FT - FT/EA/2024/0359
From GDPRhub
| UKFTT - FT/EA/2024/0359 | |
|---|---|
 | |
| Court: | First-tier Tribunal (General Regulatory Chamber) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 40(5B)(a)(i) FOIA Article 5(1)(a) UK GDPR Article 50 FOIA Article 6(1)(a) UK GDPR Article 6(1)(f) UK GDPR Article 7 UK GDPR Section 17(7) FOIA |
| Decided: | |
| Published: | 20.06.2026 |
| Parties: | Information Commissioner Nursing and Midwifery Council |
| National Case Number/Name: | FT/EA/2024/0359 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | English |
| Original Source: | Bailii (in English) |
| Initial Contributor: | bms |
A court found that the nursing and midwifery council could refuse to comply with a freedom of information request asking whether a specific nurse had been listed on a register for misconduct. According to the court, nurse’s right to privacy prevailed over the requester’s interest.
English Summary
Facts
A doctor submitted a freedom of information request to the Nursing and Midwifery Council, the controller, asking whether a named nurse had been struck off the register for misconduct under the former English National Board for Nursing or the United Kingdom Central Council for Nursing, Midwifery and Health Visiting.
The controller replied that it may hold the requested information but refused disclosure under Section 40(2) FOIA, stating that the information was personal data. The doctor, the requestor, complained to the DPA, arguing that the refusal was procedurally and substantively defective.
The DPA found that the controller should have neither confirmed nor denied whether it held the information under Section 40(5B) FOIA. The DPA also found that the controller breached Section 17(1) FOIA because it had failed to issue a correct refusal notice within the statutory time frame, but it did not require any further steps.
The requestor appealed to the First-Tier Court. She argued, among other points, that the controller had effectively admitted holding the information, that it was bound by its initial reliance on Section 40(2) FOIA, that the nurse had consented to disclosure through the regulatory registration framework, and that there was a strong public interest in disclosure.
Holding
The Court allowed the appeal in part.
First, the Court held that the controller had not admitted holding the requested information. The statement that it “may” hold the information only acknowledged a possibility. It was not a confirmation that the information was held. The Court also held that, even if the controller had previously relied on Section 40(2) FOIA, this did not prevent the DPA or the Court from considering Section 40(5B) FOIA. The statutory FOIA framework allowed the relevant authority, the DPA and the Court to consider the correct exemption or exclusion.
The Court then assessed whether confirming or denying that the information was held would disclose personal data. Since the request named the nurse and concerned whether that person had been struck off for misconduct, the Court held that confirmation or denial would reveal personal data about the requestor.
The Court considered Article 6(1)(a) UK GDPR and rejected the argument that the requestor had consented to disclosure. The fact that professional registers may be public, or that sanctions may be published in some circumstances, did not amount to clear, specific and affirmative consent to disclosure under FOIA many years later. The Court also noted that, under the controller’s current publication policy, a striking-off sanction remains publicly available on the register for five years from the date on which the order takes effect. In this case, that publication period had long expired.
The Court then considered Article 6(1)(f) UK GDPR. It accepted that the requester had a legitimate interest in the information for research purposes and that disclosure was necessary because the information was not otherwise publicly available. However, the Court held that the requestor’s privacy rights overrode that interest. The information was historic, related to professional misconduct, was no longer published on the register, and disclosure under FOIA would amount to disclosure to the public at large.
As a result, the Court held that confirming or denying whether the controller held the information would breach the first data protection principle under Article 5(1)(a) UK GDPR, since the processing would not be lawful and fair. Therefore, section 40(5B)(a)(i) FOIA was applicable.
The Court also applied the public interest test. It recognised a general public interest in transparency and possible public interest arising from the background to the request. However, it held that this was outweighed by the public interest in protecting the requestor’s privacy. The controller was therefore entitled to neither confirm nor deny whether it held the requested information. No fine was imposed. The only corrective outcome was a substituted decision notice. The Court found that the DPA’s decision notice should also have recorded that the controller breached Section 17(7) FOIA because its refusal notice failed to explain the requester’s right to complain to the DPA under Section 50 FOIA. The appeal was therefore allowed only on this limited procedural point and was otherwise dismissed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
NCN: [2026] UKFTT 980 (GRC)
Case Reference: FT/EA/2024/0359
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Heard by Cloud Video Platform
Heard on: 21 & 22 April 2026
Decision given on: 01 July 2026
Before
JUDGE SAWARD
JUDGE ARMSTRONG-HOLMES
TRIBUNAL MEMBER YATES
Between
DR. CATHERINE LUCY HAWKING
Appellant
and
(1) INFORMATION COMMISSIONER
(2) NURSING AND MIDWIFERY COUNCIL
Respondents
Representation:
For the Appellant: Professor Mark Engelman, Counsel
For the First Respondent: Did not appear
For the Second Respondent: John Fitzsimons, Counsel
Decision: The appeal is allowed in part.
Substituted Decision Notice: IC-305066-P7N8
The following text is added to paragraph 2. of the Decision:
“In addition, the NMC breached section 17(7) of FOIA as its refusal notice failed to contain
particulars of the applicant’s right conferred by section 50 of FOIA to apply to the Commissioner
for a decision whether, in any specified respect, a request for information made by the complainant
to a public authority has been dealt with in accordance with the requirements of Part I of FOIA.”
© CROWN COPYRIGHT 2026 REASONS
Introduction
1. The Freedom of Information Act 2000 (“FOIA”) provides for a general right of access
to information held by public authorities. That right is subject to exceptions and
exemptions. It is enforced by the Information Commissioner (“the Commissioner”)
with a right of appeal from a decision of the Commissioner to this Tribunal.
2. There are two outstanding appeals brought by the Appellant against separate
decisions of the Commissioner. Both concern requests for information made to the
Nursing and Midwifery Council (“the NMC”), being the regulator for nursing and
midwifery professions in the UK. The appeals were heard together. The appeal
bearing Tribunal reference FT/EA/2025/0091 is subject to a separate decision. A
third appeal involving the same parties was settled before reaching hearing. A
separate application brought by Dr. Hawking seeking certification of contempt by
the NMC in relation to both appeals (ending 0359 and 0091) is also subject to a
separate decision.
3. This appeal is made against the Commissioner’s decision referenced IC-305066-P7N8
of 9 August 2024. In that decision, the Commissioner decided that the NMC should
have neither confirmed nor denied (“NCND”) it held the requested information. The
NMC was not required to take any steps.
4. This Decision provides a summary of the submissions, evidence and the Tribunal’s
view of the law. It does not seek to capture every point made, it being impractical
and unnecessary to do so. The absence of any specific submission or evidence does
not mean it has not been considered.
Background
5. The Appellant has provided personal background information to provide context
and explain why the requested information is sought. It is unnecessary for that
personal information to be recorded in this published Decision.
The Hearing
6. The hearing was conducted by online video (CVP). The Tribunal was satisfied this
was a fair and just way to conduct the proceedings.
7. The Appellant attended and was represented by Professor Mark Engelman, Counsel.
8. The Second Respondent, the NMC, was represented by John Fitzsimons, Counsel.
The Commissioner was not represented having indicated in advance that he
intended instead to rely upon his Decision Notice and written submissions. In place
of a skeleton argument, the Commissioner provided further submissions regarding
his exercise of discretion to apply section 40(5B) FOIA.
29. The hearing took the form of submissions from each advocate with questions from
the Tribunal panel.
10. The documents before the Tribunal comprise an open bundle of some 327 pages, an
Authorities bundle, skeleton arguments for the Appellant and NMC, and the
Commissioner’s submissions (as mentioned above).
Procedural Matters
11. A costs application had been submitted by Dr. Hawking against the NMC. For time
management reasons, the costs application was heard on day 2 (i.e. on 22 April 2026).
At the hearing, Professor Engelman said that the costs application dated 3 April 2026
(and re-submitted with amendments on 8 April 2026) related to both appeals (0359
and 0091) plus the application for certification of a contempt. During the hearing, Dr.
Hawking withdrew the costs application insofar as it related to the appeals. The
Tribunal consented to the withdrawal which took effect pursuant to Rule 17 of The
Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009.
The Request
12. On 27 February 2024, the Appellant made the following request to NMC:
“[REDACTED], later [REDACTED] later [REDACTED]. I would like to know
whether this nurse was struck off the register for misconduct under the ENB or
UKCC.”
13. The “ENB” is the abbreviation for the English National Board for Nursing, which
regulated the training and education for nurses, midwives and health visitors
between 1980 and 2002. The “UKCC” is the United Kingdom Central Council for
Nursing, Midwifery and Health Visiting, which was the regulatory body for
professional conduct of those named professions between 1983 to 2002. Both bodies
were replaced by the NMC.
The Response
14. On 6 March 2024, the NMC replied to the Request by advising that it may hold the
requested information but cannot release it as it is exempt from disclosure under
section 40(2) FOIA (personal information).
Decision Notice
15. The Appellant complained to the Commissioner on 13 April 2024 about the way her
Request had been handled. By decision dated 9 August 2024, the Commissioner
found that the NMC should have neither confirmed nor denied that it held the
requested information under section 40(5B) of FOIA. The NMC had therefore
breached the procedural step in section 17(1) FOIA to issue a correct refusal notice
within 20 working days. The Commissioner decided that it was unnecessary to
require the NMC to take any corrective steps.
316. In reaching his decision, the Commissioner noted that the requested information
concerned whether a named nurse had been struck off the register for misconduct.
The Commissioner was satisfied that confirming or denying whether the requested
information was held would disclose personal data of that individual, as the data
subject. The person could be identified as they are named in the Request, and the
requested information relates to them. Confirming or denying that the information
was held could indicate whether or not the person was struck off the NMC register.
17. The Commissioner referred to having issued “numerous decision notices setting out the
correct response from a public authority faced with such a request and explaining why they
should not confirm or deny that information is held.” Based on the available evidence, the
Commissioner was satisfied that “there would be no lawful basis in data protection law
for the NMC to confirm, to the world at large, whether a particular (identifiable) nurse had
been removed from its register.”
18. The Commissioner noted that the NMC had advised the requester that it has an
online register which can be searched by a nurse’s name or PIN number.
Grounds of Appeal
19. In essence, the grounds of appeal are:-
19.1 The Appellant raised 3 bases of complaint to the NMC under sections 17(1) and
17(7) of FOIA and the Information Commissioner’s Office Code of Practice.
Whilst the Commissioner found a breach of section 17 FOIA, he did so on a basis
neither raised by the Appellant nor on the facts. The NMC had admitted to
possessing both an electronic and paper data base of registrants.
19.2 Had the Commissioner considered the Appellant’s bases, he would have
identified that the NMC register is mandated by statute to be made “available to
the public at all reasonable times” pursuant to Article 8 of The Nursing and
Midwifery Order 2001 (“the 2001 Order”).
19.3 The Commissioner entirely failed to deal with the Appellant’s actual grounds of
complaint under section 17(1) FOIA. If he had, he would have found that no
statutory exemption exists because:
(a) the registrants had consented by Article 8 of the 2001 Order to be rendered
identifiable from any personal data on the NMC register.
(b) no exemption applied to the NMC’s identification of section 40(2) FOIA
(c) NMC’s identification of section 40(2) FOIA lacked any/all specification for
the purpose of compliance with section 17(1).
19.4 The Commissioner entirely failed to address the Appellant’s complaint
concerning NMC’s breach of the Code concerning her request for internal
review by failing to (i) acknowledge receipt of it or within 20 days (ii) provide a
4 target date (iii) conduct it at all (iv) provide information (v) a record of it (vi) or
advise the Appellant of her right of appeal.
The Commissioner’s Response
20. The Commissioner resists the appeal. In summary:
20.1 The Commissioner notes that the Appellant does not appear to dispute that the
requested information is personal data or that confirmation or denial would
reveal personal data relating to the data subject.
20.2 Article 6(1) UK GDPR states that “Processing shall be lawful only if and to the extent
that at least one of the following [conditions] applies.”
20.3 Article 6(1)(a) UK GDPR renders processing lawful if “the data subject has given
consent to the processing of his or her personal data for one or more specific purposes”.
There is no evidence that the data subject gave their consent for disclosure of the
requested information to the world at large, at the time of the Request. The very
fact the Appellant needed to request the information under FOIA, makes clear
that the information was not publicly available on the register.
20.4 In considering the application of Article 6(1)(f) GDPR in the context of a request
for information under FOIA, it is necessary to consider a three-part test:-
i) Legitimate interest test: Whether a legitimate interest is being pursued by the
request for information;
ii) Necessity test: Whether disclosure of the information is necessary to meet the
legitimate interest in question; and
iii) Balancing test: Whether the above interests override the legitimate interest(s)
or fundamental rights and freedoms of the data subject.
20.5 This is consistent with Goldsmith International Business School v Information
Commissioner and Home Office [2014] UKUT 563 (AAC) at [35]-[42] (reiterating
the Supreme Court’s approach in South Lanarkshire Council v The Scottish
Information Commissioner at [18]), Glenda Rodriguez-Noza v Information
Commissioner and Nursing and Midwifery Council (GIA/0433/2014), and
InformationCommissioner vColleen Foster andNursing andMidwiferyCouncil
(GIA/1626/2014) at [19], [23]-[24], [27]).
20.6 The Commissioner accepts that the Appellant has a legitimate interest in the
requested information. He also accepts that disclosure is necessary as the
information does not appear to be publicly available on the register.
20.7 The Commissioner maintains that the Appellant’s legitimate interest is
outweighed by the data subject’s right to privacy for the reasons given in his
Decision Notice.
520.8 The Commissioner considers it to be clear from the NMC’s website that
information pertaining to fitness to practice is not recorded on the register in
perpetuity.
20.9 The Commissioner acknowledges the NMC’s argument on internal review that
individuals would not expect their data to be published upon request given that
FOIA is distinct from the NMC’s publication processes.
20.10 A person who formerly practiced as a nurse could no longer be on the register
for a number of reasons and would not expect their personal data to be released
under FOIA. It appears that only the current register is publicly available, not
information that is no longer recorded in it.
20.11 Article 6(1)(c) UK GDPR does not apply as the processing in question is
disclosure under FOIA and not a disclosure pursuant to any other legal
obligation.
20.12 It was clear that section 40(3A)(a) FOIA was the applicable condition referred to
by NMC in reliance upon section 40(2) FOIA. NMC provided further explanation
in its internal review. Such matters were overtaken by the Commissioner’s
finding that the NMC should have neither confirmed nor denied holding the
requested information.
20.13 The Commissioner’s Code of Practice is not binding on public authorities.
Internal reviews are not a statutory requirement for compliance with Part 1 of
FOIA (Montague v ICO & DIT [2022] UKUT 104 (AAC)).
Appellant’s Reply
21. The Appellantprovideda witnessstatementinreplyaddressingallthree of herFOIA
requests to NMC.
22. Itissubmittedthata nurseconsentstothepublicationoftheirstrikingofftheregister.
To support this stance, the Appellant produces extracts of the NMC “Guidance on
Publication of Fitness to Practise and Registration Appeal Outcomes, (“the Fitness to
Practice Guidance”) and the NMC Registration and Revalidation Information
Handling Guidance, (“the Information Handling Guidance”).
Legal Framework
23. Section 1(1) FOIA provides:
“Any person making a request for information to a public authority is entitled-
(a) To be informed in writing by the public authority whether it holds information of the
description specified in the request, and
(b) If that is the case, to have that information communicated to him.
624. By section 1(4) FOIA "information" in section 1(1) is "the information in question held at
the time when the request is received, ...", in this case on 7 February 2024.
25. Importantly, section 1(1) FOIA does not provide an unconditional right to be told
whether or not a public authority holds any information. Nor does it provide an
unconditional right of access to any information which a public authority does hold.
The rights within section 1(1) are subject to certain other provisions of FOIA. They
include section 2(1), which provides:
“Where any provision of Part II states that the duty to confirm or deny does not arise in
relation to any information, the effect of the provision is that where either—
(a) the provision confers absolute exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exclusion of
the duty to confirm or deny outweighs the public interest in disclosing whether the public
authority holds the information,
section 1(1)(a) does not apply.”.
26. The effect of the above is that some exclusions of the duty to confirm or deny, which
are set out in Part II of FOIA, are absolute and some are subject to the public interest
test. Section 2(3) of FOIA lists those that are absolute. In this case, the Commissioner
relies upon section 40(5B) FOIA. As section 40(5B) is not included in that list, it is a
qualified exclusion to which the public interest test applies, even if the section is
engaged.
27. Insofar as relevant to this appeal, section 40(5B) FOIA provides:
“The duty to confirm or deny does not arise in relation to other information if or to the extent
that any of the following applies—
(a) giving a member of the public the confirmation or denial that would have to be given to
comply with section 1(1)(a)—
(i) would (apart from this Act) contravene any of the data protection principles…”.
28. Section 40(7) FOIA provides definitions for the purposes of section 40 with reference
to the Data Protection Act 2018 (“DPA”) and the UK GDPR. In particular:
• section 3(2) DPA defines “personal data” as “any information relating to an
identified or identifiable living individual”. The “processing” of information
includes “disclosure by transmission, dissemination or otherwise making
available” (section 3(4)(d) DPA) and thus includes disclosure under FOIA.
• the “data protection principles” are those set out in Article 5(1) of the UK
GDPR, and section 34(1) DPA. The first data protection principle under
Article 5(1)(a) of the UK GDPR is that personal data shall be: “processed
lawfully, fairly and in a transparent manner in relation to the data subject”.
7 • a “data subject” is defined in section 3 DPA to mean “the identified or
identifiable living individual to whom personal data relates”.
• The “processing” of information relating to a data subject includes
“disclosure by transmission, dissemination or otherwise making available”
(section 3(4)(d) DPA). It therefore includes disclosure under FOIA.
29. “Processing” is only lawful if and to the extent that it meets at least one of the six
conditions set out within Article 6(1) UK GDPR. Insofar as relevant to the issues
raised in this appeal, they include:
(a) “the data subject has given consent to the processing of his or her personal data for one
or more specific purposes;
(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the
interests or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a child.”
30. Article 6(1) proceeds to disapply the legitimate interests gateway in relation to public
authorities in the performance of their tasks in respect of point (f) above. However,
section 40(8) FOIA explicitly provides that Article 6(1) should be read as though this
provision were omitted for the purposes of section 40 and the lawfulness principle in
Article 5(1)(a). This means that the legitimate interests basis (see below) is applicable
when considering the first data protection principle in Article 5(1)(a) UK GDPR.
31. The Supreme Court considered the proper interpretation and application of Article
6(1)(f) of the UK GDPR in South Lanarkshire Council v The Scottish Information
Commissioner[2013]UKSC55.LadyHale identifiedthatthisconditionfor the lawful
processing of personal data required three questions to be answered:
(i) Is the data controller or the third party or parties to whom the data are disclosed
pursuing a legitimate interest or interests? (Legitimate interests test).
(ii) Is the processing involved necessary for the purposes of those interests? (Necessity
test).
(iii) Is the processing unwarranted in this case by reasons of prejudice to the rights and
freedoms or legitimate interests of the data subject? (Balancing test).
32. The wording of question (iii) is taken from the Data Protection Act 1998, now
superseded by the DPA and the UK GDPR. Accordingly, that question should now
reflect the wording used in the UK GDPR so that the third question should be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data?’.
8 This last question specifically addresses the balance between the rights of a data
subject and the need to process the personal data in question.
33. The Upper Tribunal endorsed the approach taken in South Lanarkshire Council in the
subsequent case of Goldsmith International Business School v Information
Commissioner & Home Office [2014] UKUT 0563 (AAC), and set out eight
‘propositions’ derived from case law:
Proposition 1: Condition 6(1) of Schedule 2 to the DPA requires three questions to be
asked, as per the three questions identified by Lady Hale in South Lanarkshire.
Proposition 2: The test of “necessity” under stage (ii) must be met before the balancing
test under stage (iii) is applied.
Proposition 3: “Necessity” carries its ordinary English meaning, being more than
desirable but less than indispensable or absolute necessity.
Proposition 4: Accordingly, the test is one of “reasonable necessity”, reflecting the
European jurisprudence on proportionality, although this may not add much to the
ordinary English meaning of the term.
Proposition 5: The test of reasonable necessity itself involves the consideration of
alternative measures, and so “a measure would not be necessary if the legitimate aim
could be achieved by something less”; accordingly, the measure must be the “least
restrictive” means of achieving the legitimate aim in question.
Proposition 6: Where no Article 8 privacy rights are in issue, the question posed under
Proposition 1 can be resolved at the necessity stage, i.e. at stage (ii) of the three-part
test.
Proposition 7: Where Article 8 privacy rights are in issue, the question posed under
Proposition 1 can only be resolved after considering the excessive interference
question posted by stage (iii).
Proposition 8: The Supreme Court in South Lanarkshire did not purport to suggest a
test which is any different to that adopted by the Information Tribunal in Corporate
Officer (Information Tribunal).
34. We emphasise that the ‘legitimate interests test’ differs from the ‘public interest test’.
As explained by Upper Tribunal Judge Wikeley (albeit in the context of section 40(2))
in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:
“…the balancing process in the application of the Goldsmith questions “is different from the
balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v
Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC)
at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if
disclosure would contravene the data protection principles enshrined in the DPA, so it is the
DPA regime which must be applied. There is no obvious reason why the general transparency
9 values underpinning FOIA should automatically create a legitimate interest in disclosure
under the DPA.””
35. Other relevant principles are Recital (1) to the UK GDPR, which provides:
“The protection of natural persons in relation to the processing of personal data is a
fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union
(the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union
(TFEU) provide that everyone has the right to the protection of personal data concerning him
or her.”
36. Recital (2) to the UK GDPR also includes the following:
“The principles of, and rules onthe protectionof natural personswith regardtothe processing
of their personal data should, whatever their nationality or residence, respect their
fundamental rights and freedoms, in particular their right to the protection of personal data.”
Public Interest Test
37. The balancing of public interest is on the basis of how matters stood at the time of the
public authority’s response to a request under FOIA (Montague v
the Information Commissioner and the Department for International Trade [2022]
UKUT 104 (AAC)).
Role of the Tribunal
38. The role of the Tribunal is governed by section 58 FOIA. This requires the Tribunal
to consider whether the Commissioner’s Decision Notice is in accordance with the
law, or, where the Commissioner’s decision involved an exercise of discretion,
whether he should have exercised it differently. The Tribunal may review any
finding of fact on which the Decision Notice was based (section 58(2)). This means
that we may review all the evidence provided to us (even if that evidence was not
before the Commissioner) and make our own decision on the merits.
39. The Appellant refers to the Information Commissioner v Bell [2014] UKUT 106
(AAC), where at paragraph [22], the Upper Tribunal said:
What is the nature of the appeal? The tribunal undertakes a complete reconsideration of the
issues before the Commissioner. It is not limited to the evidence or submissions considered
by the Commissioner. Nor is it bound by his findings of fact or the way he has exercised a
discretion. In the convenient phrase that is often used to describe the role of the First-tier
Tribunal, it stands in the shoes of the decision-maker.”
40. The Upper Tribunal in NHS England v Information Commissioner and Dean [2019]
UKUT 145 (ACC) reiterated that "The First-tier Tribunal ‘exercises a full merits appellate
jurisdiction and so stands in the shoes of the IC and decides which (if any) exemptions
apply...".
41. ItdoesnotmeanthatwecanconsidermattersfallingoutsidethescopeoftheRequest.
10Main Issues
42. The main issue for the Tribunal to determine is whether section 40(5B) FOIA is
engaged. That turns on:
• Whether confirming or denying that the requested information was held
would constitute the disclosure of someone’s personal data;
• If so, whether confirming or denying that the requested information was held
would contravene any of the data protection principles. This includes
consideration of whether the nurse in question consented to publication of the
requested information.
• If so, whether (in all the circumstances) the public interest in maintaining the
exclusion of the duty to inform pursuant to section 1(1)(a) FOIA, outweighs
the public interest in disclosing whether or not the NMC holds the requested
information.
43. These were agreed by the advocates as the main issues at the start of the hearing
albeit Professor Engelman wished to raise other matters on behalf of the Appellant.
Evidence and submissions
Appellant’s submissions
44. The Appellantsubmitsthatthe Commissioner erred byfailingtoadequatelyaddress
her complaints concerning section 17(1) and the failure by NMC to identify which
precise sub-section of section 40(2) FOIA applied. There are eight sub-sections. The
duty under section 1(1) FOIA was to admit or deny possession of the requested
information, not whether it ‘may’ hold the information.
45. The Commissioner also failed to grasp why section 40(5B) FOIA cannot apply. Five
reasons are given, but two are a duplication.
46. The first reason given is that the NMC had admitted to holding the requested
information when it replied to the request on 6 March 2024. At the hearing Professor
Engelman advanced the argument that when NMC said “we may hold the information”
it was making a statement of fact, which was “an admission of the probability of holding
it”. The NMC then made a statement of fact, and also a statement of law, when it said:
“we are unable to release this to you as it is exempt under section 40(2) of the FOI Act”.
Professor Engelman asserted that when these two alternative and contradictory
statements of fact are put together “it’s lying”.
47. The second reason given for why section 40(5B) cannot apply is the NMC’s election
and reliance upon section 40(2). The Appellant submits that it is immediately clear
that section 40(2) is not an absolute exemption as NMC claimed. NMC breached
section 17(1)(c) as it was not apparent if, or why, the exemption applied. The failure
by the Commissioner to address section 17 triggered section 10 of the Tribunals and
11 Inquiries Act 1992 (which applies to the Commissioner by virtue of Schedule 1, Part
1, Article 14(a)). Section 10 required the Commissioner to give reasons for failure to
dispose of the grounds of appeal on section 17(1).
48. It is further argued that the NMC is bound by its decision on section 40(2) FOIA. The
Commissioner could not cure the serious legal/procedural error and permit the
NMC to substitute section 40(5B) for section 40(2). It was estopped from doing so.
49. The third reason the Appellant says that section 40(5B) cannot apply is because the
nurse consented to disclosure. The Decision Notice fails to explain or provide any
analysis as to which of the four subsections within section 40(5B) applies. Assuming
the Commissioner meant section 40(5B)(a)(i) and a contravention of the Data
Protection principles, to which Article 5(1)(a) applies, it is to be read subject to Article
6(a). This defines lawful processing and purposes as including consent by the data
subject to the processing of his or her personal data.
50. The Fitness to Practice Guidance provides that where a fitness to practise order has
been made, the registrant continues to appear on the Register with their status
updated. It also states that records of sanctions may be disclosed to employers and
other enquirers where it is in the public interest to do so.
51. The fourth ground for maintaining that section 40(5B) does not apply relies upon the
“enormous publicity” associated with the individual concerned, which is said to
amount to significant public interest in disclosure even absent consent. The
Commissioner’s website identifies that a suspicion or wrongdoing suffices for these
purposes. A series of press articles are attached to the Appellant’s witness statement.
52. It is pointed out that section 40(5B) is not an absolute exemption but a qualified one.
53. It is further submitted that the Commissioner breached Article 6 ECHR and the
Appellant’s right to a fair hearing by relying on an argument not raised by a party.
Also, by failing to allow the Appellant opportunity to reply or make submissions
before reaching a conclusion on different grounds from those relied upon by NMC.
NMC’s submissions
54. The NMC adopts and agrees the Commissioner’s written submissions and the
question of exercise of discretion under section 40(5B) FOIA. The NMC is clear that
releaseofsuchpersonaldata,ifheld,wouldnotbelawful,fairandtransparentwithin
the meaning of Article 5(1) UK GDPR.
55. The NMC accepts that the Appellant has a legitimate interest in the requested
information, and that disclosure is necessary as the information does not appear
publicly. However, NMC says that this legitimate interest is outweighed by the data
subject’s right to privacy for the reasons articulated in the Decision Notice.
56. During the hearing, Mr Fitzsimon added that it is wrong as a matter of fact that the
NMC had acknowledged that the information was held. When the NMC said “it may
12 hold” the requested information, it was equivocal. The language used may be
inelegant or unhelpful, but it did not express a probability or likelihood of the
information being held. It was saying it may, or may not, be held. In effect, it was the
same as NCND.
57. The NMC says the doctrine of estoppel does not apply in the statutory scheme. The
better authority is Ingle. Even if estoppel did apply, ‘detriment’ is important. That is
the same question of whether there was consent or lawful basis and legitimate
interest.
58. Through no malice of NMC, the reality of FOI is that mistakes will be made. The
NMC is entitled to rely on the Decision Notice as the way forward.
59. With reference to Article 7 UK GDPR, there is a high threshold for consent by a data
subject. The submissions do not come close to that bar. There is no way an
employment contract, or guidance somewhere on a website, gives consent to
personal information being processed by way of this type of disclosure.
60. NMC accepts that the Appellant has a legitimate interest in the information sought
as research for her writing. The ‘necessity test’ is also met as there is no other way to
get the information. The ‘balancing test’ comes down to the factors identified by the
Commissioner (at paragraphs 26 to 30 of his Response). The most important point is
that information on the register is not held in perpetuity. The NMC’s Publication
Guidance is that the live register shows individuals struck off in the last 5 years only.
61. It is acknowledged that the Commissioner’s reference (at paragraph 27 of his
Response) to NMC’s internal review, conflates this appeal with another (0091).
However, it is correct that an individual would not expect their data to be published
in this way. It is a question of the reasonable expectation of a nurse at the time that
preceded the NMC Guidance of today.
62. NMC takes its position seriously. The safety of the public is important. There is also
a duty of care to the thousands of nurses who are, or have been, on its register. NMC
should have relied upon section 40(5B) FOI.
Commissioner’s submissions
63. Whilst the Commissioner did not attend the hearing, he provided written
submissions in place of a skeleton argument regarding the exercise of his discretion
to apply section 40(5B) FOIA.
64. The point is made that it is for the Commissioner to consider the scope of his
investigation. It is his discretion. Once the Commissioner was satisfied that an
exemption in section 40(5B) was engaged, and the public interest favoured NCND,
he was not required to consider the alternative or other exemptions (Information
Commissioner v Malnick & ACOBA [2018] UKUT 72 (AAC), paragraphs [77] to [79].
1365. The then Information Tribunal said in Bowbrick v Information Commissioner &
Nottingham City Council EA/2005/0006 that the Commissioner was entitled to
consider exemptions not referred to by the public authority in appropriate cases.
Findings and Discussion
Preliminary matters
66. The NMC readily conceded at the hearing that it had not conducted an internal
review. Thus, the Decision Notice is wrong at paragraph 5 to refer to an internal
review by the NMC on 28 March 2024, as are references to the internal review in the
Commissioner’s response. It was the Appellant’s FOIA request in appeal 0091 where
an internal review was conducted. This error has no significance in our consideration
of the substantive issues. There is no statutory requirement for an internal review
before the Commissioner can issue a Decision Notice. Indeed, the Commissioner can
choose to reach a decision before an internal review in any event.
67. In determining whether the Commissioner’s Decision Notice was in accordance with
the law, our primary consideration is whether section 40(5B)(a)(i) is engaged.
Was section 40(5B) of FOIA engaged?
68. To recap, if section 40(5B)(a)(i) FOIA is engaged the duty to confirm or deny does not
arise in relation to information, and it is exempt from disclosure. To be exempt,
giving a member of the public the confirmation or denial would need to contravene
any of the data protection principles. The ‘data protection principles’ are those in
Article 5(1) UK GDPR and section 34(1) of the Act.
69. The Appellant maintains that the section 40(5B)(a)(i) exemption cannot apply for
various reasons. We address two of those preclusion arguments at the outset. Other
argumentsraised fall for considerationinthe contextof Article6(1)or‘othermatters’.
Whether NMC admitted to holding the requested information
70. We start with the Appellant’s argument that section 40(5B) FOIA cannot apply
because the NMC admitted to holding the requested information. This argument is
somewhat confused. On the one hand, the Appellant contends that the NMC failed
in its duty under section 1(1) FOIA to confirm whether it held the requested
information, as the duty is not whether it “may” hold the information. On the other
hand, it is argued that the Appellant “admitted to holding” the requested
information.
71. The contested point stems from the NMC’s refusal notice to the Request dated
6 March 2024, which said:
“I can advise that we may [emphasis added] hold the information request however, we are
unable to release this to you as it is exempt under section 40(2) of the FOI Act (personal
information). This exemption is what is known as an ‘absolute’ exemption and is not subject
14 to a public interest test. If information is classed as personal information, we can consider
withholding it.”
72. By saying that “we may hold the information” the NMC did not say that the NMC did
hold the information. The word “may” acknowledges the possibility that the
requested information is held. Nothing more. On any reasonable reading, it was not
an admission.
73. We find as a matter of fact that NMC did not admit to holding the requested
information. Our finding is not altered by the fact that the NMC then cited an
exemption within FOIA. The reference informed the requester of the exemption the
NMC considered was applicable if the information was held. The response was
clumsy, but the accusation that the NMC had lied in its response is unfounded.
74. Even if the NMC had inadvertently confirmed holding the information, the data
protection principles could still be breached. It would not prevent the Commissioner
from finding that section 40(5B)(a)(i) was engaged.
Estoppel – reliance on section 40(2) FOIA
75. The NMC no longer seeks to rely upon the section 40(2) exemption. Instead, it adopts
the position taken by the Commissioner. The Appellant challenges both NMC and
the Commissioner’s lawful ability to depart from section 40(2) FOIA.
76. Estoppel is raised by the Appellant along the lines that the NMC is bound by its
decisions which cannot be substituted by those of the Commissioner. As the NMC
soughttorelyonsection40(2)FOIA,theCommissioneritisargued,cannotsubstitute
another ground. This is also given as a reason why section 40(5B) cannot apply.
77. The Tribunal invited the advocates’ comments on the very recent Upper Tribunal
decision in United Kingdom Research & Innovation v The Information
Commissioner andReubenKirkham (“UKRI”) [2026] UKUT 146(AAC).TheTribunal
clerk circulated the judgment to the advocates and time was given to digest the
content. At paragraph [52], the Upper Tribunal held that an argument that the public
authority was estopped from relying on an exemption was misconceived for two
reasons:
a. estoppel is a common law doctrine, while FOIA is a statutory scheme, and as
the Upper Tribunal held in Ingle v The Information Commissioner &
Cambridgeshire County Council [2023] UKUT 80 (AAC) (“Ingle”) estoppel
must “give way to the principles of a statutory scheme”, and
b. the various exemptions under FOIA, where they apply, exempt a public
authority from doing what section 1 FOIA would otherwise require it to do. A
public authority may decide to disclose requested information even if it
considers that an exemption applies, and even where the public authority does
rely on an exemption, there is nothing to say that it must rely on every
exemption it considers applicable, and a public authority which has relied on
15 one exemption may later invoke an additional or alternative exemption,
whether in the same proceedings or in separate proceedings.
78. In Ingle, at paragraph [33],
“The doctrine of estoppel is a common law notion which must give way to the principles
of a statutory scheme. There is ample authority in the case law for the principle that a
public authority is not estopped from relying on an exemption under FOIA simply
because it has failed (whether consciously or by oversight) to rely on that same
exemption at some earlier stage in the proceedings.”
79. Professor Engelman argued that statute does not “trump” common law. He sought
to distinguish UKRI on the basis that it did not concern estoppel by representation.
In UKRI estoppel was raised in the context of sections 36 and 41 FOIA where the
public authority admitted holding the requested information. Professor Engelman
argues that position is very different to the facts of this case where there is a
contradiction in fact with the NMC saying: “I may have the information, I do not admit I
have it”.
80. Professor Engelman went as far as suggesting that the Upper Tribunal decision in
UKRI is per incuriam (i.e. “through lack of care”). When asked to clarify, he asserted
that the reasons were wrong because the decision was made without the benefit of
the legalargumentheardby thisTribunalpanel.Hesuggestedthatthe samewas true
of the Upper Tribunal’s decision in Ingle.
81. The Tribunal finds the Appellant’s argument on ‘estoppel’ wholly misplaced.
Paragraph [33] of Ingle is absolutely clear that the common law doctrine of estoppel
is overridden by the statutory scheme in FOIA. That is reinforced in UKRI. Those
principles remain the same regardless of different exemptions being in issue in this
case. As a First-tier Tribunal we are bound to follow decisions of the Upper Tribunal.
The NMC, as the public authority, was not bound by the original exemption that it
reliedupon.Norwas theCommissioner constrainedby the NMC’sgroundof refusal.
82. Indeed, it is well established by the Upper Tribunal in Malnick that:
“the tribunal must consider everything necessary to answer the core question whether the
authority has complied with the law, and so includes consideration of exemptions not
previously relied on but which come into focus because the exemption relied upon has fallen
away.” [102]
83. Thus, this Tribunal must consider exemptions that could apply. We are not limited
in that task by the exemption relied upon by the NMC at the outset. Quite simply,
the Commissioner was not estopped from relying on section 40(5B) and the Decision
Notice was not wrong on that basis.
16Would confirming or denying that the requested information was held constitute the
disclosure of someone’s personal data?
Personal data & “processing”
84. Where information is requested under FOIA and that information contains the
personal data of a data subject, then that personal data would be “processed” when
it is disclosed in response to a request. In respect of the first data protection principle,
this means that the information can only be disclosed if to do so would be lawful, fair
and transparent (Article 5(1) UK GDPR).
85. The parties agree: (i) the requested information constitutes personal data of the nurse
in question, who is the data subject and (ii) disclosure of the requested information
would constitute “processing” of data for the purposes of the section 40 DPA and the
UK GDPR. We agree.
86. Given that the nurse in question is named in the Request, we find that confirming or
denying that the requested information was held would disclose personal data.
Conclusion on whether section 40(5B) is precluded
87. Therefore, the application of section 40(5B) is not precluded in respect of the Request.
That section is capable of being engaged.
Whether confirming or denying that the requested information was held would
contravene any of the data protection principles
Lawful Basis of Processing
88. Inassessing whether theprocessingof the personaldata inquestion wouldbe lawful,
the most relevant lawful basis for processing (in the context of the Request and
appeal) is: (i) data subject consent under Article 6(1)(a), and/or (ii) the legitimate
interests basis under Article 6(1)(f). We consider each in turn.
Whether the data subject consented to disclosure – Article 6(1)(a)
89. The Appellant makes the point that the NMC exists to provide a register of nurses
and midwives, and there is a statutory requirement to publish that register (Article 8
of 2001 Order). The duty to establish and maintain a register of qualified nurses,
midwives and nursing associates is contained within Article 5. Article 8(1) requires
the register to be available for inspection by members of the public at all reasonable
times. However, this Request does not concern information on the current register. It
concerns historic information prior to the existence of the NMC and the 2001 Order.
90. The Appellant’s case is based upon what a nurse must expect if they are struck off
the register, and that such expectation is “tantamount to consent”. We disagree.
91. Article 6(1)(a) must be read in the context of Article 7 UK GDPR. Under Article 7(2),
if consent is given in the context of a written declaration which also concerns other
17 matters, the consent must be clearly distinguishable from other matters, in an
intelligible and easily accessible form using clear and plain language.
92. It is purely speculative that a nurse at the time would have consented to disclosure
of certain information upon registering with the regulatory body and that such
consentwouldbesufficienttoincludedisclosureunderFOIAmanyyearslater.There
is no evidence before us of what was, or likely to have been, signed by the nurse at
the time. Nor do we know whether there was any privacy notice, or the terms of
registration, for instance. Consent would need to be clear, unambiguous and
affirmative in agreeing to disclosure at the date of the NMC’s Response.
93. What we do know, is that a nurse now registered with the NMC would be subject to
a policy whereby the specified publication period for a sanction of striking off the
register is 5 years from the date the order takes force. This is set out at paragraph 30
of the ‘Fitness to Practice Guidance’. Therefore, even if the individual had given
consent (which is not established), the period for disclosure under the current policy
would be 5 years. This period has long expired.
94. We find that the evidence falls significantly short of demonstrating that, on the
balance of probabilities, the individual consented to disclosure of the requested
information. Accordingly, the condition in Article 6(1)(a) UK GDPR is not met for
disclosure to be lawful by reason of the data subject’s consent.
Legitimate Interests Basis – Article 6(1)(f)
95. In some circumstances, a NCND response is an exclusion from the general duty on a
public authority to confirm whether or not it holds the information which has been
requested. The aim of a NCND response is to leave it entirely open whether the
public authority holds the requested information so that no inferences can be drawn
either way, which might in itself be a disclosure of personal data. The ‘lawfulness,
fairness and transparency principles’ also apply in cases such as this.
96. For the purposes of Article 6(1)(f), the Appellant is “a third party” and the individual
who is the subject of the Request is the “data subject”. We proceed to apply the three-
part test identified by Lady Hale in the South Lanarkshire Council judgment. In doing
so, we bear in mind the eight ‘propositions’ endorsed by Upper Tribunal Judge
Wikeley in Goldsmith.
Legitimate interest test
97. The Tribunal agrees with the parties that the Appellant, as a third party, has a
legitimate interest in the requested information for research purposes.
Necessity test
98. We also agree with the parties that disclosure is necessary for the purposes of those
legitimate interests given that the information does not appear publicly and it would
not therefore be available through other means besides a FOIA request. We are
18 satisfied that there is not another, or less intrusive way in which to achieve the
outcome sought by the Appellant. The test of ‘necessity’ is met.
Balancing test
99. Article 8 privacy rights are in issue as the Request seeks personal data regarding
whether or not the named individual was struck off the register maintained by the
regulatory body for misconduct. Consideration thus turns to the ‘balancing test’ and
whether the above interests are overridden by the interests or fundamental rights
and freedoms of the data subject.
100. Extracts from the NMC’s ‘Fitness to Practice Guidance’ and the ‘Information
Handling Guidance’ are provided. These are the NMC’s current policies. They did
not exist during the period that any requested information would relate.
101. An important point made by the Commissioner is that information pertaining to
fitness to practice is not recorded by the NMC on the register in perpetuity. Indeed,
in line with the NMC’s current policies as set out above, the specified publication
periodfor a sanction of striking off the registeris5years from the date the order takes
force. A time limit long expired. It was suggested on behalf of the Appellant that
policieswerelikelythesamegoingbackverymanyyears,butthatisunsubstantiated.
102. Things were quite different in the past before the existence of data protection
regulation and when the 2001 Order was not yet in force with its provisions for
publication of some decisions. There was not the same disclosure of information as
exists now. Indeed, it is hard to imagine that a data subject would expect their data
to be disclosed in the way that is now sought several decades later.
103. An individual who formerly practised as a nurse could no longer be on the
register for a multitude of reasons. Information is no longer recorded on the register
of an individual who was struck off more than 5 years ago.
104. In view of all these factors, we consider that, on balance, the legitimate interest
and necessity for disclosure, is overridden by the data subject’s right to privacy. It
follows that confirming or denying that the requested information was held would
contravene the first data protection principle that personal data must be processed
lawfully and fairly (Article 5(1) UK GDPR and section 35(1) of the Act). The condition
in Article 6(1)(f) is not met.
105. It follows that section 40(5B) is engaged, subject to the public interest test.
Public Interest Test
106. As section 40(5B) FOIA is not an absolute exclusion, but a qualified exemption
from the duty to confirm or deny, the public interest test must be applied. The
Tribunal must determine the public interest in NMC neither confirming nor denying
whether it held the requested information. This involves considering whether in all
19 the circumstances, the maintenance of the exclusion of the duty outweighs the public
interest in disclosing whether the public authority holds the information.
107. The Tribunal must consider the public interest as matters stood at the time of the
decision which the public authority was obliged to make by Part I of FOIA (as per
paragraph 86 of Montague v Information Commissioner and DIT [2022] UKUT 104
(AAC)). As NMC refused the Request on 6 March 2024, that is the date the public
interest must be assessed. However, the Tribunal may properly take into account
circumstances or matters that come to light subsequently where they shed light on
the public interest at the time it fell to be considered.
108. Section 2(2)(b) FOIA requires the Tribunal to conduct a balancing exercise
weighing the factors in favour of maintaining the exemption against the public
interest factors that favour disclosure. The Tribunal has undertaken this balancing
exercise. We start by considering the values and policies that give the public interests
their significance. In this regard, there will always be a general public interest in
transparency. There may also be public interest about the issue and the person to
whom the information relates given their connection to a person of global fame.
109. The Appellant draws attention to the Commissioner’s website which provides;
“If there is a plausible suspicion of wrongdoing, this may create a publicinterest in disclosure.
And even where this is not the case, there is a public interest in releasing information to
provide a full picture.” Press articles provided by the Appellant indicate a high level of
public interest in the information sought in the past. With the passage of time, such
interest may well have diminished by the time the Request was refused.
110. Paragraph 5 of the NMC’s current ‘Fitness to Practice Guidance’ refers to duties
under the NMC’s governing legislation and processes to disclose information at
particular stages of its regulatory process. It refers to the general power under Article
22(10) of the 2001 Order “to disclose information relating to a registrant’s fitness to
practise.”
111. Paragraph 16 states that the NMC keeps a record of all sanctions imposed by any
practice committees, including striking-off. It also keeps a record of warnings and
undertakingsissuedbyCaseExaminers. Paragraph16 proceedstosaythatthesemay
be disclosed to employers and other enquirers on request where it is in the public
interest to do so. The only exceptions are where the information relates to a
registrant’s health, or where an interim order was imposed but the case subsequently
closed without a finding of impairment. Paragraph 64 refers to the legal requirement
to publish details of all sanctions imposed by the NMC’s Fitness to Practise
Committees and unfavourable decisions following a registration appeal. For these
reasons a registrant will not generally have the right to object to publication of such
findings (paragraph 65).
112. The Appellant quotes paragraphs 22 and 27 of the NMC’s ‘Information Handling
Guidance’. Paragraph 22 refers to information provided by a third party who the
NMC has asked to assist with an investigation. It is not readily apparent how this is
relevant in this instance. Paragraph 27 concerns the public register of qualified
20 nurses, midwives and nursing associates on the NMC website. It says that the full
name of each registrant and their recordable qualifications are published along with
any ‘live’ fitness to practise sanction. Given that the individual in this Request is not
in the published register, the Information Handling Guidance does not apply to
them. It is of limited value in applying the public interest test.
113. Indeed, neither piece of Guidance was in place when the nurse in question was
likely to have been practising. This factor further limits the weight that can be given
to those policies in this appeal.
114. Weighed against confirming whether the information is held is that FOIA is,
effectively, disclosure to the public i.e. to the ‘world at large’. That being so,
appropriate consideration and weight is to be afforded in the application of the
public interest test to the protection of the individual’s privacy rights. In this case,
confirming whether the specific information sought was held or not would divulge
personal information about an individual. Given the nature of the Request seeking
information on whether the person was struck off the nursing register for
misconduct, a response other than NCND would likely cause prejudice to the
individual. Such prejudice would likely be of a serious nature. It would also carry a
realistic prospect of being widely shared.
115. Having considered all the circumstances, the Tribunal finds on balance that the
public interest in maintaining an individual’s rights to privacy, based on the legal
principles we have referred to, outweighs those public interests. We view the
principle of the protection of privacy with respect to the processing of personal data
to be paramount.
116. For the reasons above, we find that the public interest in maintaining the
exclusion of the duty to inform under section 1(1)(a) FOIA outweighs the public
interest in disclosing whether the NMC holds the requested information.
Conclusion regarding section 40(5B)(a)(i) of FOIA
117. We conclude that section 40(5B)(a)(i) of FOIA was engaged and that the public
interest in maintaining the exclusion of the duty to confirm or deny outweighs the
public interest in disclosing whether NMC holds the information. Accordingly, we
find that the Commissioner was correct to find that the NMC could rely on section
40(5B) of FOIA to NCND that it held the requested information. It follows that we
agree with the findings of the Commissioner in the Decision Notice in that regard.
118. Given that conclusion, it has not been necessary for us to consider the potential
application of other exemptions under FOIA.
21Other Matters
Section 17 FOIA, the Commissioner’s Code of Practice & other matters
119. The Appellant alleges a failure by the Commissioner to address section 17(1)
which triggered section 10 of the Tribunals and Inquiries Act 1992 to give reasons.
The Appellant is also critical of the Commissioner for failing to address procedural
failings by the NMC and/or advise of the right to apply to the Commissioner under
section 50 FOIA (in breach of section 17(7)).
120. In relying upon section 40(2) FOIA, the NMC did not specify whether subsection
(a) or (b) was relied upon or which of the three following conditions was met for the
exemption to be engaged. However, the NMC did also refer to data protection
principles from which it could be gleaned that the first condition in section 40(3A)(a)
was the provision meant. Section 40(2) FOIA is an absolute exemption where the first
condition referred to in the subsection is met (section 2(3)(fa) FOIA).
121. As it is, the Commissioner’s Decision Notice did record a breach of section 17(1)
FOIA by the NMC for failing to provide a correct refusal notice within 20 working
days that confirms the exemption relied on and explains why the exemption applies.
The Commissioner’s finding resulted from his conclusion that the NMC incorrectly
cited section 40(2) instead of a NCND response under section 40(5B). Having reached
the conclusion that section 40(5B) was engaged, there was no need for findings to be
made on the NMC’s reliance on section 40(2).
122. Under section 17(7) FOIA the NMC’s refusal notice should have contained
particulars of the right conferred by section 50 to complain to the Commissioner. The
Commissioner was wrong to omit a finding of breach in this regard.
123. Section 46(1) FOI requires the Secretary of State to issue a code of practice
providing guidance to relevant authorities as to the practice which it would, in his
opinion, be desirable for them to follow in connection with the keeping, management
and destruction of their records. The Commissioner’s Code of Practice is guidance
only. It does not have the force of law. Whilst it is good practice for a public authority
to undertake an internal review, there are no consequences for a failure to conduct
one in terms of the lawfulness of the Decision Notice.
124. The Decision Notice incorrectly referred to an internal review. That error was
unlikely to affect the outcome, which was based on different reasons from the NMC’s
refusal. In any event, the Tribunal has stood in the shoes of the Commissioner and
considered the Request afresh.
125. ThepointistakenthattheCommissionerwasimpreciseinreferringtothesection
40(5B) exemption when there are subsections within that section. Given the
arguments advanced on appeal, it was sufficiently understood that the
Commissioner referred to section 40(5B)(a)(i).
22126. We have considered other arguments made by the Appellant against the
Commissioner’s handling of the complaint, but the conduct of the investigation was
a matter for the Commissioner’s discretion. Similarly, procedural complaints are
outside the scope of this decision.
Article 6 ECHR
127. In refusing the Request, the NMC relied upon section 40(2) FOIA. When the
Commissioner upheld the refusal on a different ground, he applied the right to
NCNDundersection40(5B)FOIA.Indoingso,itiscontendedthattheCommissioner
was acting as a Judge under the Tribunals and Inquiries Act 1992. It is maintained
that he breached the Appellant’s right to a fair hearing under Article 6 ECHR by
failing to give her opportunity to reply or make submissions on whether the right to
NCND existed.
128. Section 50 FOIA sets out the requirements in the consideration of a complaint
made to the Commissioner and the issue of a decision. There was no requirement for
the Commissioner when dealing with the Appellant’s complaint to seek submissions
on whether another exemption might apply.
129. The right of appeal against the Commissioner’s decision lies to this Tribunal
pursuant to section 57 FOIA. In exercising that right of appeal, the Appellant has had
opportunity to advance her arguments and to be heard. As part of this appeal, the
Appellant has made full submissions on the application of section 40(5B). The task of
the Tribunal under section 58 is to establish whether the Decision Notice is in
accordance with the law or if it involved the exercise of discretion whether such
discretion ought to have been exercised differently. We find no basis to conclude that
the Decision Notice was wrong on the grounds of alleged procedural irregularity.
Overall Conclusion
130. For the reasons given, the Tribunal concludes that the Commissioner’s Decision
Notice was in accordance with the law, and the Commissioner ought not to have
exercised any discretion differently, with one limited exception.
131. The Decision Notice did not address the application of section 17(7) FOIA and
the requirement for the NMC’s refusal notice to contain particulars of the right
conferred by section 50 FOIA. It was therefore flawed in that regard. A substituted
Decision Notice is issued to record an additional finding of breach of section 17(7) by
the NMC for omitting particulars of the right in section 50.
132. To that limited extent only the appeal is allowed. The appeal is otherwise
dismissed.
Signed: Judge Saward Date: 25 June 2026
23
