Fiona Storey v Information Commissioner & Anor

This is an appeal against Decision Notice IC-356648-RCQ9 of the IC (“the Decision Notice”) that Herefordshire Council (“the Council”) was entitled to withhold information requested under FOIA, although they breached the statutory time limit to issue a refusal notice.

Mrs Storey made a Subject Access Request (SAR) seeking access to records held by the Council concerning her late mother, specifically “her medical records since March 2020, details of any safeguarding concerns submitted by concerned agencies or individuals, details of any safeguarding investigations and their outcomes. Also how your office was made aware of her death.”

The Council replied with a summary of information it had extracted but refused to provide other information it said was the personal data of others. It signposted her to other bodies to obtain her late mother’s medical records. Mrs Storey then asked for the information she said was missing, this time under FOIA. The Council confirmed that FOIA would disclose the information to the world at large and that the requested information was exempt under Sections 40 and 41 FOIA. Mrs Storey asked for internal review. That internal review considered the SAR but not the FOIA request.

Mrs Storey then complained to the IC. The IC wrote to the Council to say that they had considered the matter as a SAR but should have handled it as a FOIA request. The Council then produced a FOIA response, refusing to provide the information because it said it was exempt under Sections 40 and 41. After further correspondence, the IC issued the Decision Notice.

Section 1 FOIA provides:

FOIA defines “Information” at section 84 which provides:

“information” (subject to sections 51(8) and 75(2) means information recorded in any form;

There is a process of challenge – the first challenge is for the requester to apply to the IC for a Decision Notice (FOIA, section 50). If either side (the requester or the public authority) wishes to challenge the IC’s Decision Notice, they are entitled to appeal to this Tribunal (FOIA, section 57). This Tribunal’s powers are found in Section 58 FOIA which provides:

Section 40 FOIA confirms that:

Both Section 40(1) and Section 40(2), so far as it relates to Section 40(3A), are absolute exemptions and so are not subject to the public interest balancing test.

Section 3(2) DPA defines personal data as “any information relating to an identified or identifiable living individual”. Section 3(4) defines processing. This includes “disclosure by transmission, dissemination or otherwise making available” [at (d)].

Article 5 of the UK GDPR sets out the principles relating to the processing of personal data:

Article 6 UK GDPR provides that:

NHS Business Service Authority v Information Commissioner and Spivack [2021] UKUT 192 (AAC) confirmed that the test of whether or not data is personal data is a binary one: can a living individual be identified, directly or indirectly, from the data? If yes, it is personal data. If no, it is not personal data. The Tribunal should not look at any test of remoteness or likelihood.

In Goldsmith International Business School v The Information Commissioner and the Home Office [2014] UKUT 563 (AAC), the Upper Tribunal considered the predecessor to Article 6(1)(f) and held that when considering whether that condition was met, the three questions formulated by Lady Hale in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 must be asked (in this order):

The Upper Tribunal further found that “necessity” means “more than desirable but less than indispensable or absolute necessity”. It held that the test was one of “reasonable necessity”, which involves the consideration of alternative measures.

The Tribunal considers that the same questions and same test should be applied in determining whether there is lawful processing under UK GDPR Article 6(1)(f).

In Corporate Officer of the House of Commons v IC & others [2008] EWHC 1084 (Admin), the High Court reflected that to be necessary, there must be a “pressing social need” and that interference must be “proportionate as to means and fairly balanced as to ends” [at para 43]. The Upper Tribunal in Halpin summarised the test as: “what must be established is a pressing social need and that there are no other means of meeting it” [at para 31].

In Cox v IC and Home Office [2018] UKUT 119 (AAC), the Upper Tribunal considered the IC’s guidance on requests for personal data about public employees that stated that "It is likely to be easier to demonstrate a need to release personal information about more senior decision makers than about more junior staff." The Upper Tribunal concluded that whether or not names should be disclosed was context-specific and fact-sensitive and that a legitimate interest cannot be assumed.

In IC v Halpin [2019] UKUT 29 (AAC), the Upper Tribunal criticised an FTT decision that had focused on the requester’s legitimate interests but failed to take account of the fact that the public authority would lose control of the information once it was disclosed to the world at large under FOIA.

Section 41 FOIA creates an absolute exemption in relation to certain information provided in confidence. It provides:

Confidentiality survives the death of the person providing the information: Webber v IC and Nottinghamshire NHS [2013] UKUT 648.

In UKRI v IC and Kirkham [2026] UKUT 146 (AAC), the Upper Tribunal confirmed that the Tribunal should follow the three-stage test to identify an equitable duty of confidentiality identified in Coco v A N Clark (Engineers) Ltd [1969] RPC 41:

In AG v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109, Lord Keith confirmed that it is sufficient that the person providing the information would prefer it not to be disclosed, even if there is no positive harm caused by disclosure.

Also in that case, Lord Goff set out three “limiting principles” where there is no longer a duty of confidence:

In Evans v IC and DBIS [2012] UKUT 313 (AAC), the Upper Tribunal confirmed that

“breach of confidence (which for these purposes includes a breach of privacy) will not be actionable if the defendant shows that the breach was justified in the public interest”.

In RB v IC UKUT 614 (AAC), the Upper Tribunal concluded that

“Disclosure of confidential information is not justified merely because the information is a matter of public interest. The public interest in disclosure must be sufficiently important to override the duty to respect confidentiality.”

It went on to confirm that in determining whether there is a public interest in disclosure, the Tribunal must consider Article 8 of the European Convention on Human Rights and to the extent to which the rights to a private and family life in Article 8 themselves compete, the balance to be struck between those rights. It doubted that Article 8 grants a right to receive confidential information about a deceased family member but confirmed that even if it did, that would not outweigh the public interest in keeping that information confidential.

However, it is important to remember that Section 41 is not a qualified exemption. As the Upper Tribunal confirmed in UKRI v ICO and Kirkham, the Tribunal “must proceed from the starting point that there is a public interest in confidence being respected” [at paragraph 95]. In other words, we do not carry out a balancing exercise: we consider whether the public interest in disclosure outweighs that starting point that confidential information should be respected in considering whether there is a defence to an action for breach of confidence and that therefore the exemption does not apply at all.

Medical records have been held to be confidential in a number of cases including Ashworth Security Hospital v MGN Ltd [2002] UKHL 29. RB v IC was a case involving social care records. The Upper Tribunal confirmed that they contained private information that was “similar in character to medical records and attracts the same public interest in protecting their confidential nature”.

The Decision Notice records that the Commissioner agreed that the Council correctly relied on Sections 40(1), 40(2) and 41 FOIA.

The Commissioner decided that some of the information related to Mrs Storey’s own safeguarding referral and constituted her own personal data and so it was appropriate for the Council to apply the exemption under Section 40(1).

The Commissioner was satisfied that some of the information relates to the personal data of third party living individuals and would identify them, that to disclose the information under FOIA would be to “process” that personal data, and so the information could only be disclosed if disclosure was lawful, fair and transparent, i.e. there was a legitimate interest, disclosure was necessary and that these interests overrode the rights and freedoms of the data subjects. The Commissioner considered that Mrs Storey was pursuing a legitimate interest and that disclosure was necessary. The Commissioner considered that individuals involved in Mrs Storey’s mother’s care would not expect private information about themselves to be made public under FOIA without their consent and that this outweighed the legitimate interests in disclosure. The Commissioner therefore decided that the Council was entitled to rely on Section 40(2).

The Commissioner found that the requested information had been imparted to the Council in circumstances importing an obligation of confidence, possessed the necessary quality of confidence, and that disclosure would cause detriment to the confider. The Commissioner further concluded that the duty of confidence survived the individual’s death and that there was no sufficient public interest in disclosure to provide a defence to an actionable breach of confidence after considering competing public interests, including under Articles 8 and 10 of the ECHR. The Commissioner concluded that there were “proper routes” to address Mrs Storey’s concerns and private interests in obtaining the information.

Mrs Storey’s Grounds of Appeal state that the requested information is needed to establish what records the Council holds concerning her mother’s interactions with social services, including apparent inconsistencies in her reported financial circumstances and the circumstances surrounding changes to her will.

The grounds further assert that the information is required to understand the Council’s response to safeguarding concerns raised, including the handling of alleged financial abuse, limitations on family contact, and the decision making surrounding her mother’s care, admission to hospice, and subsequent placement in a nursing home.

The IC’s Response relied upon the Decision Notice.

The Council relied on its FOIA refusal letter and the Decision Notice and maintained that it was correct to withhold disclosure of the requested information under the exemptions in Sections 40 and 41 FOIA.

We considered an open bundle of 154 pages, supplementary bundle of 74 pages and closed material provided by the Council. The open and supplementary bundles included evidence supplied by Mrs Storey.

The closed material was the withheld information. It would defeat the purpose of the appeal to allow the material to be disclosed in a public hearing. We scrutinised the closed material to identify whether or not it did contain personal data and information provided in confidence. Our findings are contained below. The Tribunal’s inquisitorial function allows us to take an investigatory approach to the closed material, thereby reducing the disadvantage to Mrs Storey by her not having access to the closed material.

We make these findings on the balance of probabilities.

Mrs Storey seeks the information so that she can explore a legal claim arising out of her late mother's will.

The withheld information documents contact with professionals about members of the public, now deceased. The purpose of that contact was to seek assistance from the Council with personal care. The information contains highly personal details about the individuals’ ability to meet their personal care needs and financial information regarding their ability to pay for care. Some of the information is about the individuals’ health. We are confident that the individuals would have expected the Council to keep that information confidential and that they would not want the Council to provide that information to the world at large, even after their death.

The information contains the personal data of Mrs Storey.

The information also contains data that identifies other living individuals: relatives of the deceased and professionals involved in assessing their care needs and providing care. Some of the professionals appear to be junior staff. Some of the data is about the living individuals’ own health. There is no evidence that any of the individuals have provided their consent to their personal data being disclosed to the world at large under FOIA. There is no evidence that they have made this data public.

All of the withheld information is of a confidential nature. The individuals that provided this information had a reasonable expectation that it would be kept confidential. That is clear from the context in which it was provided and that fact that some of it would be classed as special category data were the individuals still living.

Unauthorised use would be to the detriment of the persons who provided the information: we are confident that they would not want their private, personal information about their finances, health and care needs to be disclosed to the world at large.

There would be no defence to a breach of confidence claim. The information is not already in the public domain and is not useless or trivial. There is no public interest defence. We must proceed from the starting point that there is public interest in maintaining confidentiality. This is even more so in this case because if people thought that highly personal information about their health, care needs and financial situation could be released to the world at large under FOIA, they might be dissuaded from seeking help. There is public interest in transparency that might highlight financial abuse. But that does not outweigh the very powerful public interest in confidentiality of this highly personal information provided in highly confidential circumstances.

The Decision Notice was therefore right to say that the Council correctly applied Section 41 to withhold the information.

Some of the information is also Mrs Storey’s own personal data. The Decision Notice was right to say that the Council correctly applied Section 40(1) to withhold that information. The correct route for Mrs Storey to obtain that information is a SAR, a route she had already undertaken.

Some of the information is also personal data identifying living relatives of the deceased. Some of it is special category data because it relates to their health. That must therefore be withheld unless one of a limited number of exemptions applies. There is no evidence that the data subjects consented to disclosure of their personal data to the world at large under FOIA, which would be highly unusual. There is no evidence that they have made this data public. It is not necessary to disclose the data to the world at large under FOIA to meet a substantial public interest or for public health reasons.

We considered carefully whether it was necessary to release the data to establish, exercise or defend a legal claim because that is, of course, the reason why Mrs Storey seeks to obtain the information. Necessary means that there are no other reasonable means of establishing, exercising or defending a legal claim. Legal claims have provisions for disclosure of relevant documents, both before and after proceedings are issued and including disclosure from third parties not involved in the litigation. Those provisions have safeguards regarding the purpose for which documents are used that are not available when documents are disclosed under FOIA, when all confidentiality is lost. We consider therefore that disclosure is not necessary to establish, exercise or defend a legal claim because there are other reasonable means by which the information could be obtained that do not involve it being disclosed to the world at large.

So far as the non-special category data is concerned, again there is no evidence that the data subjects provided their consent to their personal data being disclosed to the world at large under FOIA.

We consider that Mrs Storey does have a legitimate interest in seeking the data: to explore a legal claim arising out of her late mother’s will. However, we disagree with the IC and do not consider that it is necessary to disclose the data to meet Mrs Storey’s legitimate interests for the same reason explored above. It is not necessary because there are other legal routes to obtaining the information for the purposes of a legal claim that have safeguards for the data subjects that are not available when information is released to the world at large under FOIA. Further, disclosure would not be fair to the data subjects, taking into account the purpose for which the personal data was collected and retained and the fact that the data subjects would not expect their data to be made public.

The Decision Notice was therefore right to say that the Council correctly applied Section 40(2) to withhold this information.

We considered carefully whether or not the personal data of professionals should be disclosed. As the Upper Tribunal confirmed in Cox v IC and Home Office, this is context-specific and fact-sensitive. There is no evidence that these professionals provided their consent to their personal data being disclosed to the world at large under FOIA. We cannot see that it is necessary for their names to be disclosed for Mrs Storey’s legitimate interests. For that reason, the Decision Notice was therefore right to say that the Council correctly applied Section 40(2) to withhold this information.

In any event, we do not believe that it would be possible to disclose the personal data belonging to the professionals without disclosing the confidential information that would be the subject of a breach of confidence claim. It is therefore exempt from disclosure under Section 41.

We considered whether or not any of the information could be redacted to remove personal data and information provided in confidence so that it could be disclosed under FOIA. We are satisfied that there would be no information left after such redaction were carried out. All of the information is inexorably bound up with the information provided in confidence that is subject to the Section 41 exemption.

For all of those reasons, the Decision Notice was in accordance with the law. The appeal is dismissed.