.jpg){kind=link}
Tribunal rules FOIA cannot be used to seek information treated as the requester’s personal data
The NHS FOIA Appeal has ended with the First-tier Tribunal dismissing an appeal brought by Steven Armstrong against the Information Commissioner over a Freedom of Information Act (FOIA) request for expert medical opinions connected to a proposed clinical negligence claim. The tribunal concluded that the Information Commissioner had correctly applied section 40(5A) of the Freedom of Information Act 2000, meaning the public authority was entitled to refuse to confirm or deny whether it held the requested information.
The judgment, delivered on 5 August 2026 by Judge Stephen Roper, with Tribunal Members Kate Grimley-Evans and Dr Phebe Mann, dismissed the appeal in full after considering whether the Information Commissioner’s Decision Notice complied with the law.
The dispute arose after Mr Armstrong emailed NHS Resolution on 28 February 2025, requesting copies of expert medical opinions obtained during its assessment of a negligence claim concerning the death of his mother. In his request, he asked the authority to provide the reports and stated that, if necessary, the request should be treated as either a data access request or a Freedom of Information request.
NHS Resolution responded by treating the request as a subject access request (SAR) under data protection legislation rather than under FOIA. It largely refused access on the basis that the material was protected by legal professional privilege. Mr Armstrong challenged that approach during an internal review, arguing that the request should instead have been considered under the Freedom of Information Act.
Following his complaint, the Information Commissioner investigated the matter and issued a Decision Notice on 9 July 2025. The Commissioner concluded that the request sought the applicant’s own personal information and that section 40(5A) of FOIA applied. As a result, NHS Resolution was entitled to refuse to confirm or deny whether it held the requested information because any such confirmation would itself reveal the existence of personal data relating to the requester.
Before the tribunal, Mr Armstrong advanced several grounds of appeal. He argued that the requested expert reports concerned his deceased mother’s medical records rather than his own personal data. He also submitted that the Information Commissioner should not have relied upon section 40(5A), particularly where NHS Resolution had previously indicated that expert opinions existed and had refused disclosure by referring to legal professional privilege. In addition, he argued that disclosure could have been made on a restricted basis to him alone instead of being treated as public disclosure under FOIA.
The tribunal rejected those submissions. It found that the Commissioner had not treated information relating to Mr Armstrong’s late mother as his personal data. Instead, the tribunal concluded that confirming or denying whether the requested reports were held would itself reveal information about Mr Armstrong, specifically whether he had made a negligence claim against the NHS. Because the request expressly referred to “my claim” and was directed to NHS Resolution, any FOIA response would necessarily disclose information relating to an identifiable living individual.
The tribunal said the central issue was not whether the expert medical opinions related to the appellant’s late mother, but whether responding to the FOIA request would disclose personal information about Mr Armstrong himself. It concluded that the request, when viewed alongside its context, related directly to his negligence claim and therefore constituted information about an identifiable living individual. As a result, the requested information would be exempt from disclosure under section 40(1) of FOIA, meaning the exclusion in section 40(5A) was engaged.
The panel also addressed Mr Armstrong’s argument that the Information Commissioner had reached this conclusion without examining the actual contents of the expert opinions. It rejected that submission, explaining that, in cases involving a “neither confirm nor deny” response, commenting on whether the requested information has been examined could itself reveal whether such information exists. The tribunal added that it was unnecessary to assess the reports themselves because the nature of the request was sufficient to determine that section 40(5A) applied.
Although the Decision Notice did not expressly consider whether section 40(5A) was subject to a public interest test, the tribunal examined the issue. It acknowledged the general public interest in transparency and accountability within public authorities, together with the wider public interest in matters involving alleged NHS negligence. However, it found that these considerations were outweighed by the importance of protecting personal data and privacy rights. The tribunal concluded that maintaining the exclusion from the duty to confirm or deny was justified in the circumstances.
Mr Armstrong also challenged NHS Resolution’s reliance on legal professional privilege during its handling of his subject access request. However, the tribunal held that this issue fell outside its jurisdiction. It explained that the appeal concerned only the lawfulness of the Information Commissioner’s Decision Notice under the Freedom of Information Act and did not extend to reviewing NHS Resolution’s response under data protection legislation or its reasons for withholding information in response to the subject access request.
The tribunal further rejected the argument that the Commissioner acted improperly by relying on section 40(5A) even though NHS Resolution had not relied on that provision during its handling of the request. It found that the Commissioner was entitled to identify and apply the exemption he considered appropriate after investigating the complaint. The judgment also noted that, in cases involving personal data, both the Commissioner and the tribunal may need to raise section 40 exemptions proactively to avoid ordering a disclosure that could conflict with data protection law.
Another issue raised by Mr Armstrong was whether the requested reports could be disclosed only to him, subject to confidentiality safeguards. The tribunal rejected that proposal, reaffirming the established legal principle that disclosure under the Freedom of Information Act is disclosure to the public at large rather than to an individual requester. It said FOIA does not allow information to be released on a restricted or confidential basis, nor could anonymisation alter the fact that the request itself related to Mr Armstrong’s personal data.
In its final conclusions, the tribunal held that the Information Commissioner had correctly determined that section 40(5A) applied to the request. It found that the appropriate response under the Freedom of Information Act was to refuse to confirm or deny whether NHS Resolution held the requested expert opinions, irrespective of whether the appellant believed the information existed or whether the authority had previously referred to it in other correspondence. The tribunal therefore dismissed the appeal in full.
The decision reinforces the distinction between requests made under the Freedom of Information Act and those made under data protection legislation. It confirms that where a request seeks information amounting to the requester’s own personal data, the appropriate legal route remains a subject access request rather than disclosure under FOIA, which is treated in law as disclosure to the public.