Dr Lucy Catherine Hawking v The Nursing and Midwifery Council & Anor [2026] UKFTT 980 (GRC)

[2026] UKFTT 00980 (GRC)Case Reference: FT/EA/2024/0359
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on: 21 &22 April 2026Date 01 July 2026
Information Rights
Heard by Cloud Video Platform
Before
JUDGE SAWARDJUDGE ARMSTRONG-HOLMESTRIBUNAL MEMBER YATES
Between
DR. CATHERINE LUCY HAWKINGAppellantINFORMATION COMMISSIONERRespondentNURSING AND MIDWIFERY COUNCILRespondentProfessor Mark Engelman, Counsel for Appellant for First Respondent: Did not appear for Second Respondent: John Fitzsimons, CounselDecision: The appeal is allowed in part.Substituted Decision Notice: IC-305066-P7N8The following text is added to paragraph 2. of the Decision:“In addition, the NMC breached section 17(7) of FOIA as its refusal notice failed to contain particulars of the applicant’s right conferred by section 50 of FOIA to apply to the Commissioner for a decision whether, in any specified respect, a request for information made by the complainant to a public authority has been dealt with in accordance with the requirements of Part I of FOIA.”REASONS

Introduction

[1]The Freedom of Information Act 2000 (“FOIA”) provides for a general right of access to information held by public authorities. That right is subject to exceptions and exemptions. It is enforced by the Information Commissioner (“the Commissioner”) with a right of appeal from a decision of the Commissioner to this Tribunal.[2]There are two outstanding appeals brought by the Appellant against separate decisions of the Commissioner. Both concern requests for information made to the Nursing and Midwifery Council (“the NMC”), being the regulator for nursing and midwifery professions in the UK. The appeals were heard together. The appeal bearing Tribunal reference FT/EA/2025/0091 is subject to a separate decision. A third appeal involving the same parties was settled before reaching hearing. A separate application brought by Dr. Hawking seeking certification of contempt by the NMC in relation to both appeals (ending 0359 and 0091) is also subject to a separate decision.[3]This appeal is made against the Commissioner’s decision referenced IC-305066-P7N8 of 9 August 2024. In that decision, the Commissioner decided that the NMC should have neither confirmed nor denied (“NCND”) it held the requested information. The NMC was not required to take any steps.[4]This Decision provides a summary of the submissions, evidence and the Tribunal’s view of the law. It does not seek to capture every point made, it being impractical and unnecessary to do so. The absence of any specific submission or evidence does not mean it has not been considered.

Background

[5]The Appellant has provided personal background information to provide context and explain why the requested information is sought. It is unnecessary for that personal information to be recorded in this published Decision.

The Hearing

[6]The hearing was conducted by online video (CVP). The Tribunal was satisfied this was a fair and just way to conduct the proceedings.[7]The Appellant attended and was represented by Professor Mark Engelman, Counsel.[8]The Second Respondent, the NMC, was represented by John Fitzsimons, Counsel. The Commissioner was not represented having indicated in advance that he intended instead to rely upon his Decision Notice and written submissions. In place of a skeleton argument, the Commissioner provided further submissions regarding his exercise of discretion to apply section 40(5B) FOIA.[9]The hearing took the form of submissions from each advocate with questions from the Tribunal panel.[10]The documents before the Tribunal comprise an open bundle of some 327 pages, an Authorities bundle, skeleton arguments for the Appellant and NMC, and the Commissioner’s submissions (as mentioned above).

Procedural Matters

[11]A costs application had been submitted by Dr. Hawking against the NMC. For time management reasons, the costs application was heard on day 2 (i.e. on 22 April 2026). At the hearing, Professor Engelman said that the costs application dated 3 April 2026 (and re-submitted with amendments on 8 April 2026) related to both appeals (0359 and 0091) plus the application for certification of a contempt. During the hearing, Dr. Hawking withdrew the costs application insofar as it related to the appeals. The Tribunal consented to the withdrawal which took effect pursuant to Rule 17 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.

The Request

[12]On 27 February 2024, the Appellant made the following request to NMC:
“[REDACTED], later [REDACTED] later [REDACTED]. I would like to know whether this nurse was struck off the register for misconduct under the ENB or UKCC.”
[13]The “ENB” is the abbreviation for the English National Board for Nursing, which regulated the training and education for nurses, midwives and health visitors between 1980 and 2002. The “UKCC” is the United Kingdom Central Council for Nursing, Midwifery and Health Visiting, which was the regulatory body for professional conduct of those named professions between 1983 to 2002. Both bodies were replaced by the NMC.

The Response

[14]On 6 March 2024, the NMC replied to the Request by advising that it may hold the requested information but cannot release it as it is exempt from disclosure under section 40(2) FOIA (personal information).

Decision Notice

[15]The Appellant complained to the Commissioner on 13 April 2024 about the way her Request had been handled. By decision dated 9 August 2024, the Commissioner found that the NMC should have neither confirmed nor denied that it held the requested information under section 40(5B) of FOIA. The NMC had therefore breached the procedural step in section 17(1) FOIA to issue a correct refusal notice within 20 working days. The Commissioner decided that it was unnecessary to require the NMC to take any corrective steps.[16]In reaching his decision, the Commissioner noted that the requested information concerned whether a named nurse had been struck off the register for misconduct. The Commissioner was satisfied that confirming or denying whether the requested information was held would disclose personal data of that individual, as the data subject. The person could be identified as they are named in the Request, and the requested information relates to them. Confirming or denying that the information was held could indicate whether or not the person was struck off the NMC register.[17]The Commissioner referred to having issued “numerous decision notices setting out the correct response from a public authority faced with such a request and explaining why they should not confirm or deny that information is held.” Based on the available evidence, the Commissioner was satisfied that “there would be no lawful basis in data protection law for the NMC to confirm, to the world at large, whether a particular (identifiable) nurse had been removed from its register.”[18]The Commissioner noted that the NMC had advised the requester that it has an online register which can be searched by a nurse’s name or PIN number.

Grounds of Appeal

[19]In essence, the grounds of appeal are:- 19.1. The Appellant raised 3 bases of complaint to the NMC under sections 17(1) and 17(7) of FOIA and the Information Commissioner’s Office Code of Practice. Whilst the Commissioner found a breach of section 17 FOIA, he did so on a basis neither raised by the Appellant nor on the facts. The NMC had admitted to possessing both an electronic and paper data base of registrants. 19.2. Had the Commissioner considered the Appellant’s bases, he would have identified that the NMC register is mandated by statute to be made “available to the public at all reasonable times” pursuant to Article 8 of The Nursing and Midwifery Order 2001 (“the 2001 Order”). 19.3. The Commissioner entirely failed to deal with the Appellant’s actual grounds of complaint under section 17(1) FOIA. If he had, he would have found that no statutory exemption exists because:(a) the registrants had consented by Article 8 of the 2001 Order to be rendered identifiable from any personal data on the NMC register.(b) no exemption applied to the NMC’s identification of section 40(2) FOIA(c) NMC’s identification of section 40(2) FOIA lacked any/all specification for the purpose of compliance with section 17(1). 19.4. The Commissioner entirely failed to address the Appellant’s complaint concerning NMC’s breach of the Code concerning her request for internal review by failing to (i) acknowledge receipt of it or within 20 days (ii) provide a target date (iii) conduct it at all (iv) provide information (v) a record of it (vi) or advise the Appellant of her right of appeal.

The Commissioner’s Response

[20]The Commissioner resists the appeal. In summary: 20.1. The Commissioner notes that the Appellant does not appear to dispute that the requested information is personal data or that confirmation or denial would reveal personal data relating to the data subject. 20.2. Article 6(1) UK GDPR states that “Processing shall be lawful only if and to the extent that at least one of the following [conditions] applies.” 20.3. Article 6(1)(a) UK GDPR renders processing lawful if “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. There is no evidence that the data subject gave their consent for disclosure of the requested information to the world at large, at the time of the Request. The very fact the Appellant needed to request the information under FOIA, makes clear that the information was not publicly available on the register. 20.4. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA, it is necessary to consider a three-part test:- i) Legitimate interest test: Whether a legitimate interest is being pursued by the request for information; ii) Necessity test: Whether disclosure of the information is necessary to meet the legitimate interest in question; and iii) Balancing test: Whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject. 20.5. This is consistent with Goldsmith International Business School v Information Commissioner and Home Office[2014] UKUT 563 (AAC) at [35]-[42] (reiterating the Supreme Court’s approach in South Lanarkshire Council v The Scottish Information Commissionerat [18]), Glenda Rodriguez-Noza v Information Commissioner and Nursing and Midwifery Council(GIA/0433/2014), and Information Commissioner v Colleen Foster and Nursing and Midwifery Council(GIA/1626/2014) at [19], [23]-[24], [27]). 20.6. The Commissioner accepts that the Appellant has a legitimate interest in the requested information. He also accepts that disclosure is necessary as the information does not appear to be publicly available on the register. 20.7. The Commissioner maintains that the Appellant’s legitimate interest is outweighed by the data subject’s right to privacy for the reasons given in his Decision Notice. 20.8. The Commissioner considers it to be clear from the NMC’s website that information pertaining to fitness to practice is not recorded on the register in perpetuity. 20.9. The Commissioner acknowledges the NMC’s argument on internal review that individuals would not expect their data to be published upon request given that FOIA is distinct from the NMC’s publication processes. 20.10. A person who formerly practiced as a nurse could no longer be on the register for a number of reasons and would not expect their personal data to be released under FOIA. It appears that only the current register is publicly available, not information that is no longer recorded in it. 20.11. Article 6(1)(c) UK GDPR does not apply as the processing in question is disclosure under FOIA and not a disclosure pursuant to any other legal obligation. 20.12. It was clear that section 40(3A)(a) FOIA was the applicable condition referred to by NMC in reliance upon section 40(2) FOIA. NMC provided further explanation in its internal review. Such matters were overtaken by the Commissioner’s finding that the NMC should have neither confirmed nor denied holding the requested information. 20.13. The Commissioner’s Code of Practice is not binding on public authorities. Internal reviews are not a statutory requirement for compliance with Part 1 of FOIA (Montague v ICO & DIT [2022] UKUT 104 (AAC)).

Appellant’s Reply

[21]The Appellant provided a witness statement in reply addressing all three of her FOIA requests to NMC.[22]It is submitted that a nurse consents to the publication of their striking off the register. To support this stance, the Appellant produces extracts of the NMC “Guidance on Publication of Fitness to Practise and Registration Appeal Outcomes, (“the Fitness to Practice Guidance”) and the NMC Registration and Revalidation Information Handling Guidance, (“the Information Handling Guidance”).

Legal Framework

[23]Section 1(1) FOIA provides: “Any person making a request for information to a public authority is entitled-(a) To be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) If that is the case, to have that information communicated to him.[24]By section 1(4) FOIA "information" in section 1(1) is "the information in question held at the time when the request is received, ...", in this case on 7 February 2024.[25]Importantly, section 1(1) FOIA does not provide an unconditional right to be told whether or not a public authority holds any information. Nor does it provide an unconditional right of access to any information which a public authority does hold. The rights within section 1(1) are subject to certain other provisions of FOIA. They include section 2(1), which provides: “Where any provision of Part II states that the duty to confirm or deny does not arise in relation to any information, the effect of the provision is that where either—(a) the provision confers absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether the public authority holds the information, section 1(1)(a) does not apply.”.[26]The effect of the above is that some exclusions of the duty to confirm or deny, which are set out in Part II of FOIA, are absolute and some are subject to the public interest test. Section 2(3) of FOIA lists those that are absolute. In this case, the Commissioner relies upon section 40(5B) FOIA. As section 40(5B) is not included in that list, it is a qualified exclusion to which the public interest test applies, even if the section is engaged.[27]Insofar as relevant to this appeal, section 40(5B) FOIA provides: “The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies— (a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)— (i) would (apart from this Act) contravene any of the data protection principles…”.[28]Section 40(7) FOIA provides definitions for the purposes of section 40 with reference to the Data Protection Act 2018 (“DPA”) and the UK GDPR. In particular:• section 3(2) DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) DPA) and thus includes disclosure under FOIA.• the “data protection principles” are those set out in Article 5(1) of the UK GDPR, and section 34(1) DPA. The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”.• a “data subject” is defined in section 3 DPA to mean “the identified or identifiable living individual to whom personal data relates”.• The “processing” of information relating to a data subject includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) DPA). It therefore includes disclosure under FOIA.[29]“Processing” is only lawful if and to the extent that it meets at least one of the six conditions set out within Article 6(1) UK GDPR. Insofar as relevant to the issues raised in this appeal, they include: (a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (f). processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”[30]Article 6(1) proceeds to disapply the legitimate interests gateway in relation to public authorities in the performance of their tasks in respect of point (f) above. However, section 40(8) FOIA explicitly provides that Article 6(1) should be read as though this provision were omitted for the purposes of section 40 and the lawfulness principle in Article 5(1)(a). This means that the legitimate interests basis (see below) is applicable when considering the first data protection principle in Article 5(1)(a) UK GDPR.[31]The Supreme Court considered the proper interpretation and application of Article 6(1)(f) of the UK GDPR in South Lanarkshire Council v The Scottish Information Commissioner [2013] UKSC 55. Lady Hale identified that this condition for the lawful processing of personal data required three questions to be answered:(i) Is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (Legitimate interests test).(ii) Is the processing involved necessary for the purposes of those interests? (Necessity test).(iii) Is the processing unwarranted in this case by reasons of prejudice to the rights and freedoms or legitimate interests of the data subject? (Balancing test).[32]The wording of question (iii) is taken from the Data Protection Act 1998, now superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR so that the third question should be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last question specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[33]The Upper Tribunal endorsed the approach taken in South Lanarkshire Council in the subsequent case of Goldsmith International Business School v Information Commissioner & Home Office [2014] UKUT 0563 (AAC), and set out eight ‘propositions’ derived from case law: Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three questions to be asked, as per the three questions identified by Lady Hale in South Lanarkshire. Proposition 2: The test of “necessity” under stage (ii) must be met before the balancing test under stage (iii) is applied. Proposition 3: “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity. Proposition 4: Accordingly, the test is one of “reasonable necessity”, reflecting the European jurisprudence on proportionality, although this may not add much to the ordinary English meaning of the term. Proposition 5: The test of reasonable necessity itself involves the consideration of alternative measures, and so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question. Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part test. Proposition 7: Where Article 8 privacy rights are in issue, the question posed under Proposition 1 can only be resolved after considering the excessive interference question posted by stage (iii). Proposition 8: The Supreme Court in South Lanarkshire did not purport to suggest a test which is any different to that adopted by the Information Tribunal in Corporate Officer (Information Tribunal).[34]We emphasise that the ‘legitimate interests test’ differs from the ‘public interest test’. As explained by Upper Tribunal Judge Wikeley(albeit in the context of section 40(2))inCox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.””
[35]Other relevant principles are Recital (1) to the UK GDPR, which provides:
“The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.”
[36]Recital (2) to the UK GDPR also includes the following:
“The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.”

Public Interest Test

[37]The balancing of public interest is on the basis of how matters stood at the time of the public authority’s response to a request under FOIA (Montague v the Information Commissioner and the Department for International Trade [2022] UKUT 104 (AAC)).

Role of the Tribunal

[38]The role of the Tribunal is governed by section 58 FOIA. This requires the Tribunal to consider whether the Commissioner’s Decision Notice is in accordance with the law, or, where the Commissioner’s decision involved an exercise of discretion, whether he should have exercised it differently. The Tribunal may review any finding of fact on which the Decision Notice was based (section 58(2)). This means that we may review all the evidence provided to us (even if that evidence was not before the Commissioner) and make our own decision on the merits.[39]The Appellant refers to the Information Commissioner v Bell [2014] UKUT 106 (AAC), where at paragraph [22], the Upper Tribunal said:
“What is the nature of the appeal? The tribunal undertakes a complete reconsideration of the issues before the Commissioner. It is not limited to the evidence or submissions considered by the Commissioner. Nor is it bound by his findings of fact or the way he has exercised a discretion. In the convenient phrase that is often used to describe the role of the First-tier Tribunal, it stands in the shoes of the decision-maker.”
[40]The Upper Tribunal in NHS England v Information Commissioner and Dean [2019] UKUT 145 (ACC) reiterated that "The First-tier Tribunal ‘exercises a full merits appellate jurisdiction and so stands in the shoes of the IC and decides which (if any) exemptions apply...".[41]It does not mean that we can consider matters falling outside the scope of the Request.

Main Issues

[42]The main issue for the Tribunal to determine is whether section 40(5B) FOIA is engaged. That turns on:• Whether confirming or denying that the requested information was held would constitute the disclosure of someone’s personal data;• If so, whether confirming or denying that the requested information was held would contravene any of the data protection principles. This includes consideration of whether the nurse in question consented to publication of the requested information.• If so, whether (in all the circumstances) the public interest in maintaining the exclusion of the duty to inform pursuant to section 1(1)(a) FOIA, outweighs the public interest in disclosing whether or not the NMC holds the requested information.[43]These were agreed by the advocates as the main issues at the start of the hearing albeit Professor Engelman wished to raise other matters on behalf of the Appellant. Evidence and submissions

Appellant’s submissions

[44]The Appellant submits that the Commissioner erred by failing to adequately address her complaints concerning section 17(1) and the failure by NMC to identify which precise sub-section of section 40(2) FOIA applied. There are eight sub-sections. The duty under section 1(1) FOIA was to admit or deny possession of the requested information, not whether it ‘may’ hold the information.[45]The Commissioner also failed to grasp why section 40(5B) FOIA cannot apply. Five reasons are given, but two are a duplication.[46]The first reason given is that the NMC had admitted to holding the requested information when it replied to the request on 6 March 2024. At the hearing Professor Engelman advanced the argument that when NMC said “we may hold the information” it was making a statement of fact, which was “an admission of the probability of holding it”. The NMC then made a statement of fact, and also a statement of law, when it said:
“we are unable to release this to you as it is exempt under section 40(2) of the FOI Act”
. Professor Engelman asserted that when these two alternative and contradictory statements of fact are put together “it’s lying”.[47]The second reason given for why section 40(5B) cannot apply is the NMC’s election and reliance upon section 40(2). The Appellant submits that it is immediately clear that section 40(2) is not an absolute exemption as NMC claimed. NMC breached section 17(1)(c) as it was not apparent if, or why, the exemption applied. The failure by the Commissioner to address section 17 triggered section 10 of the Tribunals and Inquiries Act 1992 (which applies to the Commissioner by virtue of Schedule 1, Part 1, Article 14(a)). Section 10 required the Commissioner to give reasons for failure to dispose of the grounds of appeal on section 17(1).[48]It is further argued that the NMC is bound by its decision on section 40(2) FOIA. The Commissioner could not cure the serious legal/procedural error and permit the NMC to substitute section 40(5B) for section 40(2). It was estopped from doing so.[49]The third reason the Appellant says that section 40(5B) cannot apply is because the nurse consented to disclosure. The Decision Notice fails to explain or provide any analysis as to which of the four subsections within section 40(5B) applies. Assuming the Commissioner meant section 40(5B)(a)(i) and a contravention of the Data Protection principles, to which Article 5(1)(a) applies, it is to be read subject to Article 6(a). This defines lawful processing and purposes as including consent by the data subject to the processing of his or her personal data.[50]The Fitness to Practice Guidance provides that where a fitness to practise order has been made, the registrant continues to appear on the Register with their status updated. It also states that records of sanctions may be disclosed to employers and other enquirers where it is in the public interest to do so.[51]The fourth ground for maintaining that section 40(5B) does not apply relies upon the “enormous publicity” associated with the individual concerned, which is said to amount to significant public interest in disclosure even absent consent. The Commissioner’s website identifies that a suspicion or wrongdoing suffices for these purposes. A series of press articles are attached to the Appellant’s witness statement.[52]It is pointed out that section 40(5B) is not an absolute exemption but a qualified one.[53]It is further submitted that the Commissioner breached Article 6 ECHR and the Appellant’s right to a fair hearing by relying on an argument not raised by a party. Also, by failing to allow the Appellant opportunity to reply or make submissions before reaching a conclusion on different grounds from those relied upon by NMC.

NMC’s submissions

[54]The NMC adopts and agrees the Commissioner’s written submissions and the question of exercise of discretion under section 40(5B) FOIA. The NMC is clear that release of such personal data, if held, would not be lawful, fair and transparent within the meaning of Article 5(1) UK GDPR.[55]The NMC accepts that the Appellant has a legitimate interest in the requested information, and that disclosure is necessary as the information does not appear publicly. However, NMC says that this legitimate interest is outweighed by the data subject’s right to privacy for the reasons articulated in the Decision Notice.[56]During the hearing, Mr Fitzsimon added that it is wrong as a matter of fact that the NMC had acknowledged that the information was held. When the NMC said “it may hold” the requested information, it was equivocal. The language used may be inelegant or unhelpful, but it did not express a probability or likelihood of the information being held. It was saying it may, or may not, be held. In effect, it was the same as NCND.[57]The NMC says the doctrine of estoppel does not apply in the statutory scheme. The better authority is Ingle. Even if estoppel did apply, ‘detriment’ is important. That is the same question of whether there was consent or lawful basis and legitimate interest.[58]Through no malice of NMC, the reality of FOI is that mistakes will be made. The NMC is entitled to rely on the Decision Notice as the way forward.[59]With reference to Article 7 UK GDPR, there is a high threshold for consent by a data subject. The submissions do not come close to that bar. There is no way an employment contract, or guidance somewhere on a website, gives consent to personal information being processed by way of this type of disclosure.[60]NMC accepts that the Appellant has a legitimate interest in the information sought as research for her writing. The ‘necessity test’ is also met as there is no other way to get the information. The ‘balancing test’ comes down to the factors identified by the Commissioner (at paragraphs 26 to 30 of his Response). The most important point is that information on the register is not held in perpetuity. The NMC’s Publication Guidance is that the live register shows individuals struck off in the last 5 years only.[61]It is acknowledged that the Commissioner’s reference (at paragraph 27 of his Response) to NMC’s internal review, conflates this appeal with another (0091). However, it is correct that an individual would not expect their data to be published in this way. It is a question of the reasonable expectation of a nurse at the time that preceded the NMC Guidance of today.[62]NMC takes its position seriously. The safety of the public is important. There is also a duty of care to the thousands of nurses who are, or have been, on its register. NMC should have relied upon section 40(5B) FOI.

Commissioner’s submissions

[63]Whilst the Commissioner did not attend the hearing, he provided written submissions in place of a skeleton argument regarding the exercise of his discretion to apply section 40(5B) FOIA.[64]The point is made that it is for the Commissioner to consider the scope of his investigation. It is his discretion. Once the Commissioner was satisfied that an exemption in section 40(5B) was engaged, and the public interest favoured NCND, he was not required to consider the alternative or other exemptions (Information Commissioner v Malnick & ACOBA [2018] UKUT 72 (AAC), paragraphs [77] to [79].[65]The then Information Tribunal said in Bowbrick v Information Commissioner & Nottingham City Council EA/2005/0006 that the Commissioner was entitled to consider exemptions not referred to by the public authority in appropriate cases. Findings and Discussion

Preliminary matters

[66]The NMC readily conceded at the hearing that it had not conducted an internal review. Thus, the Decision Notice is wrong at paragraph 5 to refer to an internal review by the NMC on 28 March 2024, as are references to the internal review in the Commissioner’s response. It was the Appellant’s FOIA request in appeal 0091 where an internal review was conducted. This error has no significance in our consideration of the substantive issues. There is no statutory requirement for an internal review before the Commissioner can issue a Decision Notice. Indeed, the Commissioner can choose to reach a decision before an internal review in any event.[67]In determining whether the Commissioner’s Decision Notice was in accordance with the law, our primary consideration is whether section 40(5B)(a)(i) is engaged.

Was section 40(5B) of FOIA engaged?

[68]To recap, if section 40(5B)(a)(i) FOIA is engaged the duty to confirm or deny does not arise in relation to information, and it is exempt from disclosure. To be exempt, giving a member of the public the confirmation or denial would need to contravene any of the data protection principles. The ‘data protection principles’ are those in Article 5(1) UK GDPR and section 34(1) of the Act.[69]The Appellant maintains that the section 40(5B)(a)(i) exemption cannot apply for various reasons. We address two of those preclusion arguments at the outset. Other arguments raised fall for consideration in the context of Article 6(1) or ‘other matters’.

Whether NMC admitted to holding the requested information

[70]We start with the Appellant’s argument that section 40(5B) FOIA cannot apply because the NMC admitted to holding the requested information. This argument is somewhat confused. On the one hand, the Appellant contends that the NMC failed in its duty under section 1(1) FOIA to confirm whether it held the requested information, as the duty is not whether it “may” hold the information. On the other hand, it is argued that the Appellant “admitted to holding” the requested information.[71]The contested point stems from the NMC’s refusal notice to the Request dated 6 March 2024, which said:
“I can advise that we may [emphasis added] hold the information request however, we are unable to release this to you as it is exempt under section 40(2) of the FOI Act (personal information). This exemption is what is known as an ‘absolute’ exemption and is not subject to a public interest test. If information is classed as personal information, we canconsider withholding it.”
[72]By saying that “we may hold the information” the NMC did not say that the NMC did hold the information. The word “may” acknowledges the possibility that the requested information is held. Nothing more. On any reasonable reading, it was not an admission.[73]We find as a matter of fact that NMC did not admit to holding the requested information. Our finding is not altered by the fact that the NMC then cited an exemption within FOIA. The reference informed the requester of the exemption the NMC considered was applicable if the information was held. The response was clumsy, but the accusation that the NMC had lied in its response is unfounded.[74]Even if the NMC had inadvertently confirmed holding the information, the data protection principles could still be breached. It would not prevent the Commissioner from finding that section 40(5B)(a)(i) was engaged.

Estoppel – reliance on section 40(2) FOIA

[75]The NMC no longer seeks to rely upon the section 40(2) exemption. Instead, it adopts the position taken by the Commissioner. The Appellant challenges both NMC and the Commissioner’s lawful ability to depart from section 40(2) FOIA.[76]Estoppel is raised by the Appellant along the lines that the NMC is bound by its decisions which cannot be substituted by those of the Commissioner. As the NMC sought to rely on section 40(2) FOIA, the Commissioner it is argued, cannot substitute another ground. This is also given as a reason why section 40(5B) cannot apply.[77]The Tribunal invited the advocates’ comments on the very recent Upper Tribunal decision in United Kingdom Research & Innovation v The Information Commissioner and Reuben Kirkham (“UKRI”) [2026] UKUT 146 (AAC). The Tribunal clerk circulated the judgment to the advocates and time was given to digest the content. At paragraph [52], the Upper Tribunal held that an argument that the public authority was estopped from relying on an exemption was misconceived for two reasons:a. estoppel is a common law doctrine, while FOIA is a statutory scheme, and as the Upper Tribunal held in Ingle v The Information Commissioner & Cambridgeshire County Council [2023] UKUT 80 (AAC) (“Ingle”) estoppel must “give way to the principles of a statutory scheme”, andb. the various exemptions under FOIA, where they apply, exempt a public[78]In Ingle, at paragraph [33],[79]Professor Engelman argued that statute does not “trump” common law. He sought to distinguish UKRI on the basis that it did not concern estoppel by representation. In UKRI estoppel was raised in the context of sections 36 and 41 FOIA where the public authority admitted holding the requested information. Professor Engelman argues that position is very different to the facts of this case where there is a contradiction in fact with the NMC saying: “I may have the information, I do not admit I have it”.[80]Professor Engelman went as far as suggesting that the Upper Tribunal decision in UKRI is per incuriam (i.e. “through lack of care”). When asked to clarify, he asserted that the reasons were wrong because the decision was made without the benefit of the legal argument heard by this Tribunal panel. He suggested that the same was true of the Upper Tribunal’s decision in Ingle.[81]The Tribunal finds the Appellant’s argument on ‘estoppel’ wholly misplaced. Paragraph [33] of Ingle is absolutely clear that the common law doctrine of estoppel isoverridden by the statutory scheme in FOIA. That is reinforced in UKRI. Those principles remain the same regardless of different exemptions being in issue in this case. As a First-tier Tribunal we are bound to follow decisions of the Upper Tribunal. The NMC, as the public authority, was not bound by the original exemption that it relied upon. Nor was the Commissioner constrained by the NMC’s ground of refusal.[82]Indeed, it is well established by the Upper Tribunal in Malnick that: “the tribunal must consider everything necessary to answer the core question whether the authority has complied with the law, and so includes consideration of exemptions not previously relied on but which come into focus because the exemption relied upon has fallen away.” [102][83]Thus, this Tribunal must consider exemptions that could apply. We are not limited in that task by the exemption relied upon by the NMC at the outset. Quite simply, the Commissioner was not estopped from relying on section 40(5B) and the Decision Notice was not wrong on that basis. Would confirming or denying that the requested information was held constitute the disclosure of someone’s personal data?

Personal data & “processing”

[84]Where information is requested under FOIA and that information contains the personal data of a data subject, then that personal data would be “processed” when it is disclosed in response to a request. In respect of the first data protection principle, this means that the information can only be disclosed if to do so would be lawful, fair and transparent (Article 5(1) UK GDPR).[85]The parties agree:(i) the requested information constitutes personal data of the nurse in question, who is the data subject and(ii) disclosure of the requested information would constitute “processing” of data for the purposes of the section 40 DPA and the UK GDPR. We agree.[86]Given that the nurse in question is named in the Request, we find that confirming or denying that the requested information was held would disclose personal data.

Conclusion on whether section 40(5B) is precluded

[87]Therefore, the application of section 40(5B) is not precluded in respect of the Request. That section is capable of being engaged. Whether confirming or denying that the requested information was held would contravene any of the data protection principles

Lawful Basis of Processing

[88]In assessing whether the processing of the personal data in question would be lawful, the most relevant lawful basis for processing (in the context of the Request and appeal) is:(i) data subject consent under Article 6(1)(a), and/or(ii) the legitimate interests basis under Article 6(1)(f). We consider each in turn.

Whether the data subject consented to disclosure – Article 6(1)(a)

[89]The Appellant makes the point that the NMC exists to provide a register of nurses and midwives, and there is a statutory requirement to publish that register (Article 8 of 2001 Order). The duty to establish and maintain a register of qualified nurses, midwives and nursing associates is contained within Article 5. Article 8(1) requires the register to be available for inspection by members of the public at all reasonable times. However, this Request does not concern information on the current register. It concerns historic information prior to the existence of the NMC and the 2001 Order.[90]The Appellant’s case is based upon what a nurse must expect if they are struck off the register, and that such expectation is “tantamount to consent”. We disagree.[91]Article 6(1)(a) must be read in the context of Article 7 UK GDPR. Under Article 7(2), if consent is given in the context of a written declaration which also concerns other matters, the consent must be clearly distinguishable from other matters, in an intelligible and easily accessible form using clear and plain language.[92]It is purely speculative that a nurse at the time would have consented to disclosure of certain information upon registering with the regulatory body and that such consent would be sufficient to include disclosure under FOIA many years later. There is no evidence before us of what was, or likely to have been, signed by the nurse at the time. Nor do we know whether there was any privacy notice, or the terms of registration, for instance. Consent would need to be clear, unambiguous and affirmative in agreeing to disclosure at the date of the NMC’s Response.[93]What we do know, is that a nurse now registered with the NMC would be subject to a policy whereby the specified publication period for a sanction of striking off the register is 5 years from the date the order takes force. This is set out at paragraph 30 of the ‘Fitness to Practice Guidance’. Therefore, even if the individual had given consent (which is not established), the period for disclosure under the current policy would be 5 years. This period has long expired.[94]We find that the evidence falls significantly short of demonstrating that, on the balance of probabilities, the individual consented to disclosure of the requested information. Accordingly, the condition in Article 6(1)(a) UK GDPR is not met for disclosure to be lawful by reason of the data subject’s consent.

Legitimate Interests Basis – Article 6(1)(f)

[95]In some circumstances, a NCND response is an exclusion from the general duty on a public authority to confirm whether or not it holds the information which has been requested. The aim of a NCND response is to leave it entirely open whether the public authority holds the requested information so that no inferences can be drawn either way, which might in itself be a disclosure of personal data. The ‘lawfulness, fairness and transparency principles’ also apply in cases such as this.[96]For the purposes of Article 6(1)(f), the Appellant is “a third party” and the individual who is the subject of the Request is the “data subject”. We proceed to apply the three-part test identified by Lady Hale in the South Lanarkshire Council judgment. In doing so, we bear in mind the eight ‘propositions’ endorsed by Upper Tribunal Judge Wikeley in Goldsmith.

Legitimate interest test

[97]The Tribunal agrees with the parties that the Appellant, as a third party, has a legitimate interest in the requested information for research purposes.

Necessity test

[98]We also agree with the parties that disclosure is necessary for the purposes of those legitimate interests given that the information does not appear publicly and it would not therefore be available through other means besides a FOIA request. We are satisfied that there is not another, or less intrusive way in which to achieve the outcome sought by the Appellant. The test of ‘necessity’ is met.

Balancing test

[99]Article 8 privacy rights are in issue as the Request seeks personal data regarding whether or not the named individual was struck off the register maintained by the regulatory body for misconduct. Consideration thus turns to the ‘balancing test’ and whether the above interests are overridden by the interests or fundamental rights and freedoms of the data subject.[100]Extracts from the NMC’s ‘Fitness to Practice Guidance’ and the ‘Information Handling Guidance’ are provided. These are the NMC’s current policies. They did not exist during the period that any requested information would relate.[101]An important point made by the Commissioner is that information pertaining to fitness to practice is not recorded by the NMC on the register in perpetuity. Indeed, in line with the NMC’s current policies as set out above, the specified publication period for a sanction of striking off the register is 5 years from the date the order takes force. A time limit long expired. It was suggested on behalf of the Appellant that policies were likely the same going back very many years, but that is unsubstantiated.[102]Things were quite different in the past before the existence of data protection regulation and when the 2001 Order was not yet in force with its provisions for publication of some decisions. There was not the same disclosure of information as exists now. Indeed, it is hard to imagine that a data subject would expect their data to be disclosed in the way that is now sought several decades later.[103]An individual who formerly practised as a nurse could no longer be on the register for a multitude of reasons. Information is no longer recorded on the register of an individual who was struck off more than 5 years ago.[104]In view of all these factors, we consider that, on balance, the legitimate interest and necessity for disclosure, is overridden by the data subject’s right to privacy. It follows that confirming or denying that the requested information was held would contravene the first data protection principle that personal data must be processed lawfully and fairly (Article 5(1) UK GDPR and section 35(1) of the Act). The condition in Article 6(1)(f) is not met.[105]It follows that section 40(5B) is engaged, subject to the public interest test.

Public Interest Test

[106]As section 40(5B) FOIA is not an absolute exclusion, but a qualified exemption from the duty to confirm or deny, the public interest test must be applied. The Tribunal must determine the public interest in NMC neither confirming nor denying whether it held the requested information. This involves considering whether in all the circumstances, the maintenance of the exclusion of the duty outweighs the public interest in disclosing whether the public authority holds the information.[107]The Tribunal must consider the public interest as matters stood at the time of the decision which the public authority was obliged to make by Part I of FOIA (as per paragraph 86 of Montague v Information Commissioner and DIT [2022] UKUT 104 (AAC)). As NMC refused the Request on 6 March 2024, that is the date the public interest must be assessed. However, the Tribunal may properly take into account circumstances or matters that come to light subsequently where they shed light on the public interest at the time it fell to be considered.[108]Section 2(2)(b) FOIA requires the Tribunal to conduct a balancing exercise weighing the factors in favour of maintaining the exemption against the public interest factors that favour disclosure. The Tribunal has undertaken this balancing exercise. We start by considering the values and policies that give the public interests their significance. In this regard, there will always be a general public interest in transparency. There may also be public interest about the issue and the person to whom the information relates given their connection to a person of global fame.[109]The Appellant draws attention to the Commissioner’s website which provides; “If there is a plausible suspicion of wrongdoing, this may create a public interest in disclosure. And even where this is not the case, there is a public interest in releasing information to provide a full picture.” Press articles provided by the Appellant indicate a high level of public interest in the information sought in the past. With the passage of time, such interest may well have diminished by the time the Request was refused.[110]Paragraph 5 of the NMC’s current ‘Fitness to Practice Guidance’ refers to duties under the NMC’s governing legislation and processes to disclose information at particular stages of its regulatory process. It refers to the general power under Article 22(10) of the 2001 Order “to disclose information relating to a registrant’s fitness to practise.”[111]Paragraph 16 states that the NMC keeps a record of all sanctions imposed by any practice committees, including striking-off. It also keeps a record of warnings and undertakings issued by Case Examiners. Paragraph 16 proceeds to say that these may be disclosed to employers and other enquirers on request where it is in the public interest to do so. The only exceptions are where the information relates to a registrant’s health, or where an interim order was imposed but the case subsequently closed without a finding of impairment. Paragraph 64 refers to the legal requirement to publish details of all sanctions imposed by the NMC’s Fitness to Practise Committees and unfavourable decisions following a registration appeal. For these reasons a registrant will not generally have the right to object to publication of such findings (paragraph 65).[112]The Appellant quotes paragraphs 22 and 27 of the NMC’s ‘Information Handling Guidance’. Paragraph 22 refers to information provided by a third party who the NMC has asked to assist with an investigation. It is not readily apparent how this is relevant in this instance. Paragraph 27 concerns the public register of qualified nurses, midwives and nursing associates on the NMC website. It says that the full name of each registrant and their recordable qualifications are published along with any ‘live’ fitness to practise sanction. Given that the individual in this Request is not in the published register, the Information Handling Guidance does not apply to them. It is of limited value in applying the public interest test.[113]Indeed, neither piece of Guidance was in place when the nurse in question was likely to have been practising. This factor further limits the weight that can be given to those policies in this appeal.[114]Weighed against confirming whether the information is held is that FOIA is, effectively, disclosure to the public i.e. to the ‘world at large’. That being so, appropriate consideration and weight is to be afforded in the application of the public interest test to the protection of the individual’s privacy rights. In this case, confirming whether the specific information sought was held or not would divulge personal information about an individual. Given the nature of the Request seeking information on whether the person was struck off the nursing register for misconduct, a response other than NCND would likely cause prejudice to the individual. Such prejudice would likely be of a serious nature. It would also carry a realistic prospect of being widely shared.[115]Having considered all the circumstances, the Tribunal finds on balance that the public interest in maintaining an individual’s rights to privacy, based on the legal principles we have referred to, outweighs those public interests. We view the principle of the protection of privacy with respect to the processing of personal data to be paramount.[116]For the reasons above, we find that the public interest in maintaining the exclusion of the duty to inform under section 1(1)(a) FOIA outweighs the public interest in disclosing whether the NMC holds the requested information.

Conclusion regarding section 40(5B)(a)(i) of FOIA

(a) (i) of FOIA

[117]We conclude that section 40(5B)(a)(i) of FOIA was engaged and that the public interest in maintaining the exclusion of the duty to confirm or deny outweighs the public interest in disclosing whether NMC holds the information. Accordingly, we find that the Commissioner was correct to find that the NMC could rely on section 40(5B) of FOIA to NCND that it held the requested information. It follows that we agree with the findings of the Commissioner in the Decision Notice in that regard.[118]Given that conclusion, it has not been necessary for us to consider the potential application of other exemptions under FOIA. Other Matters

Section 17 FOIA, the Commissioner’s Code of Practice & other matters

[119]The Appellant alleges a failure by the Commissioner to address section 17(1) which triggered section 10 of the Tribunals and Inquiries Act 1992 to give reasons. The Appellant is also critical of the Commissioner for failing to address procedural failings by the NMC and/or advise of the right to apply to the Commissioner under section 50 FOIA (in breach of section 17(7)).[120]In relying upon section 40(2) FOIA, the NMC did not specify whether subsection (a) or (b) was relied upon or which of the three following conditions was met for the exemption to be engaged. However, the NMC did also refer to data protection principles from which it could be gleaned that the first condition in section 40(3A)(a) was the provision meant. Section 40(2) FOIA is an absolute exemption where the first condition referred to in the subsection is met (section 2(3)(fa) FOIA).[121]As it is, the Commissioner’s Decision Notice did record a breach of section 17(1) FOIA by the NMC for failing to provide a correct refusal notice within 20 working days that confirms the exemption relied on and explains why the exemption applies. The Commissioner’s finding resulted from his conclusion that the NMC incorrectly cited section 40(2) instead of a NCND response under section 40(5B). Having reached the conclusion that section 40(5B) was engaged, there was no need for findings to be made on the NMC’s reliance on section 40(2).[122]Under section 17(7) FOIA the NMC’s refusal notice should have contained particulars of the right conferred by section 50 to complain to the Commissioner. The Commissioner was wrong to omit a finding of breach in this regard.[123]Section 46(1) FOI requires the Secretary of State to issue a code of practice providing guidance to relevant authorities as to the practice which it would, in his opinion, be desirable for them to follow in connection with the keeping, management and destruction of their records. The Commissioner’s Code of Practice is guidance only. It does not have the force of law. Whilst it is good practice for a public authority to undertake an internal review, there are no consequences for a failure to conduct one in terms of the lawfulness of the Decision Notice.[124]The Decision Notice incorrectly referred to an internal review. That error was unlikely to affect the outcome, which was based on different reasons from the NMC’s refusal. In any event, the Tribunal has stood in the shoes of the Commissioner and considered the Request afresh.[125]The point is taken that the Commissioner was imprecise in referring to the section 40(5B) exemption when there are subsections within that section. Given the arguments advanced on appeal, it was sufficiently understood that the Commissioner referred to section 40(5B)(a)(i).[126]We have considered other arguments made by the Appellant against the Commissioner’s handling of the complaint, but the conduct of the investigation was a matter for the Commissioner’s discretion. Similarly, procedural complaints are outside the scope of this decision.

Article 6 ECHR

[127]In refusing the Request, the NMC relied upon section 40(2) FOIA. When the Commissioner upheld the refusal on a different ground, he applied the right to NCND under section 40(5B) FOIA. In doing so, it is contended that the Commissioner was acting as a Judge under the Tribunals and Inquiries Act 1992. It is maintained that he breached the Appellant’s right to a fair hearing under Article 6 ECHR by failing to give her opportunity to reply or make submissions on whether the right to NCND existed.[128]Section 50 FOIA sets out the requirements in the consideration of a complaint made to the Commissioner and the issue of a decision. There was no requirement for the Commissioner when dealing with the Appellant’s complaint to seek submissions on whether another exemption might apply.[129]The right of appeal against the Commissioner’s decision lies to this Tribunal pursuant to section 57 FOIA. In exercising that right of appeal, the Appellant has had opportunity to advance her arguments and to be heard. As part of this appeal, the Appellant has made full submissions on the application of section 40(5B). The task of the Tribunal under section 58 is to establish whether the Decision Notice is in accordance with the law or if it involved the exercise of discretion whether such discretion ought to have been exercised differently. We find no basis to conclude that the Decision Notice was wrong on the grounds of alleged procedural irregularity.

Overall Conclusion

[130]For the reasons given, the Tribunal concludes that the Commissioner’s Decision Notice was in accordance with the law, and the Commissioner ought not to have exercised any discretion differently, with one limited exception.[131]The Decision Notice did not address the application of section 17(7) FOIA and the requirement for the NMC’s refusal notice to contain particulars of the right conferred by section 50 FOIA. It was therefore flawed in that regard. A substituted Decision Notice is issued to record an additional finding of breach of section 17(7) by the NMC for omitting particulars of the right in section 50.[132]To that limited extent only the appeal is allowed. The appeal is otherwise dismissed. Signed: Judge Saward Date: 25 June 2026

Cited in 2 later judgments