James Kelsall v Information Commissioner [2026] UKFTT 709 (GRC)

[2026] UKFTT 00709 (GRC)Case Reference: FT/EA/2024/0189
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on: 24 February 2026 and 1 May 2026Date 20 May 2026
Information Rights
Determined on the papers
Before
TRIBUNAL JUDGE MORNINGTONTRIBUNAL MEMBER WOLFTRIBUNAL MEMBER PEPPERELL
Between
James KelsallAppellantINFORMATION COMMISSIONERRespondentIn person for Appellant for First Respondent: Did not appearDecision: The appeal is Allowed.REASONS
[1]This appeal is brought under section 57 of the Freedom of Information Act 2000 (“FOIA”) against a Decision Notice issued by the Information Commissioner on 17 April 2024. The Decision Notice concluded that the Department for Work and Pensions (“DWP”) did not, on the balance of probabilities, hold recorded information within the scope of the Appellant’s request concerning procedures for validating consent prior to requesting medical evidence by way of a UC113 form.[2]The appeal raises issues that go beyond a routine “held / not held” dispute. It concerns the relationship between what a public authority states in published guidance to third parties, particularly medical practitioners, and what it can later assert about the existence (or non-existence) of the policies or procedures said to underpin those statements. It also raises questions about the adequacy of searches undertaken where the authority’s own documentation appears to assert that the requested material exists.[3]The Appellant attended and made oral submissions at the hearing on 24 February 2026. The Information Commissioner did not attend. DWP was not a party but has engaged with the Tribunal following directions issued after the hearing.

Background to Appeal

[4]On 15 August 2023, the Appellant submitted a FOIA request to DWP seeking any policy, guidance or other recorded documents describing the procedures followed by DWP and the Centre for Health and Disability Assessments to obtain and to validate claimant consent before requesting medical evidence from a GP using a UC113 form. The request was as follows:
“Dear Department for Work and Pensions, The DWP (via the CHDA) asks GPs to complete a UC113 form in relation to Universal Credit Work Capability Assessments. The letter asking a GP to complete a UC113 form states that “your patient has given consent to allow us to approach you for this information”
. Please provide any policy, guidance, or other documents you may hold which describe the procedures which the DWP (and CHDA) follows in order to obtain and validate consent from claimants for UC113 forms.”[5]DWP responded on 30 August 2023 by directing the Appellant to the UC50 questionnaire and other publicly available material. No policy or procedure dealing specifically with validation of consent was identified or disclosed.[6]On 1 September 2023, The Appellant requested an internal review, reiterating that his request concerned validation of consent, not merely the point at which consent is first obtained. The Appellant referred DWP to wording in DWP’s Guidance for GPs completing the UC113 form entitled: DWP Medical (Factual) Reports – A Guide to Completion. Footnote 1 to that guidance states that consent may be provided in various forms and that “DWP has procedures in place to ensure that consent is valid.”[7]DWP’s internal review responses of 15 September 2023 and 11 October 2023 maintained their position. They provided narrative explanation of how consent may be given but did not identify any recorded procedures dealing with validation of consent and continued to rely on the UC50 and general descriptions of process.[8]On 23 November 2023, the Appellant complained to the Information Commissioner. During the Commissioner’s investigation, DWP undertook intranet and Google searches and consulted internally with policy, digital, operational and data protection teams. Screenshots and internal email correspondence were supplied to the Commissioner but withheld from the Appellant.[9]On 17 April 2024, the Commissioner issued the Decision Notice, concluding that DWP did not hold the requested information and that its searches were reasonable.[10]The Appellant appealed to the Tribunal on 15 May 2024.

Submissions of the Appellant

[11]At the hearing on 24 February 2026, the Appellant gave evidence and submissions and had previously provided his written submissions to the Tribunal.[12]The Appellant submits that DWP’s position was fundamentally undermined by its own documentation. He emphasised that the request was prompted by a clear and unqualified statement in guidance issued to medical practitioners that DWP “has procedures in place to ensure that consent is valid.” That statement appears in a formal guidance document, intended for reliance by GPs when deciding whether to disclose sensitive patient information.[13]The Appellant argued that any GP reading such guidance would reasonably understand that DWP operates a defined procedure for checking that consent exists and remains valid at the time medical evidence is requested. He submitted that it was therefore reasonable, and indeed inevitable, for a member of the public affected by such disclosures to seek sight of those procedures.[14]The Appellant further submitted that it is implausible that a governmental department processing very large volumes of special category personal data could lawfully operate without recorded policies or procedures addressing consent validation, particularly given the requirements of data protection law.[15]In relation to the guidance document which GPs are referred to, the Appellant highlighted to the Tribunal that the guidance published online was updated on 6 August 2025, which is some time after the Appellant’s request and the submission of the Appeal to the Tribunal. The updated guidance still contains the statement at footnote 1 that “DWP has procedures in place to ensure that consent is valid”.

Submissions of the Information Commissioner

[16]The Commissioner relies on the reasoning in the Decision Notice. The Commissioner submits that the correct legal test has been applied, namely whether the information was held on the balance of probabilities.[17]The Commissioner emphasises that FOIA does not provide a mechanism for requiring a public authority to justify or explain the accuracy of its published statements, nor to create policies that do not exist.[18]The Commissioner’s position is that DWP had undertaken reasonable searches and consulted relevant teams, and that the evidence did not establish that any recorded procedures for validating consent were held. The Commissioner accepted DWP’s explanation that consent is managed through claimant declarations and operational practice rather than by reference to a discrete recorded procedure.

Position of the Department for Work and Pensions

[19]DWP did not participate in the hearing. However, following Tribunal directions requiring DWP to confirm whether it would join proceedings with a view to assisting the Tribunal, DWP confirmed that it did not wish to be joined as a party but did not oppose disclosure of the previously closed search material and internal emails, subject to limited redactions, so as to help the Appellant understand the nature and extent of the searches which had been conducted.[20]DWP maintained that those materials demonstrated extensive internal inquiries and confirmed that no formal policy or procedure document dealing specifically with validation of consent had ever been created.

Documents

[21]The Tribunal has considered a 213-page bundle of documents and a closed bundle of documents containing the search terms used by DWP and the intranet results arising from those searches. Following directions from the Tribunal, DWP have also sent an email chain between DWP departments detailing the enquiries and searches made following the Appellant’s request.

The Legal Framework

[22]Section 1(1) FOIA entitles a requester to be informed as to whether a public authority holds information of the description specified and, if so, to have that information communicated.[23]Whether a public authority holds material is a question of fact to be determined on the balance of probabilities, see the case of Linda Bromley v the Information Commissioner and the Environment Agency (EA/2006/0072; 31 August 2007) which has subsequently been followed and approved by the Upper Tribunal. The type of fact that will be considered in determining whether the material is held may include the quality of the public authority's initial analysis of the request, the scope of the search that it decided to make on the basis of that analysis and the rigour and efficiency with which the search was then conducted. As noted in that case “There can seldom be absolute certainty that information relevant to a request does not remain undiscovered somewhere within a public authority's records. This is particularly the case with a large national organisation like the Environment Agency, whose records are inevitably spread across a number of departments in different locations. The Environment Agency properly conceded that it could not be certain that it holds no more information. However, it argued (and was supported in the argument by the Information Commissioner) that the test to be applied was not certainty but the balance of probabilities. This is the normal standard of proof and clearly applies to Appeals before this Tribunal in which the Information Commissioner's findings of fact are reviewed. We think that its application requires us to consider a number of factors including the quality of the public authority's initial analysis of the request, the scope of the search that it decided to make on the basis of that analysis and the rigour and efficiency with which the search was then conducted. Other matters may affect our assessment at each stage, including, for example, the discovery of materials elsewhere whose existence or content point to the existence of further information within the public authority which had not been brought to light. Our task is to decide, on the basis of our review of all of these factors, whether the public authority is likely to be holding relevant information beyond that which has already been disclosed.”[24]The Tribunal applies the civil standard of proof. It is not the Tribunal’s role to determine what information ought to be held, nor to require a public authority to create new material. However, the Tribunal must scrutinise the adequacy of the searches undertaken and the consistency and plausibility of the authority’s evidence, particularly where there is contextual material suggesting that relevant information is likely to exist.

Discussion and Conclusion

[25]The Tribunal begins by considering the scope of the request. It is clear that the Appellant did not merely seek information about how consent is initially obtained. The request was expressly directed at “procedures” for validating consent, prompted by wording in DWP’s guidance that refers to such procedures. In the Tribunal’s judgment, the request encompasses any recorded information that explains how DWP satisfies itself that valid consent exists at the point medical evidence is requested, including how consent is checked or verified and how the possibility of withdrawal is addressed.[26]The Tribunal attaches particular significance to the footnote in the medical guidance relied upon by the Appellant. The statement that “DWP has procedures in place to ensure that consent is valid” is not tentative or aspirational language. It is a definitive assertion, presented as fact, in a document issued to healthcare professionals. It conveys that DWP has established mechanisms or rules governing consent validation. The Tribunal considers that such a statement is highly material when assessing whether relevant recorded information is likely to be held.[27]The Tribunal is conscious that a public authority may, in practice, operate without a single, neatly packaged policy document and yet still assert that it has “procedures” in a broader sense. However, where an authority asserts the existence of procedures in formal guidance and continues to repeat that assertion over time, including in updated versions of the guidance, the evidential position is materially affected. In this case, the Tribunal heard oral evidence at the in-person hearing on 24 February 2026 that the Appellant had checked the most recent version of the relevant online guidance, updated since the original request, and that the same assertion continues to appear in a footnote. In those circumstances, the Tribunal considers that careful examination is required of whether recorded information exists that gives substance to that continuing assertion.[28]Turning to the searches, the Tribunal has reviewed the search screenshots and internal email chains that were previously withheld. Whilst these materials show that DWP undertook some searches and made enquiries across a number of teams, they also reveal significant limitations. The searches shown focus largely on specific form numbers and use of the word “validating.” They do not demonstrate that broader or alternative terminology, such as “policy,” “medical consent,” “GP consent” or equivalent formulations, was used. The Tribunal accepts that searching generic terms such as “policy” may yield large volumes of results, but that does not absolve a public authority from designing proportionate searches capable of identifying responsive material.[29]Moreover, the evidence shows lists of search results but does not show that those results were examined and discounted as irrelevant. There is no witness statement or equivalent evidence explaining how search hits were assessed. The Tribunal places weight on the absence of such analysis, particularly in a case where the authority is asserting that the material is not held.[30]The internal email correspondence provided to the Tribunal by DWP reinforces the Tribunal’s concerns. The emails disclose repeated assumptions that some form of policy exists, references to validation of consent being “prescribed by policy,” and efforts to identify which team might hold relevant material. Ultimately, responses refer the matter to the data protection team, which is said to have indicated that the data requested is not held, but without any explanation of what searches were undertaken or what repositories were examined. The Tribunal considers that this chain of correspondence demonstrates uncertainty within DWP rather than clear evidence of non-holding.[31]The Tribunal therefore finds that, taken as a whole, the evidence does not establish on the balance of probabilities that DWP does not hold any recorded information within scope of the Appellant’s request. The combination of the definitive statement in the medical guidance footnote, the scale and sensitivity of the data processing involved in obtaining and validating consent in dealing with medical records, the internal references to policy, and the limitations of the searches undertaken leads the Tribunal to conclude that the Information Commissioner was not entitled to reach a finding of non-holding on the basis of the evidence relied upon.[32]Accordingly, the Tribunal concludes that the Decision Notice issued by the Information Commissioner on 17 April 2024 is not in accordance with the law. The Commissioner’s conclusion that the requested information is not held is not supported by sufficiently robust evidence of reasonable and proportionate searches, particularly when weighed against DWP’s own published statements.

Outcome and Directions

[33]The appeal is allowed. The Tribunal orders that DWP disclose to the Appellant, subject to appropriate redaction of junior staff personal data and internal mailbox addresses, the search material (documents showing the search terms used and the intranet results) and internal email correspondence previously withheld under Rule 14.[34]The Tribunal further directs that DWP undertake fresh, reasonable and proportionate searches designed to identify any recorded information within the scope of the request, including searches capable of locating policy or procedural material relating to medical consent and its validation. Following those searches, DWP must either disclose any responsive information identified or provide a clear and reasoned confirmation that no such information is held, explaining what searches were undertaken and why they are considered sufficient.[35]The Tribunal emphasises that it does not require the DWP to create new information or to amend its guidance. However, where a public authority makes clear, repeated and unqualified statements to medical professionals that it “has procedures in place to ensure that consent is valid”, transparency as to whether recorded versions of those procedures are held is of obvious and substantial public interest. In circumstances where such assurances are relied upon by clinicians when providing medical evidence about their patients, it is not sufficient for an authority simultaneously to assert that no recorded information exists. That transparency is central both to the proper operation of FOIA and to maintaining confidence in the lawful handling of sensitive medical information