Rosamund Ridley v The Information Commissioner

The information sought by the Appellant’s request was not held by the relevant public authority at the time of the request.

Accordingly, the appeal is dismissed.

The Department of Health & Social Care (‘DHSC’) is a ministerial Department of State.

On 28 October 2021 the Appellant, Ms Rosamund Ridley, wrote to DHSC requesting information in these terms (question mark and sic added):

DHSC responded on 19 November 2021, denying that it held any information within the scope of the request but drawing attention to guidance on patient data safety issued by NHS Digital, an executive non-departmental body of DHSC.

Ms Ridley challenged DHSC’s answer but, following an internal review completed on 11 January 2022, it confirmed it.

Ms Ridley complained to the Respondent (‘the Commissioner’) about the way in which DHSC had dealt with her requests. An investigation followed.

In the course of the investigation Ms Ridley stated that she had directed her request not only to DHSC but also to NHS Digital and a third public body, the National Data Guardian, and that all three had denied holding the information sought and suggested that one of the others might hold it. She considered it inconceivable that it was held by none of the authorities approached.

By a Decision Notice dated 20 September 2022 (‘the DN’), the Commissioner determined, on a balance of probabilities, that the Department did not hold the information requested. (Footnote: ¹ )

By her notice of appeal (Footnote: ² ) Ms Ridley challenges the Commissioner’s decision. She recites the history already mentioned of her unavailing requests directed not only to DHSC but also to NHS Digital and the National Data Guardian, stresses the obvious importance of the information sought (in particular its bearing on the security of patient data) and draws attention to the breadth of DHSC’s responsibilities for regulating healthcare professionals and protecting the public. In short, she argues that DHSC must hold information within the terms of her request. She also argues that the balance of probabilities is not the appropriate test given the seriousness of the subject-matter with which she is concerned (although no alternative test is proposed).

By a response dated 28 November 2022 the Commissioner resisted the appeal, essentially on the grounds set out in the Decision Notice.

The appeal came before us for consideration on the papers. Both parties had expressed themselves content with that procedure and we were satisfied that it was just and proper to decide the matter without a hearing.

By the Freedom of Information Act 2000 (‘FOIA’) s1(1) a person making a request for information to a public authority is entitled to be told in writing by the public authority whether it holds information of the description specified in the request and, if so, to have the information communicated to him/her.

For the purposes of FOIA, ‘information’ means information recorded in any form (s84).

A request for a public authority to generate an explanation or a commentary is not a request for information within the scope of the freedom of information legislation (Betts v Information Commissioner (EA/2007/0109), FTT 18 May 2018, paras 33, 68).

Information is ‘held’ by a public authority if it is held by it otherwise than on behalf of another person, or it is held by another person on behalf of the authority (FOIA, s3(2)). Whether particular information is ‘held’ by a public authority is essentially a question of fact (University of Newcastle upon Tyne v ICO and BUAV [2011] UKUT 185 AAC, [41]).

Any question as to whether requested information is ‘held’ is to be decided on a balance of probabilities (Bromley v Information Commissioner and Environment Agency EA/2006/0072).

The appeal is brought pursuant to FOIA, s57. The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

We start by reminding ourselves that requests under FOIA are to be interpreted broadly and pragmatically. Pedantry is to be avoided. The public authority must focus on the essence of what is asked for, eschewing technicalities. So directed, we understand the request to address the means (“how?”) by which (a) the safety of NHS records communicated by any NHS doctor in the course of non-NHS work to any third party and (b) “comprehension” of the information which such data contains, is monitored. As to (b), it seems to us that the request must extend to any information elucidating, interpreting or commenting on any NHS record within (a). We also consider that a broad reading must treat the request as embracing information generated by any monitoring as well as information about any monitoring process or system.

Adopting, in Ms Ridley’s favour, an ample approach to her request, we have nonetheless concluded that her appeal fails. We have six main reasons.

First, we see no basis for inferring that DHSC has taken a narrow or technical line in interpreting the request.

Second, contrary to Ms Ridley’s argument, the appeal must be determined on a balance of probabilities (see above). The law is very clear. (We would add that the Commissioner’s references in the DN (paras 15 and 17) to an absence of “compelling evidence” in support of the appeal is unhelpful and we have been careful not to apply that test ourselves.)

Third, we agree with the Commissioner that the appeal really amounts to a complaint that DHSC ought to hold material within the scope of the request. Ms Ridley may be right about that, but the question for us is a purely factual one: was the information held at the time of the request? And in so far as she is to be taken as arguing that the importance of the security of NHS records is such as to make it improbable that the information was not held by DHSC, that proposition is nowhere near established on the slender material before us. It amounts to mere assertion. Before forming a view on (a) whether it was likely that relevant information existed at all or (b) whether, if it existed, it was likely to be held by DHSC, we would need to know much more than we do about policies and procedures concerning data safety generally across the NHS as a whole and about where recorded information about such policies and procedures, or generated by them, can reasonably be expected to be held. The NHS is a massive organisation and responsibilities for its governance are spread across a number of public bodies, of which DHSC is but one.

Fourth, there may be a simple explanation for the negative response to the request, namely that the information is not and was not held because DHSC is concerned with the NHS and Ms Ridley’s interest is in the protection of data (albeit relating to NHS patients) in a non-NHS setting.

Fifth, there is, on the other hand, force in the Commissioner’s suggestion (DN, para 18) that, if there is a “regulatory blind spot,” that tends to support DHSC’s position that no information within the scope of the request exists (or existed at the date of the request).

Sixth, the logic of Ms Ridley’s case has to be either that DHSC has carelessly failed to locate the information sought as a result of not carrying out a sufficiently diligent search or that it has deliberately withheld it. Neither theory is at all convincing. DHSC must be taken to have document retrieval systems which would enable the information asked for to be located very quickly, if it was held. And we can conceive of no possible motive for wilfully suppressing it. Faced with Ms Ridley’s request, he public authority would surely regard its position as strengthened if it was in a position to disclose documents evidencing a system of scrutiny and monitoring relating to NHS patient data security.

For all the reasons given, the appeal is dismissed.

Nothing in our decision or reasons should be taken as underestimating the importance of the subject-matter of Ms Ridley’s request.

Finally, we would add that in our view DHSC’s handling of Ms Ridley’s request could be seen as perfunctory. Hard-pressed public authorities are not expected to spend excessive resources on FOIA requests, but should at least to engage in sufficient correspondence to establish exactly what the requester is seeking and, if appropriate, offer suitable advice. The duty to advise and assist (FOIA, s16) is an important obligation.