Appeal References: EA.2019/0307/0308/0309/0310/0311
Information Rights
Determined, by consent, on written evidence and submissions
Considered on the papers on 22 February 2022 and 5 December 2022
Decision given on: 04/01/2023
Before
TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Anne Chafer
TRIBUNAL MEMBER Dan Palmer-Dunk
Between
COLLETTE LLOYD
Appellant
And
INFORMATION COMMISSIONER
Respondent
And
SHERWOOD FOREST HOSPITALS NHS FOUNDATION TRUST
(IN EA/2019.0309 only)
Second Respondent
And
WHITTINGTON HEALTH NHS TRUST
(in EA/2019/0311 only)
Second Respondent
Decision: The appeals are Dismissed.
Substituted Decision Notice: None
REASONS
MODE OF HEARING
The parties and the Tribunal agreed that these matters were suitable for determination on the papers in accordance with rule 32 Chamber’s Procedure Rules.
The Tribunal considered an agreed open bundle of evidence in each of the cases, together with further submissions from the parties submitted after the paper consideration on 22 February 2022.
BACKGROUND
In each of these appeals, and in appeal EA/2019/0285, the Appellant had made a request to an NHS body that read as follows: -
Please could you tell me the total number of live births, the number of prenatal diagnoses of Down Syndrome and the number of live births with Down syndrome in your Trust in the past 8 years? If you collect data in financial years please fill in table A, if you collect data in calendar years please fill in table B [from 2010-2017].
In each case the NHS bodies disclosed some information, but in years where the actual numbers of live births with Down syndrome was under five per year cited the exemption under section 40(2) FOIA (which relates to the disclosure of personal data) as preventing the disclosure of further information. In each case the Commissioner upheld this reliance on s40(2) FOIA.
We remind ourselves that section 40 (2) FOIA reads as follows: -
Any information to which a request for information relates is also exempt information if—
it constitutes personal data which does not fall within subsection (1) (personal information of the applicant], and
the first, second or third condition below is satisfied.
Section 3(2) of the Data Protection Act 2018 (DPA) defines personal data as ‘any information relating to an identified or identifiable living individual’.
As there were a number of very similar requests to a number of NHS bodies, appeals directions were given on 29 October 2019 that the case of Lloyd v Information Commissioner EA/2019/0285 (Footnote: 1) (which concerned a request made to Airedale NHS Foundation Trust), would be treated as a lead case under rule 18(2)(a) Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009. The relevant provisions read as follows: -
18.—(1) This rule applies if—
two or more cases have been started before the Tribunal.
in each such case the Tribunal has not made a decision disposing of the proceedings; and
the cases give rise to common or related issues of fact or law.
The Tribunal may give a direction—
specifying one or more cases falling under paragraph (1) as a lead case or lead cases; and
staying... the other cases falling under paragraph (1) (“the related cases”).
When the Tribunal makes a decision in respect of the common or related issues—
the Tribunal must send a copy of that decision to each party in each of the related cases; and
subject to paragraph (4), that decision shall be binding on each of those parties.
The decision in EA/2019/0285 was dated 11 February 2021 and the Tribunal upheld the decision notice in that case and the reliance on s40(2) FOIA in relation to years where there were under five relevant births. The full decision in that case is included as an annex to this decision. At paragraph 35 the Tribunal said: -
Thus, in the present case, applying the Appellant’s own approach, if the numbers in this case are disclosed, she will know exactly how many children were born in the area with Down syndrome. As the Appellant says, if she takes that information and obtains further information from a Down syndrome child or the child’s parents (or obtains the information from social media platforms as the Appellant suggests could happen), the Appellant (or anyone else) would be able to tell the child and/or their parents the exact size of the cohort of those born with Down syndrome in that year and place the child in that cohort. In our view the Commissioner has correctly identified, therefore, the information as personal data.
The Registrar issued further directions on 23 February 2021 that these current appeals were to be placed before a Judge for consideration of disposal on the basis of the lead case’s decision, citing rules 18(4) and (5) which read: -
Within 28 days after the date on which the Tribunal sent a copy of the decision to a party under paragraph 3(a), that party may apply in writing for a direction that the decision does not apply to, and is not binding upon the parties to, a particular related case.
The Tribunal must give directions in respect of cases which are stayed under paragraph 2(b), providing for the disposal of or further directions in those cases.
The directions went on to say: -
If, by 16 April 2021, the Tribunal has not received any application(s) under rule 18(4) these appeals will be placed before a Judge for consideration of disposal on the basis of the lead case’s decision.
No such applications to the effect that the lead case did not apply to these appeals were received and the matters came before the Tribunal to be considered on the papers on 22 February 2022 (almost exactly one year after the directions given by the Registrar). The expectation at that point was that the Tribunal would confirm that the decision in EA/2019/0285 would be binding in the cases that had been stayed.
However, since the date of those 2021 directions, and before the consideration by the Tribunal on 22 Febraury 2022, the Upper Tribunal (UT) gave judgment in the case of NHS Business Services v Information Commisisoner and Spivack [2021] UKUT 192 (AAC) (Spivack) on 6 August 2021, which dealt with the issue as to what should be considered to be ‘personal data’ and which are potentially relevant to these appeals: -
The UT reviewed the current case law (much of which was considered in the EA/2019/0285 decision) and noted some uncertainties and ambiguities (see paragraphs 27 and 31 for example) which needed to be explained and considered with care.
A firm conclusion was reached by the UT in Spivack that the law ‘creates a binary test: can a living individual be identified, directly or indirectly? If the answer is ‘yes’, the data is personal data. Otherwise, it is not’ (paragraph 12). It is also stated that ‘The test has to be applied on the basis of all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer….’ (paragraph 13).
The guidance issued by the Commissioner (relied on by the Commissioner in EA/2019/0285) does not assist and ‘will not be useful’ (paragraph 8).
There is a common practice ‘for statistical publications and releases to redact or round small numbers, or otherwise adapt tables and results so that numbers lower than some thresholds are usually suppressed’ for the purposes of reducing risk of disclosure of personal information, but ‘this is not what the law requires’ (paragraph 36).
Following the consideration of these cases on the papers on 22 February 2022 the Tribunal issued further directions which are dated 2 May 2022.
The Tribunal noted that in the current cases (as in EA/2019/0285) the decision notices set out that the withheld data ‘may link with other information or knowledge’ such as to ‘make identification of the data subjects possible’, and then conclude that the Commissioner ‘is satisfied that this information both relates to and identifies the children. This information therefore falls within the definition of ‘personal data’ in section 3(2) of the DPA’. The directions of 2 May 2022 stated that ‘it seems to the Tribunal that, applying Spivack, unless the factors referred to can definitely be said to identify the data subjects when linked with the withheld data, then the information sought is not personal data’.
The Tribunal decided that-
Upon consideration of the judgment in Spivack this Tribunal is no longer of the view that that the decision in EA/2019/0285 should be treated as binding upon the parties in the current appeals on the specific issue only as to whether the requested information amounts to personal data and should no longer be treated as a lead case in relation to that issue.
Effectively, the Tribunal reversed the decision that EA/2019/0285 should be considered as a lead case pursuant to rule 18(2)(a), and then went on to give the parties an opportunity to make further submissions before reaching a conclusion on each of the appeals.
The Tribunal also invited submissions from the two NHS bodies who were parties to the appeals and invited the other NHS bodies to apply to be joined as parties if they wished to make submissions. In the end there were no further submissions from the NHS bodies but there were further submissions from the Commissioner and the Appellant.
SUMMARY OF THE POSITION IN EACH CASE
Appeal EA/2019/0307 Northern Devon Healthcare NHS Trust
The relevant part of the decision notice (Reference: FS50841713) in this case states: -
The Trust stated that the information relates to individuals within a small geographical area, and it remains ’convinced that the release of extremely small patient numbers can very easily be combined with other information already in the public domain or released in the future as part of a mosaic or jigsaw affect and allow identification of individual Downs syndrome children within our small rural area’.
The Trust stated that its concerns related to both:
‘Self-identification; where the child or their parents/close family are able to recognise or identify themselves /the child from this disclosed information. It is highly likely that distress would be caused by this self-identification as negative emotions are involved from recognising the child’s disability and isolation within the community.
Motivated intruder risk: where a third party (media, commercial, or action group) for whatever reason is able to determine or infer who the data relates to or is able to piece this information together with other information to identify the child(ren) in question. The additional information potentially coming from: the educational sector, media or social media.’
The Trust gave an example of its concerned route to identification as a ‘child born in 2011 (8 years old) with Downs syndrome in the town or near vicinity of Barnstaple (where our Maternity Unit is based and given the age of the child on the balance of probabilities the family still lives in the area).
Appeal EA/2019/0308 East Lancashire Hospitals NHS Trust
The relevant part of the decision notice (Reference: FS50841725) in this case stated that: -
The Trust considered the steps that a motivated individual could take to identify the individuals from the numbers if disclosed.
- The data relates to children who, dependant on the year, will now be of school age. Children with Down syndrome can require additional support and although they may attend a mainstream school, it is likely that they will attend a school that is able to cater for their specific special needs.
- It is possible to look at other freely available information, such as the list of schools for children with special educational needs to see which schools fall within the boundary of the Trust. https://www.lancashire.gov.uk/children-educationfamilies/special-educational-needs-anddisabilities/education/schools/special-schools-and-short-stayschools and https://www.blackburn.gov.uk/schools-andeducation/school-lists/special-schools.
- It is highly probable that these children now attend one of these schools. Indeed, two schools for children with special educational needs are located next to the hospital and would cater to children that fall within the years requested.
- The requester could send additional POIA requests to the schools or councils asking for a breakdown on the number of children that attend and what conditions they have or search for information that may now be in the public domain from past requests. Should the school confirm that they did have students attending with Down syndrome, there would be a possibility for a motivated individual to take steps to identify them.
- Once the information is released in response to a POIA request it is in the public domain and there is nothing to stop a motivated individual with ulterior motives from using this to target those individuals in question.
Thus, East Lancashire Hospitals NHS Trust appears to have addressed a test of remoteness or likelihood, rather than whether the information sought can lead to the identification of a living individual, directly or indirectly.
Appeal EA/2019/0309 Sherwood Forest Hospitals NHS Foundation Trust
The relevant part of the decision notice (Reference: FS50840752) in this case provided that: -
The Trust stated that ‘due to the very small numbers of patients with this diagnosis, combined with additional datasets likely to be available from our Trust or other public bodies such as education authorities/council. It may be distinctly possible for a ‘motivated intruder’ to combine or link datasets and risk inappropriately identifying the sensitive genetic data of individual patients involved.
The Trust also stated that ’the information to be released constitutes physical and genetic data that relates to an identifiable living individual.’
Thus, it appears that the Sherwood Forest Hospitals NHS Foundation Trust has addressed a test of remoteness or likelihood, rather than whether the information sought can lead to the identification of a living individual, directly or indirectly.
Appeal EA/2019/0310 Poole Hospital NHS Foundation Trust
The relevant part of the decision notice (Reference: FS50846461) in this case provided that: -
The Trust stated that to assist the complainant it had provided an overall total for the years requested. The Trust appreciated that with disclosure of the suppressed figures ’it might have been difficult to identify individuals, but along with any other information obtained this may have become extremely easy, and we must maintain patient confidentiality’.
The Trust referred to the Commissioner’s guidance on the physical, physiological and genetic, identifiers of an individual and stated its concerns ’if the information obtained were to be published, and the Trust were identified along with this data, it has the potential to identify, and could lead to possible complaints and action taken against the Trust.
Thus, Poole Hospital NHS Foundation Trust appears to have addressed a test of remoteness or likelihood, rather than whether the information sought can lead to the identification of a living individual, directly or indirectly.
Appeal EA/ 2019/ 0311 – Whittington Health NHS Trust
The relevant part of the decision notice (Reference: FS50841731) in this case provided that: -
The Trust stated that the information relates to individuals who ‘could be identified indirectly in particular by reference to factors specific to the physical and physiological identity of the individual...’
The Trust took the decision to aggregate the numbers and provide a range of 1-5 rather than exempt the request as a whole. The range took into account ’the risk of identification of a mother/child with a rare medical and genetic condition affecting only a single gender (the mother who gave birth) localised to a single hospital. The patients affected by this request are categorised as a vulnerable patient group.’
22.The Trust also considered whether there was any further information currently available in the public domain that if combined with this dataset, could increase the risk of identification of an individual. The Trust provided the Commissioner with examples of data currently available for its hospital (ethnicity, age, EM and numbers of mothers booked in for birth per month - source: https://digital.nhs.uk/data- and information/data-collections-and—data sets/data sets/maternity services- data set/maternity-services-dashboard).
THE APPEAL AND RESPONSES
The Appellant relied on the same grounds as were summarised in EA/2019/0285 as follows at paragraph 25: -
‘The Personal Data Ground’: The Appellant appears to dispute the Commissioner’s finding on the facts that the data sought was "personal data".
‘The Special Category Ground’: The Appellant contends, in respect of paragraph 31 of the decision notice that ‘the physical characteristics of the natural person/child in this case are the identifier and that disclosing how many children with that genetic make-up were born at a particular location in a particular year, adds nothing to their identification’. As understood, the Appellant does not dispute the finding that the data sought was special category data.
‘The Necessity Ground’: The Appellant disputes the Commissioner's findings at paragraphs 49 and 50 of the decision notices.
As to paragraph 49, she asserts that " ... people with Down syndrome can be subject to prejudice and bullying, however, this would be due to the physical characteristics, not because they are one of 4 born in that year or even that they were the only one born in that year. I would strongly suspect, due to early intervention, Facebook and support groups that the parents are already very aware of other children around the same age as their own who happen to have Down syndrome. Further, it is notoriously difficult to work out what age a child with Down syndrome is, due to them often looking significantly younger than they are, and sometimes, not always, being placed out of year in an educational placement."
As to paragraph 50, the Appellant disputes that NDSCR, which is published by region (not by hospital trust) meets her legitimate interest. The Appellant asserts: "... it is important (a) to gain correct baseline data for national evaluation, and in the case of trusts that are already offering NIPT, this data may be skewed and (b) to anticipate the effects on live birth rates of this national roll-out."
However, and as pointed out by the Commissioner (and by the Tribunal in paragraph 35 of EA/2019/0285) the Appellant also stated in her grounds of appeal that the information sought ‘would not make anything about that person identifiable that was not already known’. The Appellant went on to say that ‘The information I would be given would, at the most, allow me to meet someone with a child with Down syndrome, and be able to say (after verbally asking where they were born and in what year) that they were the only, or one of two, three or four babies that were born with Down syndrome at that hospital trust in that year’.
That is a submission which is repeated in all these appeals.
The Commissioner’s essential submission was that, whether or not the Commissioner had adopted a Spivack-compliant approach in the decision notice, the Tribunal, in its decision in EA/2019/0285, had applied the correct approach and so, applying the same approach to these appeals would produce a result which would mean the appeals should be dismissed. The Commissioner relies, to an extent, on the above submission made by the Appellant in all her appeals as supporting this position.
In response the Appellant says as follows: -
I note the heavy reliance on the example I gave as a way of potentially identifying an individual. In that example I was trying to illustrate the ridiculousness of all the processes that would have to be gone through, the complicities of the caretaker in answering the questions around date of birth etc and how no-one would do this, ever. In fact, I have now had this data for many, many hospitals for five years and despite numerous stories in the media about Down Syndrome, no one has ever attempted this convoluted set of steps in order to attempt to identify individuals. Further if they ever did, I sincerely doubt that they would be able to as it would require cooperation from the caregivers. Therefore, it would not be possible within any reasonable scenario to identify someone using the data I need. Please can someone think about this in the real world. The fact that my convoluted example has been taken as a potential scenario and used as the basis of this dismissal is very surprising.
DISCUSSION
As set out above, in Spivack at paragraph 12, having set out this definition of ‘personal data’ in section 3 DPA and Recital 26 to the General Data Protection Regulation (EU) 2016/ 679, UTJ Jacobs held:
Section 3 of the 2018 Act creates a binary test: can a living individual be identified, directly or indirectly? If the answer is ‘yes’, the data is personal data. Otherwise, it is not. That is what the Act says, and it is consistent with the Regulation. There is no mention of any test of remoteness or likelihood.
Whilst the Commissioner found in each of the decision notices under appeal in this case that the information sought itself did not ‘directly identify individuals’ that does not mean an individual is unable to be ‘indirectly’ identified from that information (which, as Spivack confirmed, also comes within the definition of s3 DPA).
In Information Commissioner v Miller [2018] UKUT 220 (AAC) at paragraphs 12-16, the Upper Tribunal acknowledged the ‘motivated intruder’ test, which relates to ‘…a person who starts without any prior knowledge but who wishes to identify the individual or individuals referred to in the purportedly anonymised information and will take all reasonable steps to do so.’
Again, in Miller the UT noted that a similar approach was taken by the Court of Session (Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at paragraph 24:
…it is not just the means reasonably likely to be used by the ordinary man on the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist…
The adoption of this test was confirmed in Spivack at paragraph 33.
As set out above, the Tribunal found at paragraph 35 of the EA/2019/0285 case that the information in that case was personal data, essentially applying the ‘motivated intruder’ test and the description by the Appellant in her appeal as to how, if she were so motivated, she would be able to discover the identity of a Down syndrome child by combining the withheld information with other available information.
In relation to these appeals, the Appellant disputes whether her approach would, in fact, enable the identification of individuals. We are, of course, not bound to follow the approach of the Tribunal in EA/2019/0285. The Appellant now says that she presented her example ‘to illustrate the ridiculousness of all the processes that would have to be gone through’ to identify a Down child if the withheld information were disclosed. She says that ‘no one has ever attempted this convoluted set of steps in order to attempt to identify individuals.
However, simply because someone has not attempted to combine the withheld information with other information available to identify a child does not mean that it cannot or will not be done. We have to consider (to cite the Craigdale case) ‘the means which are likely to be used by a determined person with a particular reason to want to identify the individual…using the touchstone of, say, an investigative journalist’. It seems to us that when considering the submissions by the public authorities (as cited in the extracts from the various decision notices set out above), as to how individual children would be identifiable (albeit ‘indirectly’) together with the approach suggested by the Appellant, that individual children would indeed be identifiable if the withheld information is disclosed.
That was the approach in the EA/2019/0285 case as explained by the Tribunal at paragraphs 28-35. Having considered the further submissions of the parties and the decision in Spivack, we agree with the Commissioner that the Tribunal decision in EA/2019/0285 is correct, and therefore applying the same approach to the information in these appeals produces the result that the withheld information is personal data.
Having reached that conclusion, we are also of the view that the same approach as in EA/2019/0285 should be adopted (see paragraph 36-41). Thus: -
The information sought is also special category information and none of the exceptions in Art 9(2) GDPR apply (see paragraphs 36-37).
Even if the information is not special category information, then disclosure is not necessary to meet the Appellant’s legitimate interests, applying Art 6 GDPR (see paragraphs 38-40).
The fact that the Appellant has offered to give an undertaking not to disseminate the information further cannot be a factor to take into account because, once disclosed under FOIA, the information is in the public domain (see paragraph 41).
Having reached those conclusions, these appeals are dismissed.
Signed Judge Stephen Cragg KC Date: 22 December 2022