Spencer v The Information Commissioner and the Medicine and Health products Regulatory Agency: [2018] UKUT 349 (AAC) [2018] UKUT 349 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2018] UKUT 349 (AAC)Case No GIA/0236/2018, EA/2016/0283
Between
SpencerAppellantThe Information Commissioner and the Medicine and Health products Regulatory AgencyRespondent
Date 22 October 2018Category: Information rightsSubcategory: Information rights freedom of information qualified exemptions
[1]The Secretary of State has functions under the Medical Devices Regulations 2002 (SI No 618). Those functions are exercised by an executive agency of the Department of Health. In legislation, it is known as the Medicines and Healthcare Products Regulatory Agency: see for example the Medicines and Healthcare Products Regulatory Agency Trading Fund Order 2003 (SI No 1076). I have followed the practice of the Agency’s website by reducing the initial letter of Products to lower case and by referring to it as the MHRA rather than the MHPRA or even the MHpRA. B. A short history of the proceedings[2]Mr Spencer made a request under the Freedom of Information Act 2000 (FOIA) asking the MHRA for information about voluntary reports of adverse incidents involving medical devices. It supplied some of the information and the Information Commissioner ordered it to disclose more. Mr Spencer’s appeal to the First-tier Tribunal concerned the remaining information, which related to the date of the incident and to the model, manufacturer name, catalogue number, serial number, and lot or batch number of the devices involved. The tribunal dismissed the appeal, deciding that there was an absolute exemption prohibiting disclosure under section 44(1)(a) of FOIA. Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 2 C. Legislation FOIA[3]Section 44(1) of FOIA ensures that a request under FOIA cannot bypass prohibitions in other legislation: 44 Prohibitions on disclosure (1) Information is exempt information if its disclosure (otherwise than under this Act) by the public authority holding it— (a) is prohibited by or under any enactment, (b) is incompatible with any EU obligation, or (c) would constitute or be punishable as a contempt of court.

(i) Enterprise Act 2002

[4]Section 237 of this Act prohibits disclosure: 237 General restriction(1) This section applies to specified information which relates to— (a) the affairs of an individual; (b) any business of an undertaking.(2) Such information must not be disclosed— (a) during the lifetime of the individual, or (b) while the undertaking continues in existence, unless the disclosure is permitted under this Part.(3) But subsection (2) does not prevent the disclosure of any information if the information has on an earlier occasion been disclosed to the public in circumstances which do not contravene— (a) that subsection; (b) any other enactment or rule of law prohibiting or restricting the disclosure of the information. Section 238(1) defines ‘specified information’: 238 Information (1) Information is specified information if it comes to a public authority in connection with the exercise of any function it has under or by virtue of— … (b) an enactment specified in Schedule 14; … Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 3 The Consumer Protection Act 1987 is one of the enactments specified in Schedule 14.[5]So far, then, information cannot be disclosed under FOIA if it is held by a public authority to which it came in connection with the exercise of any function under the Consumer Protection Act 1987.[6]Mr Spencer also raised: 240 Community obligations This Part does not prohibit the disclosure of information held by a public authority to another person if the disclosure is required for the purpose of an EU obligation. Both section 237 and section 240 are in Part 9 of the Act. Consumer Protection Act 1987[7]Section 11 of this Act authorises the making of what it calls ‘safety regulations’: 11 Safety regulations. (1) The Secretary of State may by regulations under this section (‘safety regulations’) make such provision as he considers appropriate … for the purpose of securing— (a) that goods to which this section applies are safe; (b) that goods to which this section applies which are unsafe, or would be unsafe in the hands of persons of a particular description, are not made available to persons generally or, as the case may be, to persons of that description; and (c) that appropriate information is, and inappropriate information is not, provided in relation to goods to which this section applies.[8]The Medical Devices Regulations 2002 (SI No 618) were made in part under section 11. Regulation 61 provides that for the purposes of enforcement the Regulations are ‘safety regulations’ and ‘safety provision’: 61 Enforcement etc(1) Notwithstanding that they are made partly in exercise of powers other than those conferred by section 11 of the 1987 Act, these Regulations shall be regarded for all purposes relating to enforcement (whether by criminal proceedings, notices or otherwise) and for the purposes of section 38 of that Act (disclosure of information) as safety regulations as defined in that Act, and any provision of these Regulations made under those other powers shall be regarded for those purposes as a safety provision as defined in that Act.(2) Except as provided by paragraph (3), each weights and measures authority in Great Britain and each district council in Northern Ireland is Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 4 relieved of its duty imposed by section 27(1) of the 1987 Act in so far as it is exercisable in relation to relevant devices or devices for performance evaluation, and that duty is transferred to the Secretary of State.(3) Paragraph (2) does not relieve an authority or council of its duty in relation to devices which are consumer goods for the purposes of Part II of the 1987 Act, and accordingly but subject to paragraph (4), each weights and measures authority in Great Britain and each district council in Northern Ireland shall, concurrently with the Secretary of State, enforce these Regulations in relation to such devices.[9]So far, then, any function under the Regulations is within the scope of the 1987 Act and thereby the prohibition against disclosure.[10]One of those functions involves three European Directives. 65 Centralised systems of records etc The Secretary of State shall perform, as respects the United Kingdom, the functions of the Member State under article 8 of Directive 90/385, article 10 of Directive 93/42 and article 11(1) to (3) of Directive 98/79. Directives[11]The articles set out in section 65 provide: Article 8 of Directive 90/385[1]Member States shall take the necessary steps to ensure that information brought to their knowledge regarding the incidents mentioned below involving a device is recorded and evaluated in a centralized manner:(a) any deterioration in the characteristics and performances of a device, as well as any inaccuracies in the instruction leaflet which might lead to or might have led to the death of a patient or to a deterioration in his state of health;(b) any technical or medical reason resulting in withdrawal of a device from the market by the manufacturer.[2]Member States shall, without prejudice to Article 7, forthwith inform the Commission and the other Member States of the incidents referred to in paragraph 1 and of the relevant measures taken or contemplated. Article 10 of Directive 93/42 Information on incidents occurring following placing of devices on the market[1]Member States shall take the necessary steps to ensure that any information brought to their knowledge, in accordance with the provisions of this Directive, regarding the incidents mentioned below involving a Class I, IIa, IIb or III device is recorded and evaluated centrally: Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 5(a) any malfunction or deterioration in the characteristics and/or performance of a device, as well as any inadequacy in the labelling or the instructions for use which might lead to or might have led to the death of a patient or user or to a serious deterioration in his state of health;(b) any technical or medical reason in relation to the characteristics or performance of a device for the reasons referred to in subparagraph (a), leading to systematic recall of devices of the same type by the manufacturer.[2]Where a Member State requires medical practitioners or the medical institutions to inform the competent authorities of any incidents referred to in paragraph 1, it shall take the necessary steps to ensure that the manufacturer of the device concerned, or his authorized representative established in the Community, is also informed of the incident.[3]After carrying out an assessment, if possible together with the manufacturer, Member States shall, without prejudice to Article 8, immediately inform the Commission and the other Member States of the incidents referred to in paragraph 1 for which relevant measures have been taken or are contemplated. Article 11(1)-(3) of Directive 98/79 Vigilance procedure[1]Member States shall take the necessary steps to ensure that any information brought to their knowledge, in accordance with the provisions of this Directive, regarding the incidents mentioned below involving devices bearing the CE marking is recorded and evaluated centrally:(a) any malfunction, failure or deterioration in the characteristics and/or performance of a device, as well as any inadequacy in the labelling or the instructions for use which, directly or indirectly, might lead to or might have led to the death of a patient, or user or of other persons or to a serious deterioration in their state of health;(b) any technical or medical reason in relation to the characteristics or performance of a device for the reasons referred to in subparagraph (a), leading to systematic recall of devices of the same type by the manufacturer.[2]Where a Member State requires medical practitioners, the medical institutions or the organisers of external quality assessment schemes to inform the competent authorities of any incidents referred to in paragraph 1, it shall take the necessary steps to ensure that the manufacturer of the device concerned, or his authorised representative, is also informed of the incident. Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 6[3]After carrying out an assessment, if possible together with the manufacturer, Member States shall, without prejudice to Article 8, immediately inform the Commission and the other Member States of the incidents referred to in paragraph 1 for which appropriate measures, including possible withdrawal, have been taken or are contemplated.[12]So, information brought to the Secretary of State’s knowledge under these articles is within the scope of the 1987 Act and thereby within the prohibition against disclosure. Regulation (EC) No 765/2008 (the RAMS Regulation)[13]Mr Spencer also relied on this Regulation in connection with section 240. These are the relevant provisions: Article 12 - Information obligation[1]Each national accreditation body shall inform the other national accreditation bodies of the conformity assessment activities in respect of which it operates accreditation and of any changes thereto.[2]Each Member State shall inform the Commission and the body recognised under Article 14 of the identity of its national accreditation body and of all conformity assessment activities in respect of which that body operates accreditation in support of Community harmonisation legislation, and of any changes thereto.[3]Each national accreditation body shall regularly make publicly available information concerning the results of its peer evaluation, the conformity assessment activities in respect of which it operates accreditation and any changes thereto. Article 18 - Obligations of the Member States as regards organisation[1]Member States shall establish appropriate communication and coordination mechanisms between their market surveillance authorities.[2]Member States shall establish adequate procedures in order to:(a) follow up complaints or reports on issues relating to risks arising in connection with products subject to Community harmonisation legislation;(b) monitor accidents and harm to health which are suspected to have been caused by those products;(c) verify that corrective action has been taken; and(d) follow up scientific and technical knowledge concerning safety issues.[3]Member States shall entrust market surveillance authorities with the powers, resources and knowledge necessary for the proper performance of their tasks. Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 7[4]Member States shall ensure that market surveillance authorities exercise their powers in accordance with the principle of proportionality.[5]Member States shall establish, implement and periodically update their market surveillance programmes. Member States shall draw up either a general market surveillance programme or sector specific programmes, covering the sectors in which they conduct market surveillance, communicate those programmes to the other Member States and the Commission and make them available to the public, by way of electronic communication and, where appropriate, by other means. The first such communication shall be effected by 1 January 2010. Subsequent updates of the programmes shall be made public in the same manner. Member States may cooperate with all relevant stakeholders to those ends.[6]Member States shall periodically review and assess the functioning of their surveillance activities. Such reviews and assessments shall be carried out at least every fourth year and the results thereof shall be communicated to the other Member States and the Commission and be made available to the public, by way of electronic communication and, where appropriate, by other means. Article 19 - Market surveillance measures[2]Market surveillance authorities shall take appropriate measures to alert users within their territories within an adequate timeframe of hazards they have identified relating to any product so as to reduce the risk of injury or other damage. They shall cooperate with economic operators regarding actions which could prevent or reduce risks caused by products made available by those operators.[3]Where the market surveillance authorities of one Member State decide to withdraw a product manufactured in another Member State, they shall inform the economic operator concerned at the address indicated on the product in question or in the documentation accompanying that product.[5]Market surveillance authorities shall observe confidentiality where necessary in order to protect commercial secrets or to preserve personal data pursuant to national legislation, subject to the requirement that information be made public under this Regulation to the fullest extent necessary in order to protect the interests of users in the Community. Medicines and Healthcare Products Regulatory Agency Trading Fund Order 2003[14]The Consumer Protection Act imposed duties on the Secretary of State. Under the 2003 Order, some functions of the Secretary of State were transferred to the MHRA. Those functions were set out in Schedule 1 to the[1]All the operations of that part of the Department of Health known from 1st April 2003 as the Medicines and Healthcare Products Regulatory Agency carried out in connection with the following:—(a) the functions of the Health Ministers, the Ministers, the appropriate body or the licensing authority under— (i) the Medicines Acts of 1968 and 1971 and secondary legislation under those Acts, and (ii) any legislation of the European Communities or their institutions relating to medicinal products, and related implementing legislation;(b) the functions of the Secretary of State relating to the application of the principles of good laboratory practice and the verification of their application for tests on substances and to the inspection and verification of good laboratory practice as laid down in Council Directive 87/18/EEC of 18th December 1986 as amended and Council Directive 88/320/EEC of 9th June 1988 as amended and related implementing legislation, and as arising out of the United Kingdom’s membership of the Organisation for Economic Co-operation and Development;(c) the functions of the Secretary of State— (i) under the Medical Devices Regulations 2002 and the Medical Devices Directives, (ii) under the Clinical Thermometers (EEC Requirements) Regulations 1993, (iii) otherwise in connection with the safe use of medical devices or similar devices;(d) the functions of the Secretary of State under any legislation of the European Communities or their institutions relating to general product safety, and related implementing legislation in so far as the legislation relates to medicinal products or medical devices or similar products or devices;(e) the functions of the United Kingdom authorities relating to medicinal products, medical devices or similar products or devices under international obligations or in connection with Association Agreements or Mutual Recognition Agreements or in connection with any activities of the European Communities or any of their institutions;(f) the provision of services relating to or in connection with public health, medicinal products, medical devices or similar products or devices to meet the needs of customers in the United Kingdom, in Europe or world-wide including: Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 9 (i) assistance to other regulatory authorities, other Government departments or agencies, or public bodies, (ii) advisory, information, education or training services, (iii) the collection, processing, analysis or provision of data, (iv) the inspection or accreditation of tissue banks, (v) assessment of devices or components of devices, (vi) the sale of reference substances, (vii) the sale of publications.[2]Any operations carried on in connection with any proposed legislation or the provision and dissemination of information relating to the functions described in paragraph 1.[3]Any operations which are incidental, conducive or are otherwise ancillary to the operations described in paragraphs 1 and 2. ‘The Medical Devices Directives’ is defined by regulation 2 of the 2002 Regulations as meaning ‘Directive 90/385, Directive 93/42 and Directive 98/79’.[15]The argument in this case has focused on paragraph 1(c)(i). D. The First-tier Tribunal’s reasons[16]The tribunal rejected Mr Spencer’s argument: Notwithstanding Mr Spencer’s strongly expressed assertion to the contrary we are quite clear that voluntary reports of adverse incidents relating to medical devices comprise information which comes to the MHRA in connection with that function. The only reason people supply the information to the MHRA and the only reason it receives and records the information is because it is responsible for enforcing the Regulations which are designed to ensure the safety of medical devices. The fact that the Regulations may not refer to voluntary reports of adverse incidents (or indeed the fact that not every report will lead to enforcement action) is irrelevant: the information is still supplied and received in connection with the function of enforcing the Regulations.[17]The tribunal at first overlooked Mr Spencer’s argument on section 240. When he applied for permission to appeal to the Upper Tribunal, the tribunal dealt with the issue on review. It rejected his argument: It appears not to be in issue that MHRA is a ‘market surveillance authority’ (and indeed an ‘accreditation body’) for the purposes of the [RAMS] Regulation. However, we accept the submission made by both the Information Commissioner and MHRA that Art 19(5) does not create any free-standing obligation to disclose information; what it does is to oblige authorities to observe confidentiality in certain respects and to qualify that Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 10 obligation where disclose is otherwise required under the Regulation. The only obligations which require information to be communicated contained in the Regulation to which we have been referred are in Arts 12(1) to (3), 18 and 19(2) and (3). We have considered each of those provisions. They all relate to specific types of information (eg ‘hazards [MHRA] have identified’) and/or specific recipients (eg ‘the economic operator concerned’). None of them require details of ‘voluntary reports of adverse incidents’ involving medical devices to be disclosed to someone in Mr Spencer’s position or to the public at large. Accordingly nothing in the Regulation requires the disclosure of the information requested in this case. E. The appeal to the Upper Tribunal[18]Mr Spencer applied for permission to appeal to the Upper Tribunal ‘on one single point of law: that the information subject of the FOIA request in this Appeal is not “specified information” under the Enterprise Act 2002.’[19]I gave permission to appeal to the Upper Tribunal, saying: Given the complexity of the legislation and the importance of the issue, for which there is no Upper Tribunal precedent, a full consideration on appeal is appropriate. As we will see, the proceedings took a different course from what I expected. This led to an oral hearing on 18 October 2018. Mr Spencer decided not to attend. The other parties were represented by counsel: Ivan Hare QC for the MHRA and Elizabeth Kelsey of counsel for the Information Commissioner. I am grateful to all three for their written arguments and to counsel for their oral arguments at the hearing. Mr Spencer’s grounds[20]Mr Spencer argued that the information he had asked for was not specific information because there was no requirement for it to be provided to the MHRA under the Directives. The requirement to provide the reports was contained in the RAMS Regulations, so they were not provided under the Directives. The only confidentiality requirements under the RAMS Regulations related to personal data and commercial secrets. Information Commissioner’s response[21]This was provided by Elizabeth Kelsey of counsel. Her argument was that the First-tier Tribunal was right to decide that the information sought was specified information under section 238, disclosure of which was prohibited by section 237. The lack of any specific requirement for information to be provided does not prevent voluntary reports being provided in connection with the MHRA’s functions for three reasons: Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 11• As the tribunal said, the MHRA is only provided with the information on account of its responsibilities.• Regulation 65 requires the Secretary of State to perform the functions under the Directives, which require member States to ensure that such information is brought to their attention.• The RAMS Regulation does not impose a specific requirement that reports be provided to the MHRA. It is not specifically concerned with medical devices. Even if voluntary reports serve a market surveillance function, they also come to the MHRA in connection with its functions. MHRA’s response[22]This was provided by Ivan Hare QC. His argument was that Mr Spencer had asked the wrong question. The correct question was not: was there a legal obligation on the MHRA to receive the information? The correct question was: did the information come to the MHRA in connection with the exercise of any function under the 1987 Act? The tribunal came to the right answer to that question for the reasons it gave. Mr Spencer’s reply[23]This makes a number of detailed points. In summary:• It is appropriate to accept that the MHRA is a de facto but not the de jure market surveillance authority for medical devices.• There is no evidence of any connection between the reports submitted and the MHRA’s function.• He provides a detailed statement of the position in different parts of the United Kingdom and in Germany on which to base an argument about the source of a duty to provide reports about medical devices.• Some of the undertakings concerned in the reports might no longer exist. The further issue[24]I allowed the MHRA to deal with Mr Spencer’s comment that some undertakings might no longer exist. Mr Hare responded: The MHRA would be prepared to consider such requests if the Appellant is able to produce compelling evidence that requested information relates to an individual who is now dead. However, the MHRA cannot accede so easily to a request relating to an undertaking since the relationships between undertakings can be very complex. For example, the fact that an undertaking named in an incident report no longer exists under the same name will not be enough to remove the information from non-disclosure. The name of the undertaking may have changed or the rights to the device may have passed to another undertaking. In some cases, the rights to a number of different devices originally manufactured by one undertaking will have passed to multiple different undertakings. Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 12 F. Analysis[25]It is important to begin by asking the correct question. If you don’t, you will only happen upon the right answer by chance and may not recognise it when you do. FOIA[26]The starting point in this case is section 44(1) of FOIA and the question to ask is whether disclosure of the information that Mr Spencer wanted was prohibited under any enactment or incompatible with any EU obligation. Specified information[27]That leads to the prohibition on disclosure in section 237 of the Enterprise Act. This applies to ‘specified information’. That expression is defined in section 238 as information that came to the public authority ‘in connection with the exercise of any function’ under the Consumer Protection Act. Information is categorised, as specified or not, according to this test at the time it came to the public authority. I will deal with this first and then come back to the prohibition. Functions[28]In order to apply section 238, it is necessary to identify the relevant functions of the public authority. The public authority in this case is the MHRA. Its functions are set out in Schedule 1 to the 2003 Order. The argument in this case had focused on paragraph 1(c)(i), which covers the 2002 Regulations and the Directives. It may be that other functions would be relevant, but they have not been argued. Each of the Directives provides for the State to ‘take the necessary steps to ensure that information brought to their knowledge’ about devices is dealt with as specified. The Directives apply to information provided to the MHRA. A voluntary report is precisely that – information that has been provided to the MHRA. In connection with[29]But did the information come to the MHRA in connection with its functions? I accept Mr Spencer’s argument that ‘in connection with’ takes its meaning from its context. I accept that it would include information that is received by virtue of a requirement to provide it. But I do not accept that it is so limited. If it were, why not just say so? The expression is general and unspecific. It requires some relationship with the MHRA’s functions, but not necessarily a requirement. Some looser connection is sufficient. Given that one of the MHRA’s functions relates to particular articles of the Directives and that those articles apply to information that is received, voluntary reports received by the MHRA are provided in connection with that function. As the tribunal said, the reports are only provided because of the function that the MHRA has under the Directives. There is no Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 13 need for evidence of the connection. The connection is shown by the relationship between the contents of the reports and the functions of MHRA. The prohibition – individuals and undertakings[30]I said I would come back to this. Section 237 does not contain an absolute prohibition. It is qualified to apply only to individuals who are still alive and undertakings that are still in existence. The MHRA and the Information Commissioner now accept that this is so. The First-tier Tribunal went wrong in law by overlooking this point.[31]The MHRA had relied on the prohibition. It was only entitled to do so to the extent that it applied. It does not apply to individuals who have died or to undertakings that no longer exist. If the MHRA wants to rely on section 237, it has to show that it applies. I accept that there are practical problems for MHRA in identifying whether an undertaking is still in existence, but that that cannot relieve it of its responsibility if it wants to rely on the prohibition. Again, if it wants to rely on section 237, it has to show that it applies.[32]I suggested that the MHRA might be able to rely on section 12 of FOIA: 12 Exemption where cost of compliance exceeds appropriate limit(1) Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit.(2) Subsection (1) does not exempt the public authority from its obligation to comply with paragraph (a) of section 1(1) unless the estimated cost of complying with that paragraph alone would exceed the appropriate limit.(3) In subsections (1) and (2) ‘the appropriate limit’ means such amount as may be prescribed, and different amounts may be prescribed in relation to different cases. As the MHRA could only comply with a request by identifying those cases that were outside the scope of the prohibition, the cost of identifying the information that it could disclose would come within section 12. The practical difficulties that I have mentioned would fall to be taken into account in that way. It would be for the MHRA to show that the cost would exceed the limit.[33]At the hearing, Mr Hare relied principally on section 14, arguing that the request was vexatious. He also told me that if there were a rehearing, he would rely on section 12 and section 44(1)(b) of FOIA. His argument on the latter was that there were obligations under EU legislation that existed independently of any incorporation of directives I have mentioned into domestic law. For good measure, he suggested that the MHRA might not ‘hold’ the information requested, because it contained information necessary to identify whether an organisation still existed. I make no comment on any of those arguments, as they will require a rehearing before the First-tier Tribunal. Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 14 The prohibition – section 240[34]Mr Spencer argued that the RAMS Regulation imposed a duty of disclosure so that the prohibition under section 237 did not apply by virtue of section 240. I do not accept this argument.[35]Section 240 is an exception to the prohibition on disclosure. It limits the scope of that prohibition. It does not itself create a duty to disclose. It merely applies when a duty exists. And when it does apply, it only removes the prohibition in respect of the persons who fall within the scope of the EU obligation. They may be the public at large, but may be a limited class. In other words, the effect of section 240 is to prevent a conflict between the EU obligation and the section 237 prohibition.[36]This is significant for the operation of FOIA because of section 21, which provides that ‘Information which is reasonably accessible to the application other than under section 1 is exempt information.’ In other words, if there is a duty to disclose to the public under an EU obligation and it has been complied with, FOIA does not apply. If the duty has not been complied with, the proper approach would be to seek to enforce the obligation, as FOIA does not provide an enforcement mechanism for other duties.[37]In those circumstances, it is not necessary to deal with the extent to which, if at all, the RAMS Regulation imposed a duty to disclose. I will, though, deal with it as it was covered in the First-tier Tribunal’s decision on review. With regard to Article 19(5), the tribunal’s analysis was correct. It does not create a duty to disclose. What it does is to impose a requirement of confidentiality that is subject to a limitation. In effect, it recognises the existence of duties that exist independently of Article 19(5). With regard to the other provisions considered by the tribunal, I accept that these may involve disclosure, but they are limited either in the persons to whom disclosure is required or in the contents of what has to be disclosed. The tribunal was correct that there was no obligation covering the information that Mr Spencer had asked the MHRA to provide. Signed on original on 22 October 2018 Edward Jacobs Upper Tribunal Judge

Order

Leonard Spencer v Information Commissioner and the Medicine and Healthcare Products Regulatory Agency [2018] UKUT 349 (AAC) Upper Tribunal Case No: GIA/0236/2018 8