Sid Ryan v The Information Commissioner & Anor

The appeal is Dismissed.

This appeal is brought under section 57 of the Freedom of Information Act 2000 (“FOIA”) against the Commissioner’s Decision Notice dated 5 December 2022 (“the DN”) with reference IC-146236-ROF1 which is a matter of public record.

The Tribunal conducted a hearing by CVP and considered an Open Bundle (“OB”) of 921 pages, a Closed Bundle (“CB”) of 384 pages and Skeleton Arguments from Mr Ryan and Mr Hopkins, on behalf of NHS England (“NHSE”).

It is necessary to withhold the information in the closed bundle because it contains the withheld information and to do otherwise would defeat the purpose of the proceedings.

The Closed Bundle included unredacted versions of the withheld information, correspondence between NHSE, the third party healthcare providers and the Commissioner as part of the Commissioner’s investigation.

The Tribunal heard a submission from Mr Hopkins, on behalf of the NHSE, and a submission and evidence from Mr Ryan.

In reaching its decision the Tribunal took into account all the evidence before it and made findings on the balance of probabilities.

The full details of the background to this appeal, the Mr Ryan’s request for information and the Commissioner’s decision are set out in the DN.

On 6 April 2021, Mr Ryan made a FOIA request to NHSE in the following terms:

On 26 August 2021 the NHSE provided its response to the Request and on a couple of occasions during the Commissioner’s investigation. Mr Ryan was provided with or sent a link to the following information:

The NHSE asserted that it was withholding the actual invoices under section 31(1) FOIA as well as maintaining the reliance on section 40(2), section 43(2) and section 41 in respect of the redactions to the KPMG Validation Reports. NHSE confirmed it did not hold anything further in scope of Part 2 of the request.

On 5 December 2022 the Commissioner issued the DN. The decision was as follows:

On 1 February 2023 Mr Ryan appealed the Commissioner’s DN.

Section 1(1) FOIA provides that any person making a request for information to a public authority is entitled (a) to be informed in writing by the public authority whether it holds information of that description and (b) if so, to have that information communicated to him.

Part II of the Act contains a range of exemptions from the general right of access to

Section 43 FOIA provides as follows:

In Department for Work and Pensions v Information Commissioner & Zola [2016]

‘Commercial interests’ should be interpreted broadly. The ICO Guidance states that a commercial interest relates to the ability to participate competitively in a commercial activity.

The exemption is prejudice based. ‘Would or would be likely to’ means that the prejudice is more probable than not or that there is a real and significant risk of prejudice. The public authority must show that there is some causative link between the potential disclosure and the prejudice and that the prejudice is real, actual or of substance. The harm must relate to the interests protected by the exemption.

Section 31 FOIA provides an exemption for information relating to law enforcement. Amongst other things, information will be exempt if its disclosure would, or would be likely to, prejudice the prevention or detection of crime (section 31(1)(a)).

The public interest test: sections 43 and 31 FOIA are “qualified” exemptions meaning that, where they are engaged, the right to have information communicated under section 1(1)(b) FOIA does not apply “if or to the extent that…in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information”.

On an appeal under section 57 FOIA the question for the Tribunal pursuant to section 58(1)(a) FOIA is whether the notice against which the appeal is brought is “in accordance with the law.” The Tribunal is entitled to review any finding of fact on which the notice in question was based: section 58(2) FOIA. The Tribunal stands in the shoes of the Commissioner and takes a fresh decision on the evidence. The Tribunal does not undertake a review of the way in which the Commissioner’s decision was made.

Mr Ryan set out the background to the request in his Grounds of Appeal documents at pages 24 to 27. In the light of the disclosure of information by the NHSE, Mr Ryan submits the focussed grounds of appeal as follows:

The Commissioner submits the following grounds:

The NHSE submits the following grounds:

NHSE has disclosed the so-called “line 1” information from each invoice, namely the costs submitted to NHSE by Circle Health and Spire Healthcare over the relevant period. The term “line 1” should not be read overly literally: NHSE disclosed all lines from all relevant invoices that contained information on the sums claimed by the invoicing provider. This information tells Mr Ryan, on an invoice-by-invoice basis, what sums each provider claimed for.

Mr Ryan argues that the invoices must have contained more data beyond the line 1 information that has been disclosed to him. NHSE has confirmed to him that this is not correct. The IC has considered the relevant invoices and concurs. The Tribunal is invited to consider examples of invoices in the closed bundle and to concur likewise. This aspect of Mr Ryan’s appeal is misplaced.

NHSE withheld the remaining information that would be disclosed by means of copies of the invoices themselves, in reliance on section 31(1)(a) FOIA. The concern is that disclosure of copies of original invoices would be likely to assist those seeking to submit fraudulent invoices to NHSE, because they would know how to make their fraudulent invoices look as authentic as possible. This concern was borne out by actual experience. This ground of appeal is misguided. Mr Ryan does not explain what additional information he requires from the invoices. FOIA applies to information rather than documents per se.

The public interest favours maintaining the exemption of section 31(1)(a) FOIA. No good would be served in disclosing copies of actual invoices and would create a risk of attempts at fraud.

The appeal should be dismissed. Mr Ryan and the public have all the relevant information from the invoices i.e. the amounts for which the two private healthcare providers claimed.

NHSE did not unquestioningly make payment in the invoiced amounts. It scrutinised whether each sum claimed by the private healthcare providers was justified. It did so by commissioning KPMG to assess the invoiced sums against granular cost data submitted by the relevant providers. In relation to the period and providers covered by Mr Ryan’s FOIA request, there were 12 such reports. These are the adjustment reports that NHSE has disclosed to Mr Ryan in redacted form.

The costing data has been withheld in reliance on sections 41(1) FOIA (actionable breach of confidence) and 43(2) FOIA (prejudice to the commercial interests of the providers and also NHSE). The IC’s analysis focused on section 43(2): he was satisfied that the exemption applied and did not need to consider section 41(1). NHSE maintains that the information redacted from the adjustment reports is exempt under both of those exemptions.

It is clear from the unredacted versions of the adjustment reports that the redacted information comprises detailed cost data provided to KPMG (and thus NHSE) by the two providers to demonstrate that the sums they were claiming were properly payable according to the detailed payment provisions of their contracts with NHSE. That is precisely the sort of information that falls within the contractual confidentiality provisions imposed by contract. Such information goes to the heart of a business’ commercial interests.

Section 41(1) FOIA is engaged and is an absolute exemption, The redacted information is exempt. Unless Mr Ryan can establish a public interest in disclosure that would be strong enough to defeat an action for breach of confidence. That is a high hurdle: there is a presumption that confidences will be respected. The public interest defence under section 41(1) FOIA entails a different test and more onerous test than the section 2(2)(b) FOIA public interest balancing test. That high hurdle is not met here, in particular because there is a wealth of other relevant information that would assist the public in understanding the sums claimed and the sums paid. Sums over £25k are and were published on a provider-by-provider, invoice-by-invoice, month-by-month basis in NHSE’s publication scheme and the published contracts governing how payment worked.

If NHSE were to have disclosed in or around April 2021 the information it redacted from the KPMG adjustment reports for reasons unrelated to its FOIA obligations (which is the test laid down in section 41(1)), the providers would have been able to take action against NHSE for breach of confidence, and they would have been very likely to win.

The redacted information is exempt, also, under section 43(2) FOIA by reference to the providers’ commercial interests as stated by the Commissioner:

With reference to the commercial interests of NHSE the Commissioner noted as follows:

At the time of Mr Ryan’s FOIA request in April 2021 there was a real prospect of NHSE needing to enter into further arrangements comparable to those at issue in this appeal. Its ability to do so, or to do so on favourable terms, would have been harmed by the disclosure of the information NHSE has redacted from the KPMG adjustment reports.

Mr Ryan appears to accept that he seeks the public disclosure of highly sensitive commercial information.

The public already has ample information by which to assess what providers claimed, what they were actually paid, and how the contractual arrangements for their services and payments worked. The incremental benefit (if any) from the publication of the information redacted from these KPMG adjustment reports is much weaker than the harm that disclosure would cause.

In relation to the request for payments made this data has all been published on a provider-by-provider, invoice-by-invoice, month-by-month basis in NHSE’s publication scheme.

The NHSE has made clear that it has provided the only information it holds in relation to the so-called “activity dataset.” The NHSE does not hold any other information. NHSE holds information relating to invoice sums, KPMG’s adjustment analysis of those invoices and the resulting payments.

The NHSE identified all of the recorded information it held that met Mr Ryan’s request, and it disclosed it (subject to justifiable exemptions). It did not – and does not – need to engage in further dialogue on this request. Mr Ryan’s insistence on dialogue is misplaced and has the character of an open-ended fishing expedition that FOIA does not require public authorities to facilitate.

Mr Ryan’s vague speculations as to additional information he thinks was held and should have been disclosed lack foundation in fact or law. His reliance on section 16 FOIA takes matters no further, and while he understandably highlights the delays in NHSE’s responses to his request and internal review communications (for which NHSE apologises), none of that demonstrates that NHSE holds any further information that, on a fair and objective reading of this request, it held and should have disclosed.

Mr Ryan told the Tribunal that he had Autism but had received no diagnosis, had only spoken to his GP about this, was high functioning and required no reasonable adjustments at the hearing to enable him to engage fully.

At the hearing Mr Ryan argued that under section 16 the NHSE, like all regulators, had an obligation to assist him and he felt that if he had told the NHSE that he had Autism he would have been shown more consideration and received more help with his request. He expected to be advised about the breadth of his request and offered assistance in refining it. He believed that the duty under section 16 should include regard for his needs notwithstanding that he had no diagnosis and had not informed NHSE that he believed he was neurodivergent.

He expressed disappointment about the length of time it had taken for there to be disclosure.

Mr Ryan asked that the Tribunal satisfy itself that the invoices included in the Closed Bundle contained no other undisclosed information.

Mr Hopkins submitted that the duty on the NHSE under section 16 of FOIA was to provide advice and assistance “so far as it would be reasonable to expect” and this did not include making suggestions to Mr Ryan about what he might wish to request or what other requests he could make. Mr Hopkins referred to section 8(1)(c) FOIA which framed what a request is namely a “request for information” that describes the information requested. He submitted that this section does not describe a regime whereby a dialogue is opened in which a requester could make enquiries about what information may be available that would be of assistance. The regime of the FOIA requires a requester to state what information they want to receive. In relation to the section 16 duty Mr Hopkins submitted that this did not stretch to officers telephoning Mr Ryan and suggesting other lines of enquiry by way of assistance.

Mr Hopkins submitted that having disclosed the requested information, it was hard to know what else the NHSE could do.

Mr Ryan accepted that if Line 1 information was all the information available on the invoices he had received all the information in his request.

The Tribunal conducted a closed session to ask questions of Mr Hopkins, on behalf of the NHSE. Mr Sivers asked two questions to assist the Tribunal relating to the invoices in the closed bundle. Mr Hopkins drafted The Gist of the closed session which was provided to Mr Ryan who stated that if all the information on the invoices had been disclosed he had all the information he required. The answers to the questions established that:

Although it was not known whether standard industry invoice documents were used in terms of layout and font or whether an NHSE template was used, it made no difference in relation to the S.31 concerns.

Weight should be attached to the providers’ concerns that disclosure of granular cost data would impact negotiations with insurers who would gain insights into the providers’ margins. This point was considered in Royal Marsden NHS Foundation Trust v IC ad Rowland (EA/2021/0047) and the prejudice to commercial interests for public disclosure of information relating to profit margins.

Mr Hopkins answered by reference to (i) the providers’ own indications of concern about e.g. the impact of negotiations with insurers, who would gain insights into the providers’ margins if they had sight of this granular cost data, and (ii) by way of practical illustration in Tribunal case law: the Royal Marsden case cited at para 29 of NHSE’s skeleton, in which the Tribunal considered evidence of exactly that concern, i.e. how disclosure of cost data would prejudice a private provider’s negotiations with insurers.

On an appeal under section 57 FOIA, the task for the Tribunal is to determine whether the DN is in accordance with the law (section 58(1)(a) FOIA). The Tribunal is entitled to review any finding of fact on which the notice in questions was based (section 58(2) FOIA).

In reaching its decision the Tribunal took into account all the evidence before it whether or not specifically referred to in this Decision. The Tribunal applied the legislation and case law as set out above.

The background to the Mr Ryan’s request is that in the light of the strain on the capacity of NHS facilities during the Covid-19 pandemic in 2020 NHSE entered into contracts with private healthcare providers to reserve parts of their capacity. The contracts were entered into pursuant to the National Health Service Commissioning Board (Coronavirus) Directions 2020.

There is an example set of contractual documentation and those contracts specify the services covered and details of how payments would work (pages 696 to 713).

The Tribunal found that the contracts contained an express provision for certain information to be treated as confidential, for example, in clause 7 (pages 675, 826 and 847).

The Tribunal found that payments made under the contracts by NHSE were checked against invoices submitted by the private healthcare providers.

The Tribunal found that KPMG as auditors scrutinised the invoiced sums and the data relating to the sums claimed and the services provided and KPMG produced regular reconciliation reports.

The Tribunal found that the NHSE disclosed the ‘Line 1’ information from each invoice. This provided the costs submitted to the NHSE by Circle Health and Spire Healthcare over the relevant period in the Mr Ryan’s request namely from March 2020 to 6 April 2021. The Tribunal found that the NHSE disclosed all the lines from the relevant invoices and provided information on the sums claimed by the invoicing providers. The information provided gives on an invoice-by-invoice basis what sums each provider claimed for.

The Tribunal considered the invoices in the Closed Bundle and found that having considered the relevant invoices they do not contain more data beyond the information provided.

The Tribunal finds that there was no confusion as to the scope of the request and what Mr Ryan was seeking. This was not mentioned in the DN, so it was not before the Tribunal in any event.

Mr Ryan sought the original documents rather than the data extracted from them. NHSE applied section 31 to all the invoices. The Commissioner agreed with the arguments for applying section 31 and that the public interest favoured maintaining the exemption.

The Commissioner decided that NHSE was entitled to withhold entire copies of the actual invoices under section 31(1) of FOIA and the public interest favours maintaining the exemption. The Commissioner required NHSE to disclose the ‘Line 1’ information in the requested invoices.

The Tribunal found that when the NHSE invoices were cross-referenced with the information about the same invoices in the public domain the useful information was the information in the ‘Line 1’ information. The Tribunal found that the ‘Line 1’ information was disclosed and that with this information Mr Ryan can compare what was invoiced with what was paid and that this satisfied his request.

The Tribunal found that section 31(1)(a) FOIA was engaged in relation to the original invoices submitted by Circle Health and Spire Healthcare because disclosure would be likely to prejudice the prevention or detection of crime.

The Tribunal found in relation to the public interest test that there is greater public interest in NHSE avoiding making payments against potentially fraudulent invoices and that public interest in transparency about the payments the NHSE makes is adequately met through the information published.

The Tribunal found that section 43(2) of FOIA is engaged in relation to the request for a ‘reconciliation/validation report.’ This is because disclosure would be likely to prejudice the commercial interests of any person including the NHSE. The Tribunal found that disclosing the validation reports would prejudice the commercial interests of Circle Health and Spire Healthcare. The redacted granular financial and operational information differed by provider and the fact that they were on the same contracts was irrelevant, but the Tribunal found that there was likely harm to the providers’ commercial interests on the basis of the examples in the Closed Bundle. The Tribunal was satisfied that Mr Ryan was seeking public disclosure of sensitive commercial information. This was dealt with by the Commissioner who stated:

The Tribunal found that the public interest favoured withholding the information because the matter of transparency was met through the information the NHSE routinely publishes and has released. How the NHSE manages public funding is independently audited by KPMG. There is a greater public interest in providers of healthcare services being able to support the NHSE and being able to compete for contracts fairly and there is public interest in the NHSE having access to as wide a range of potential providers as possible.

The Tribunal found that the public interest in maintaining section 43 outweighed the public interest disclosure. The Tribunal found that proper reliance was placed on sections 31(1), 41 and 43(2) of the FOIA.

The tribunal found that the duty under section 16 is to provide advice and assistance as far as it would be reasonable for the NHSE to do so. There was no fault in the NHSE not offering reasonable adjustments taking into account that Mr Ryan did not tell the NHSE that he believed he was neurodivergent even though he has no medical diagnosis of any relevant condition. The Tribunal found that the NHSE provided appropriate advice and assistance and complied with its obligations under section 16.

The Tribunal has borne in mind that the Commissioner’s Code of Practice does not state what Authorities should be required to do beyond that it should be reasonable.

The Tribunal found that the NHSE did not comply with sections 10(1) and 17(1) of FOIA.

The Tribunal found there was no error of law in the Commissioner’s DN and there was no flaw in the exercise of his discretion.

Accordingly, the appeal is dismissed.