the law and may place the police at a disadvantage in certain scenarios.

(vi) Disclosing the SBD assessment could cause certain individuals to be at risk of harm and undermine public safety, thereby hindering the prevention and detection of crime.

(vii) The strongest argument for disclosure, namely that of openness and accountability on the part of the police, is outweighed by the strongest argument against disclosure, which is the potential impact upon the ability of the police to enforce the law.

The Legal Framework

[10]Section 1(1) of FOIA provides for a general right of access to information held by public authorities, which is subject to a series of exemptions. Those exemptions are contained within Part II of FOIA and include section 31 (Law Enforcement). Section 31 is a prejudice based exemption and is additionally a qualified exemption, meaning that not only does disclosure of the information have to prejudice one of the purposes listed in section 31(1) FOIA, but that it can then only be withheld if the public interest in maintaining the exemption outweighs the public interest in disclosing the information (section 2(2) FOIA). The relevant provisions are as follows: 31: Law Enforcement (1) Information which is not exempt information by virtue of section 30 is exempt information if its disclosure under this act would, or would be likely to, prejudice – (a) The prevention or detection of crime, (b) … Section 2 (Effect of the Exemptions in part 2) 2(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that – (a) The information is exempt information by virtue of any provision conferring absolute exemption, or (b) In all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”

[11]In DWP v IC

[2016] EWCA Civ 758

, at [27] the Court of Appeal approved the following passage of the Tribunal’s decision in Christopher Martin Hogan and Oxford City Council v the Information Commissioner (“Hogan”) (EA/2005/0026 and 0030), 17th October 2006, as being “an accurate statement of the correct approach to take when determining prejudice.”:

“29. First there is a need to identify the applicable interest(s) within the relevant exemption. There are only two under s31(1)(a), namely the prevention or detection of crime. 30. Second, the nature of the ‘prejudice’ being claimed must be considered. An evidential burden rests with the decision maker to be able to show that some causal relationship exists between the potential disclosure and the prejudice and that the prejudice is, as Lord Falconer of Thoronton has stated, “real, actual or of substance” (Hansard HL, Vol. 162, April 20, 2000, col. 827). If the public authority is unable to discharge this burden satisfactorily, reliance on ‘prejudice’ should be rejected. There is therefore effectively as de minimis threshold which must be met… 31. When considering the existence of ‘prejudice’, the public authority needs to consider the issue from the perspective that the disclosure is being effectively made to the general public as a whole, rather than simply the individual applicant, since any disclosure may not be made subject to any conditions governing subsequent use. 32. However, while the intended use or motive of the applicant is not relevant to a decision whether to grant or refuse access, this Tribunal accepts that where a public authority is aware of the intended use, it may be a factor for consideration when assessing the nature of the prejudice… 34. A third step for the decision-maker concerns the likelihood of occurrence of prejudice. A differently constituted division of this Tribunal in John Connor Press Associates Limited v Information Commissioner (EA/2005/0005) interpreted the phrase “likely to prejudice” as meaning that the chance of prejudice being suffered should be more than a hypothetical or remote possibility; there must have been a real and significant risk. That Tribunal drew support from the decision of Mr Justice Mundy in R (on the application of Lord) v Secretary of State for the Home Office [2003] EWHC 2073 (Admin), where a comparable approach was taken to the construction of similar words in Data Protection Act 1998. Mr Justice Munby stated that ‘likely’: “connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there may ‘may very well’ be prejudice to those interests, even if the risk falls short of being more probable than not.” 35. On the basis of these decisions there are two possible limbs on which a prejudice-based exemption might be engaged. Firstly, the occurrence of prejudice to the specified interest is more probable than not, and secondly there is a real and significant risk of prejudice, even if it cannot be said that the occurrence of prejudice is more probable than not.” “connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there may ‘may very well’ be prejudice to those interests, even if the risk falls short of being more probable than not.”

[12]Should it be determined that the exemption under section 31(1)(a) FOIA is engaged, the Tribunal would then need to assess the competing public interests under section 2(2)(b) FOIA to determine whether the information should be disclosed.

The role of the Tribunal

[13]The Tribunal has the following powers when determining appeals against the Commissioner’s decisions for the purposes of FOIA: Section 57 FOIA: Appeal against notices…(1) Where a decision notice has been served, the complainant or the public authority may appeal to the Tribunal against the notice. Section 58 FOIA: Determination of appeals (1) If on an appeal under section 57 the Tribunal considers– (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised the discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

Issues and Evidence

[14]The parties had submitted written evidence to the Tribunal prior to the hearing, comprising of an OPEN bundle of 242 pages, and a CLOSED bundle of 16 pages, containing the withheld information. The Tribunal considered and read both of these bundles before determining this appeal

[15]The parties were agreeable to the determination of this appeal on the papers, that is to say, without an oral hearing. We are satisfied, pursuant to Rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, that we can properly determine the issues without an oral hearing.

Discussion and Conclusions

[16]In 2019, Sussex Police carried out a ‘Secured By Design’ crime prevention assessment at St Peter’s Health Centre in Brighton. The purpose of that assessment was to identify any potential risks to the location from a crime prevention perspective, and to provide recommendations to improve the security of buildings and their immediate surroundings. The assessment was withheld from disclosure under section 31(1)(a) FOIA by Sussex Police on the ground that its disclosure would be likely to prejudice the prevention of crime. That decision was upheld by the Commissioner after carrying out his own investigation into the matter, and in his Decision Notice he concluded that Sussex Police was entitled to rely upon the exemption to withhold the SBD assessment.

[17]The Tribunal must determine whether the Decision Notice was wrong in law, or alternatively whether any exercise of discretion by the Commissioner ought to have been exercised differently. In approaching these matters, the Tribunal must consider firstly whether the exemption contained within section 31(1)(a) FOIA has been properly engaged, and if so, whether in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the SBD assessment (section 2(2)(b) FOIA).

[18]We start by briefly mentioning section 30. This is relevant as it is a precursor to the engagement of section 31(1)(a), in that this section can only be engaged if section 30 is itself not engaged. Section 31 FOIA refers to a potential exemption for information “which is not exempt by virtue of section 30”.

[19]There is no dispute between the parties regarding section 30 not being engaged. However, for completeness, we find that section 30 (investigations and proceedings conducted by public authorities) is not engaged in respect of any of the withheld information which is the subject matter of this appeal. This is because we conclude that the information in question is not related to any investigations relating to possible crimes, criminal proceedings or civil proceedings. We therefore return to the question of whether section 31(1)(a) FOIA was correctly engaged.

The Prejudice Test

[20]In the case of Hogan (seeparagraph 11 above), the Tribunal identified a three-stage test to be applied when considering whether such a prejudice-based exemption should apply to the information in question. Firstly, there is a need to identify the applicable interest(s) within the exemption. The focus of the SBD assessment is the security of the NHS premises in Brighton city centre, which it is submitted by the Chief Constable, enables those operating the premises to understand risks, including risks associated with the surrounding area, and to help them to implement physical and procedural controls to deter crime or to frustrate potential offenders, or to mitigate any damage that such offenders may cause. It is further submitted that disclosing this assessment would enable criminals to target any weaknesses identified in the report to gain access to the building(s). On any view of it, the potential harm referred to relates to the prevention of crime, and the Tribunal is therefore satisfied that this applicable interest has been correctly identified.

[21]Secondly, the Tribunal must consider whether the harm identified is “real, actual or of substance”, and determine whether there is a causal link between disclosure of the information and that harm. The purpose of an SBD assessment is to identify weaknesses or risks to the security of a premises, and to suggest suggestions or recommendations which, if implemented, serve to minimise of reduce any potential security issues. Whilst the Appellant submits that there is not a plausible causal link between disclosure of the SBD assessment and the harm identified, in that it is “a design guide” and there is information on the SBD website, having considered the assessment in the CLOSED bundle, we consider that it provides recommendations which are specific to the health centre, and we consider that if the information was disclosed to the world that there is a significant risk that any security weaknesses would be highlighted to the reader. As the Appellant recognises, the nature of the report is that it provides recommendations to the NHS or the developer of the premises, and there is no mechanism by which they may be compelled to implement the suggested measures. Whilst it is true that the reader of the assessment would not know whether the recommended measures have been implemented, we consider that, at the very least, it identifies potential weaknesses in security which could be exploited by those involved in criminal activity.

[22]The Appellant has referred the Tribunal to the case of Pauline Reith v Information Commissioner and London Borough of Hammersmith and Fulham (EA/2006/0058) in submitting that Sussex Police has not provided any evidence to support there being a causal link between disclosure of the SBD assessment and the harm envisaged. That decision concerned the applicable interest detailed under section 31(1)(g) FOIA, namely ‘the exercise by any public authority of its functions for any purposes specified in subsection (2)’, with the applicable section of subsection 2 being 31(2)(c) (the purpose of ascertaining whether circumstances which would justify regulatory action in pursuance of any enactment exist or may arise), and the public authority in question had submitted that disclosing its detailed criteria for towing vehicles would encourage people to park illegally. They had provided no evidence to substantiate this claim however, and the Commissioner’s argument that people who park illegally would know, based on the detailed criteria, where they could park and only receive a fine, rather than being towed away, was not accepted by the Tribunal. The Tribunal found no evidence that there were people who would take this risk, given that they would receive a substantial fine in any case.

[23]A previous decision of the Tribunal is of course not binding on a subsequent and differently constituted Tribunal, and each appeal turns on its own facts. However, in Colin P England v London Borough of Bexley and the Information Commissioner (EA/2006/0060 and 0066), which was concerned with the disclosure of a list of empty properties, the Tribunal stated that providing evidence of a causal link between the disclosure of the list and the prevention of crime was “a speculative task, and as all parties have accepted there is no evidence of exactly what would happen on disclosure, it is necessary to extrapolate from the evidence available to come to the conclusion about what is likely.”.

[24]The police are of course part of the machinery of the State which is tasked with the prevention and detection of crime, and the apprehension of criminals. Whilst it is impossible to say what would happen if this particular SBD assessment were to be disclosed to the public, the views of the police, as experts in the field of crime prevention, carry significant weight. There is, in the Tribunal’s view, a distinct possibility that criminals may target the health centre, should the assessment be disclosed, and although the SBD website may offer guidance to potential developers and organisation, such guidance is not specific in nature and can provide only general recommendations to an interested individual. A motivated individual with access to a specific SBD assessment would, in the Tribunal’s view, be in a stronger position in which to target the premises for criminal activity. We therefore conclude that there is a causal link between disclosure of the information and the harm identified, and that there is a real and significant risk of this harm or prejudice arising. Accordingly, the third condition is satisfied on the basis that it would be likely to occur, should the information be disclosed. We therefore find that the section 31(1)(a) FOIA exemption is engaged.

The Public Interest Test

[25]Although we have determined that section 31(1)(a) FOIA is engaged, we must now consider whether “in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.” (s.2.(2)(b) FOIA). In favour of disclosure, the Tribunal recognises the general public interest in the transparency and openness of public authorities, and that disclosure of the SBD assessment would go some way towards informing members of the public that the police is assisting developers to take preventative steps towards crime, thereby increasing public confidence in the police. Disclosure might equally, as the Appellant suggests, lead to the increased accountability of the NHS Trust in terms of the steps taken by it to implement adequate security features to these particular premises. However, the Tribunal considers that the general information provided by the SBD website and other sources demonstrates the preventative steps which may be taken by developers under the guidance of the police, and that the existence of this material in the public domain goes some way towards increasing public confidence in the police.

[26]There is, in the view of the Tribunal, a strong public interest in preventing crime and the measures used by the police to assist it with this aim. Should the SBD assessment, which is particular to these NHS premises, be disclosed to the world, there is a real risk that this would compromise the integrity of any security measures which have been implemented by the health centre. Any such risk is likely to be increased considerably in the event that the NHS Trust has not implemented all of the recommendations in the assessment, whether this is as a result of financial limitations or other rationale.

[27]The SBD was created in April 2019, and by the time of the Appellant’s request for information in July 2024, there had been a considerable passage of time during which the health centre had been built and is understood to have been operational. As has already been referred to above, there was no requirement for the developer or the NHS to implement any of the recommendations within the assessment, and whilst it may have highlighted potential areas of concern when it was written, we consider that that any value in its disclosure would have been reduced further over time.

[28]Having considered all of the arguments advanced by the parties, we conclude that the public interest in maintaining the exemption outweighs the public interest in disclosure, and that the section 31(1)(a) FOIA exemption was correctly relied upon in withholding the requested information. Accordingly, we do not consider that the Commissioner’s Decision Notice was wrong in law, or that he ought to have exercised his discretion differently when assessing the prejudice or public interest in this appeal.

[29]For the reasons identified above, the appeal is dismissed. Signed: Date: Judge Armstrong-Holmes 15th February 2026