Shiar Youssef v The Information Commissioner [2026] UKFTT 880 (GRC)

[2026] UKFTT 00880 (GRC)

Case Reference: FT/EA/2025/0437

First-tier Tribunal

(General Regulatory Chamber)

Date 16 June 2026

Information Rights

Before

JUDGE A. MARKS CBE

MEMBER K. GRIMLEY EVANS

MEMBER P. DEWAAL

Between

SHIAR YOUSSEFAppellant

THE INFORMATION COMMISSIONERRespondent

SHIAR YOUSSEF

Appellant

THE INFORMATION COMMISSIONER Respondent

The Appellant: represented himself

Richard Bailey for Respondent

Decision: The appeal is dismissed.

REASONS

Introduction

[1]This is an appeal against the Information Commissioner’s Decision Notice dated 5 November 2025 (IC-391833-L9C5) (“the DN”) concerning a request for information made by the Appellant, Mr Shiar Youssef (“SY”), to the Home Office.

[2]In the DN, the Information Commissioner (“the Commissioner”) upheld the Home Office’s reliance on section 40(5B) of the Freedom of Information Act 2000 (“FOIA”), maintaining a 'neither confirm nor deny' (“NCND”) response.

[3]The parties have consented to this appeal being determined on the papers, and the Tribunal is satisfied that it is appropriate to do so pursuant to Rule 32 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

Background

[4]The request relates to the citizenship status of a named individual, Mrs Asma Al-Assad, following the fall of the Assad regime in December 2024 and subsequent events concerning the Assad family.

[5]Material before the Tribunal includes references to Mrs Al-Assad's inclusion on the United Kingdom Consolidated List of Financial Sanctions Targets and contemporaneous media reporting concerning the question of her UK citizenship.

The request for information, internal review and responses

[6]The request, dated 23 April 2025, was as follows:

“Has the Home Office considered withdrawing or revoking the UK citizenship of the former first lady of Syria, Asma Al-Assad, since the fall of the Assad regime in December 2024 and the Assad family fleeing to Russia and being granted asylum there. If yes, what was the Home Office’s decision? I would like to receive a copy of this decision.”

[7]The Home Office responded on 15 May 2025, neither confirming nor denying whether it held information falling within the scope of the request, relying on section 40(5B) FOIA.

[8]SY sought an internal review on 15 May 2025.

[9]Following an internal review, by letter dated 4 June 2025 the Home Office informed SY that it upheld its original position.

The Commissioner’s investigation and Decision Notice

[10]On 4 June 2025, SY complained to the Commissioner about the Home Office’s handling of his request.

[11]The Commissioner considered that the scope of his investigation was whether the Home Office was entitled to rely on section 40(5B) FOIA to give an NCND response.

[12]In his DN dated 5 November 2025, the Commissioner accepted the Home Office’s position.

[13]The Commissioner found that confirming or denying whether relevant information was held would itself disclose personal data relating to a living, identifiable individual; further, such disclosure would contravene UK data protection principles relating to the processing of personal data set out in Article 5 of the UK General Data Protection Regulation ("UK GDPR").

[14]The Commissioner therefore concluded that the Home Office was entitled to rely on section 40(5B) FOIA to give a NCND response and required no further steps.

Appeal to the Tribunal

[15]On 1 December 2025, SY appealed to the Tribunal.

[16]SY’s grounds of appeal are, in summary, that:(a) the Home Office has consistently ignored the legitimate public interest in the information requested, which relates to the actions of the UK government and its different bodies;

(b) this legitimate public interest outweighs the data subject's reasonable expectations of privacy;

(c) the DN is contradictory in acknowledging the legitimate interest in the government's actions and consistency of decision-making and thus the argument that releasing the information would be in the public interest, yet stating there is "insufficient legitimate interest" to outweigh the data subject's fundamental rights and freedoms;

(d) insufficient weight was given to the particular circumstances of the individual concerned, including her public profile, the sanctions to which she is subject by the UK government, investigation for war crimes by the Metropolitan Police and public questioning about her UK citizenship by MPs and the press, making her far from a "routine" case;

(e) the Home Office and Commissioner have failed to consider the data subject's "reasonable" expectation of privacy and data protection in these circumstances stating simply that "all individuals are entitled to a level of privacy" without qualifying that level to the individual in question;

(f) the Commissioner accepts that there is in this case "no less intrusive means of achieving the legitimate aims identified"; and

(g) as such, the Commissioner should have concluded that the Home Office should have confirmed or denied that it holds the information requested.

[17]SY seeks disclosure of the requested information.

The Law

[18]It is not disputed that FOIA is the relevant statutory regime.

Duty to confirm or deny

[19]Section 1(1)(a) FOIA requires a public authority to confirm or deny whether it holds information requested.

[20]Section 40(5B)(a)(i) FOIA provides that the duty to confirm or deny does not arise if giving a member of the public such confirmation or denial would contravene any of the data protection principles under UK GDPR ("DP principles").

[21]Personal data is defined by section 3(2) of the Data Protection Act 2018 as any information relating to an identified or identifiable living individual.

[22]Information relates to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

[23]If the information is personal data, the next question is whether its disclosure would breach any of the DP principles.

[24]Article 5(1)(a) UK GDPR provides that personal data shall be processed lawfully, fairly and in a transparent manner.

[25]‘Processing’ of personal data includes its disclosure in response to a FOIA request: thus information can only be so disclosed if to do so would be lawful, fair and transparent.

[26]Article 6(1) UK GDPR provides that where a public authority is holding personal information as part of its general processing, such processing will be ‘lawful’ if and to the extent that at least one of six conditions applies. These conditions include (most relevantly for the present case):

‘(f) The processing is necessary for the purposes of legitimate interests pursued by…a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...’

[27]Lawful processing of personal data under Article 6(1)(f) UK GDPR requires application of the following three-part test South Lanarkshire Council v Scottish Information Commissioner [2013]UKSC 55at para. 18(which related to Schedule 2 Condition 6 of the Data Protection Act 1998, the precursor to Article 6(1)(f) UK GDPR) :(a) the legitimate interest test (whether a legitimate interest is being pursued in the request for information);

(b) the necessity test (whether confirming or denying that the requested information is held is necessary to meet the legitimate interest in question); and

(c) the balancing test (whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject).

Role of the Tribunal

[28]Under section 57 FOIA, the requester or the public authority is entitled to appeal to this Tribunal.

[29]Under section 58 FOIA, the Tribunal:(a) must determine whether the Decision Notice is not in accordance with the law or, to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently; and

(b) may make its own findings of fact.

Evidence

[30]The Tribunal was provided with an Open Bundle of 105 pages (including indexes) comprising pleadings, correspondence, and supporting material.

[31]The bundle includes:(a) the Decision Notice dated 5 November 2025;

(b) SY’s Notice of Appeal dated 1 December 2025;

(d) SY’s Reply dated 28 December 2025; and

(e) background materials including correspondence relating to the request and publicly available information referred to by the parties.

[32]The Tribunal considered all materials contained within the bundle. Submissions Summary of submissions on behalf of the Commissioner

Submissions

[33]The Commissioner’s position, in summary, is that:(a) the reasoning of the DN was correct in law;

(b) SY's claim of a "contradiction" (accepting there is a legitimate interest but nevertheless relying on a NCND response) is rejected;

(c) government statements indicate a consistent policy of not commenting on individual citizenship cases and thus the data subject in this case would not reasonably expect the Home Office to confirm or deny such matters;

(d) even though the data subject in this case is a public figure, she retains a reasonable expectation of privacy;

(e) confirming or denying would intrude upon private citizenship status and would likely cause distress, which would not be mitigated by the individual's public role;

(f) while there is public interest in the events in Syria and the individual's role there, that does not translate into a strong interest in confirming or denying whether the Home Office holds the requested information nor would it add much public understanding to those wider issues;

(g) SY's reliance on the finding that confirming or denying was "necessary" to meet that public interest was misplaced: that relates only to the second limb of Article 6(1)(f) not the third limb (balancing of interests) which remains decisive and was properly applied;

(h) accordingly, SY's arguments amount to no more than a disagreement with the respective weight the Commissioner attributed to the competing factors, concluding that the individual (despite her public profile) retains a reasonable expectation of privacy in her citizenship status; and

(i) additionally, the individual would be caused an unjustified intrusion even by confirming or denying whether the information is held; the asserted public interest is insufficiently connected to the information sought and therefore disclosure (even by confirming or denying whether the information is held) would be unfair and unlawful under Article 5(1)(a) UK GDPR so section 40(5B) FOIA is properly engaged.

Summary of SY’s submissions in reply to the Commissioner's response

[34]SY submits that:(a) there is a strong public interest in transparency concerning the actions of government, particularly in relation to citizenship and the exercise of executive powers;

(b) the Home Office and the Commissioner failed properly to give weight to that legitimate public interest;

(c) the Commissioner has accepted at face value the Home Office's rejection of commenting on individual cases of citizenship when in fact both the Foreign Secretary David Lammy MP on 9 December 2024 in Parliament and the Prime Minister Sir Keir Starmer on 9 December 2024 to journalists have commented on this individual case;

(d) it is thus reasonable to conclude that the data subject is someone who is (or whose actions are) not conducive to the public good, and that her expectation of privacy and data protection are lowered accordingly: these factors were not properly considered in the balancing test the Commissioner applied;

(e) contrary to its assertion, the Home Office has in fact revealed similar information on some occasions e.g. when stripping people accused of supporting terrorism of their UK citizenship status;

(f) the Commissioner has mischaracterised the wider public interest as "what happened in Syria" rather than the Home Secretary's exercise of his power under section 40 of the British Nationality Act 1981 to deprive a person of their UK citizenship if satisfied this would be "conducive to the public good";

(g) the British public has the right to know why successive Home Secretaries have not (so far) exercised such power in this case, despite all the evidence and high-profile calls to do so when the same power has been exercised in 1,500 citizenship deprivation orders between 2010 and 2024; and

(h) the attribution of "distress" to the data subject by loss of her privacy by confirming or denying whether the requested information is held is speculative and far-fetched: if her citizenship has been considered and stripped, she will already know and be "distressed" by that, or if it has not, there would be no reason for her to be distressed. Discussion and decision The point at issue in this case

Discussion and decision

[35]As the appellant, it is for SY to satisfy the Tribunal Forstater v Information Commissioner & Ministry of Justice & Judicial College

[2023] UKUT 303

at paras. 37-38 that the DN is wrong either in law or in the Commissioner's exercise of his discretion.

[36]SY's complaint is essentially that the Commissioner ought not to have concluded that interference with the data subject's fundamental rights and freedoms outweighs the legitimate interest in confirming or denying that the information is held.

[37]The Tribunal considers the issue for decision is whether the Commissioner correctly concluded that, under Article 6(1)(f) UK GDPR, the data subject's privacy rights outweigh the legitimate public interest in confirming or denying whether the requested information is held.

The facts

[38]The Tribunal first considered the facts of this case. Based on all the evidence provided, the Tribunal made the following findings of fact on the balance of probabilities:(a) no information was provided in response to SY's request but instead the Home Office gave a NCND reply;

(b) confirming or denying that the requested information is held would itself disclose third party personal data because the request names the data subject and any such response would reveal information about her;

(c) there is a legitimate interest in confirming or denying whether the requested information is held to help the public understand how powers relating to citizenship are exercised; and

(d) confirming or denying that the requested information is held would contribute to that legitimate interest.

The principles applicable to NCND responses to requests for personal data

[39]The Tribunal next considered the Commissioner's guidance on the relevant principles where the public authority gives a NCND response to a request for third party personal information.

[40]In contrast to a standard refusal (where the authority confirms that it holds the personal data but refuses to disclose it because the content would contravene data protection principles), a NCND response:(a) precedes consideration of disclosure of the content of any information which may fall within the scope of the request;

(b) focuses on the implications of confirming or denying the existence of information held i.e. would confirming or denying whether the information is held itself contravene data protection principles;

(d) prevents any inference about whether the information exists; and

(e) may be applied on a hypothetical basis irrespective of whether the information is in fact held; but nevertheless

(f) requires application of the same data protection analysis i.e. whether it would be lawful, fair and transparent to confirm or deny the holding (as opposed to the disclosure) of personal data; and

(g) requires application of the legitimate interest balancing test i.e. any legitimate interests pursued by the request must be balanced against the interests of the data subject.

Decision

[41]The Tribunal considers that:(a) while one step away from disclosing any information which may be held by the Home Office within the scope of the request, even confirming or denying whether the requested information is held would reveal personal information about the data subject, namely whether she had been subject to consideration by the Home Office;

(b) confirming or denying whether the information is held would therefore amount to disclosure of personal data to the world at large;

(c) while there is a strong public interest in matters relating to the data subject in this case because of her high public profile and background, it is important to distinguish matters relating to her private life from her public role;

(d) the fact that someone is a public figure or has a high public profile due to their past actions does not mean that they have no (or even a lowered) reasonable expectation of privacy in relation to their personal data;

(e) caselaw cited by SY in support of a "lowering" of an individual's expectation of privacy as a result of their actions in the context of media reporting Lord Browne v Associated Newspapers

[2008] QB 103

and Campbell v MGN Ltd

[2004] UKHL 22

is not readily applicable to the different legal context of confirming or denying under FOIA whether personal data is held; and

(f) while it would be transparent to require the Home Office to give a section 1(1)(a) FOIA response to the request, the question is whether it would also be lawful and fair to do so.

[42]While accepting - as do the Home Office and the Commissioner - that there is a legitimate public interest in the information requested in this case (and legitimate interest in confirmation or denial whether it is held), the Tribunal is satisfied that the Commissioner made neither an error of law nor a discretionary error such as to require interference with the DN because:(a) the Commissioner was entitled to find that there was a legitimate interest in confirming or denying whether the information is held as there is no less intrusive means of finding out the information; but

(b) the Commissioner was also entitled to find that the data subject's rights to privacy of personal data (in this case her citizenship status), despite her high public profile and background, outweighs that legitimate public interest.

[43]In balancing the legitimate interest in compliance with the duty to confirm or deny under section (1)(a) FOIA against the interests or fundamental rights and freedoms of the data subject, the Tribunal also takes into account that a requirement to confirm or deny in this case may give rise to the possible inference of such a requirement in similar cases in the future. This could undermine the protections that UK GDPR are designed to provide.

[44]The Tribunal concludes that in this case it would be neither lawful nor fair to confirm or deny under section 1(1)(a) whether the information is held.

[45]In the absence of any additional legitimate interest factor(s) of which the Commissioner was either unaware or demonstrably failed to take into account, SY's evidence and submissions have not satisfied the Tribunal that the DN is not in accordance with the law nor, to the extent that it involved an exercise of discretion by the Commissioner, that such discretion ought to have been exercised differently.

[46]The appeal is dismissed. No further steps are required. Signed: Judge A. Marks CBE, First-tier Tribunal Judge Dated: 11 June 2026