Amended on 18 March 2019 pursuant to the slip rule on Mr Peters' application
First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2018/ 0142
Decided without a hearing
Before
JUDGE DAVID THOMAS
TRIBUNAL MEMBERS MARION SAUNDERS AND ALISON LOWTON
BETWEEN
JOHN PETERS
Appellant
AND
THE INFORMATION COMMISSIONER
First Respondent
AND
THE UNIVERSITY OF BRISTOL
Second Respondent
DECISION AND REASONS
NB Numbers in [square brackets] refer to the bundle
The Tribunal’s decision
The Tribunal substitutes a fresh decision notice to the effect that the University of
Bristol (the University) was not entitled to rely on section 40(2) Freedom of
Information Act 2000 and should therefore disclose the requested information to Mr
Peters within the later of 35 days or the outcome of any appeal to the Upper Tribunal
(see below as to the scope of the request).
1
Introduction
1. This is an appeal by Mr Peters against the rejection by the Information
Commissioner (the Commissioner) on 10 July 2018 of his complaint that the
University had wrongly refused to disclose certain information to him under
section 1(1)(b) Freedom of Information Act 2000 (FOIA).
2. The parties are content that the appeal be determined on the papers. The Tribunal
is satisfied that it can properly do so within rule 32(1)(b) of The Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009. 1
3. The University has sent material to the Tribunal on a closed basis.
Factual background
4. Mr Peters suffers from chronic fatigue syndrome (CFS). The term CFS is often, but
not always, used interchangeably with myalgic encephalomyelitis (ME). The
Tribunal will refer compendiously to CFS/ME. Mr Peters and others are much
exercised by some of the research carried out into the condition. In brief and
probably crude summary, he and his fellow campaigners believe that the
condition’s aetiology is physiological rather than psychological; they dispute
research findings which indicate the contrary. For example, they regard research at
Queen Mary University of London (QMUL) known as PACE as methodologically
flawed and its conclusions unwarranted. Mr Peters has made a number of FOIA
requests in relation to that research, at least two of which have reached the Tribunal.
5. Mr Peters and others also question the validity of research into CFS/ME at the
University; hence his FOIA request. The research is known by the acronym SMILE
(Specialist Medical Intervention and Lightning Evaluation). It involves the
Lightning Programme (LP), which is developed from osteopathy, life coaching and
neuro-linguistic programming. The trial recruited 100 participants aged 12 to 18
with mild or moderate CFS/ME. Mr Peters says that recruitment started some eight
years ago. The participants were randomly divided into two groups: one received
medical care only and the other medical care plus LP. All the participants were
asked to complete questionnaires at regular intervals about their levels of physical
function, fatigue, pain, anxiety and school attendance. According to the University’s
press release dated 20 September 2017 [91], those in the LP group had improved
physical function at six months (improving further at 12 months); fatigue, anxiety
and depression were reduced at six and 12 months; and school attendance also
improved at 12 months.
1 SI 2009 No 1976
2
6. The press release also explains that CFS/ME affects at least one per cent of
secondary school children in the UK. Around 250 children with the condition use
LP each year. The principal investigator for the trial, Professor Esther Crawley, is
professor of child health at the University and consultant paediatrician at the Royal
United Hospital in Bath (RUH). The release says that the RUH is the largest
paediatric CFS/ME clinical service in the UK, providing assessment and treatment
for over 400 children from across the UK and Western Europe every year. A briefing
produced by the University about the trial says that it recruited participants from a
specialist paediatric CFS/ME service in the south west of England, and the
University’s Response 2 confirms that the service was based at the RUH. Prof
Crawley was the corresponding author in an open access article in Archives of
Diseases in Children published in September 2017 [97] summarising the trial results
(but not at the level of detail that Mr Peters has requested).
7. In his witness statement dated 9 December 2018, Mr Peters says that the study has
been criticised, in particular for the ‘folding’ of a feasibility study into a full study
and the switching of primary and secondary outcomes. It is not, of course, for the
Tribunal to resolve the scientific disputes. Its role is limited to determining whether
Mr Peters is entitled to the information he has requested.
The request and the University’s response
8. On 26 September 2017, Mr Peters made this request of the University [55]:
‘These requests concern “Comparing specialist medical care with specialist medical care
plus the Lightning Process for chronic fatigue syndrome or myalgic encephalomyelitis
(CFS/ME).: a randomised controlled trial (SMILE Trial)”. I have previously requested
the trial data, your reference: FOQ17 193.
In each instance following, the request is for anonymized data with personal identifiers
removed.
Please provide the following patient-level data at baseline, 3 months, 6 months and 1
year assessments, where available
1. SF-36 physical functioning scores.
2. School attendance in the previous week, collected as a percentage (10, 20, 40, 60, 80
and 100%).
3. Chalder Fatigue Scale Scores.
4. Pain visual analogue scale scores.
5. HADS scores
6. SCAS scores
7. Work Productivity and Activity Impairment Questionnaire: General Health
8. Health Resource Use Questionnaire.
I am happy to receive this information in electronic format’.
2 Para 12
3
The scope of the request
9. In FOIA appeals, the Tribunal’s first task is to determine the scope of the request.
Only then can an assessment be made whether the requester is entitled to some or
all of the information. In his witness statement, Mr Peters indicated, as he had in his
Reply to the University’s Response, that he would be content for the age and gender
of participants to be removed from the data. This would, he said, have little impact
on the value of the data. In fact, it does not appear that age and gender are within
the scope of his carefully-calibrated request. Rather, Mr Peters wishes to know
various outcome scores (including school attendance) and questionnaire responses.
Construing a request is an objective task for the Tribunal but its conclusion here is
fortified by Mr Peters’ confirmation that he does not want to know age and gender.
The Tribunal will therefore determine whether he is entitled to the requested
information on the basis that it does not extend to age and gender. 3
10. In relation to parts 7 and 8 (two questionnaires), it appears that what Mr Peters
wants is the information in statistical form (as with parts 1 – 6). In its email of 22
June 2018 to the ICO [90], the University said in relation to these two parts: ‘In order
to provide you with these two fields, the raw data would need to be processed,
sanitised and prepared in order to extract what has been requested. This would take
a large amount of time and effort due to the volume of raw data involved and the
fact that it is not labelled in a way according directly with what is being asked for
…’. The Commissioner quotes the passage in paragraph 14 of her Response. It is
clear from Mr Peters’ Reply to that Response, and in particular his reliance on the
ruling of the House of Lords in Common Services Agency v Scottish Information
Commissioner (Common Services Agency) 4 that barnardisation (a form of statistical
presentation) does not create new information, that he was not expecting the raw
data (i.e. the original answers in the questionnaires). The University did
subsequently process the information into statistical form and sent it to the
Commissioner (see paragraph 27 of its Response).
The University’s Response
11. The University responded to the request on 3 November 2017 [59]. It confirmed that
it held the requested information but refused to disclose it, relying on the exemption
in section 40 FOIA (personal information) (in its form prior to the amendments
made in 2018 to give effect to the General Data Protection Regulation (GDPR) 5).
Although the University did not say so, it was clearly relying on subsection (2)
(third party personal data): the information constituted the personal data of the
research participants. It explained that, although the research data had been
anonymised, it was derived from sensitive source material: information about the
3 See para 26
4 [2008] 1 WLR 1550
5 Regulation (EU) No 2016/679
4
physical and mental health of children. Neither the research participants nor (where
they were too young) their parents had consented to the release of ‘this detailed,
individual-level patient data into the public domain’. However, the University was,
it said, making the data available to the research community, with appropriate
safeguards. This was in line with the Commissioner’s Code of Practice on
Anonymisation: Managing Data Protection Risk (the Code) 6 which suggested that
limited access was particularly appropriate for the handling of anonymised data
derived from sensitive source material, ‘as it maintains control over further
disclosure or use of the data and reduces the risk of exposing the data to attempts
to re-identify the information’.
12. Mr Peters was not happy with this response. On 7 November 2017, he asked for a
review [58], supporting his application with some of the arguments he has later run
in the appeal. The University maintained its position on 5 December 2017 [57],
arguing that it had to be certain that release of the requested information could not
lead to the re-identification of the research participants.
The Commissioner’s decision
13. Mr Peters made a complaint to the Commissioner on 16 December 2017 [63].
14. The Commissioner gave her decision on 10 July 2018 [18]. She decided that the
University was entitled to rely on section 40(2) FOIA. The information constituted
‘personal data’ within section 1 Data Protection Act 1998 (DPA 1998). The
Commissioner said she understood that each line of data referred to one individual
trial participant. She applied the ‘motivated intruder’ test (see below) and her own
guidance. 7 She distinguished the Tribunal’s decision in Matthees v Information
Commissioner and Queen Mary University of London, 8 which concerned data from the
PACE trial, on the basis that the database at issue there was a large national one of
adults whereas the SMILE study covered 100 schoolchildren aged 12-18 in a very
limited geographical area (which she described as Bristol).
15. The kernel of the Commissioner’s reasoning on the personal data issue is found in
paragraph 27:
‘…having had the opportunity to review the detailed fatigue and anxiety score details
and the school attendances in the withheld information, the Commissioner considers that
it is more than remote and reasonably likely that individual children could be identified
by combining this information which “relates to” individuals receiving specialist
6 https://ico.org.uk/media/1061/anonymisation-code.pdf
7 https://ico.org.uk/media/for-organisations/documents/1554/determining-what-is-personal
data.pdf and https://ico.org.uk/media/for-
organisations/documents/1549/determining_what_is_personal_data_quick_reference_guide.pdf
8 EA/2015/0259
5
medical care for [CFS/ME] with information from other sources, such as school
attendance records’.
(The phrase ‘more than remote and reasonably likely’ is taken from the judgment
of Mr Justice Cranston in R (Department of Health) v Information Commissioner
(Department of Health). 9
16. The Commissioner then considered whether any of the data protection principles
would be breached by disclosure and decided that the first (DPP1) would be.
Disclosure would not be fair, particularly given that the patients had not given their
consent. She also held that the information constitutes ‘sensitive personal data’ (for
which there are additional barriers to disclosure) because it relates to physical or
mental health of individuals.
The pleadings
17. In his Grounds of Appeal [15], Mr Peters’ main argument was that there was no
basis for the University’s fear that a motivated intruder could identify trial
participants from a combination of the trial data and school attendance records. He
argued that the intruder would need access to the records, for the three years the
trial lasted, of every pupil in some 60 schools (his estimate of the number of schools
in the trial catchment area, which he took to be Bristol and Bath). School attendance
records were confidential and protected and the Commissioner, the ultimate
guardian of the protection of data, should not have made a decision on the premise
that protection of confidential data by public bodies (i.e. schools) was inadequate.
Participants could only be identified with prior knowledge, one of the criteria of the
motivated intruder test is that the intruder should not have such knowledge.
18. In her Response [20], the Commissioner said that she recognised that ‘the issue of
whether the withheld information in this case is truly anonymised is not beyond
argument and is finely balanced, particularly given the limited information
provided by the public authority in this matter, the University of Bristol as to the
means by which other information could be obtained that would enable individuals
to be identified from the withheld information’. She had not expressed such
reservations in her decision, which indicates that she is now less confident about
the application of section 40(2). It is perfectly proper for the Commissioner to
reconsider during the course of an appeal: it is not her function to defend her
decision at any cost.
19. Because of the uncertainty she now felt, the Commissioner suggested that the
University should be joined as a party. She is not, however, formally supporting
Mr Peters’ appeal. She continues to maintain that all the requested information
constitutes personal data and that disclosure would breach DPP1. She suggested
9 [2012] EWHC 1430 (Admin)
6
that there might be a stronger argument that the information within parts 7 and 8
of the request (Work Productivity and Activity Impairment Questionnaire:
General Health and Health Resource Use Questionnaire respectively), which she
had not seen at that point, was personal data on the basis that it was ‘less
anonymised’ than other data; alternatively, that information might not be held for
the purposes of FOIA, given that public authorities have no obligation to create
information to meet a request. She pointed out 10 that paragraph 27 of her decision
contemplated the use of information from sources other than school attendance
records, and suggested online blogs and forums (for example, with parents
contributing) might reveal information from which a link could be made. She
invited the University to make further representations on the risk of
reidentification. 11
20. Mr Peters submitted a Reply to the Commissioner’s Response [39] on 25
September 2018. He questioned whether anyone would be motivated to try to
identify the participants: there was no need to do so to criticise the trial, which was
the objective of campaigners. There did not exist information in blogs and forums
which could be used to identify participants, bearing in mind that the information
about how a participant was feeling was now up to eight years old.
21. The University was indeed joined as a party. In its Response [45], it argued that the
requested information was linked to the impact of a child’s illness on parental
ability to work. It corrected Mr Peters’ misapprehension that the trial took place in
Bristol: the recruitment centre was based, it said, in Bath and most of the children
were recruited from Bath. The true figure of the number of schools from which
pupils were recruited was believed to have been between three and nine at any one
time, mainly from the Bath area. Mean school attendance for teenagers attending a
specialist CFS/ME service is 40% (two days a week), an exceptionally low
individual attendance rate such that the children would stand out clearly in any
school attendance records. Access to attendance records was possible from various
sources including teachers responsible for attendance, special needs teachers and
Education Welfare Officers. Whilst attendance records were confidential, schools
were regularly asked to review or submit records by a range of professional persons
and authorised bodies. Personalised records were regularly obtained by parents
and carers and a request made by, or on behalf of, a motivated intruder might be
complied with unwittingly or inadvertently through human error. The University
considered that there was a real risk that a motivated intruder might be able
successfully to identify some, if not all, of the trial participants by obtaining school
attendance records and comparing them to the SMILE data. Boys would be
particularly easy to identify, since CFS/ME disproportionally affects girls after the
age of 13.
10 Para 46
11 See paras 38 and 47
7
22. The University submitted that there was likely to be a ‘determined person with a
particular reason to want to identify the individual’ within the public at large who
would be motivated and able to identify the children to whom the SMILE data
relates; even a small risk of reidentification of a single child participant would be
unacceptable.
23. The University explained that it had categorised the requested information in its
central research data repository as ‘Controlled data’:
‘Controlled data has a large degree of sensitivity involved. For example, research
participants have not given explicit consent to share as open data and the risk of
reidentification of participants is medium to high. Requests for Controlled data are
referred to an appropriate Data Access Committee for approval before data can be
shared with bona fide researchers, after their host institution has signed a Data
Access Agreement’.
The University argued that the provision of controlled data to researchers under
carefully controlled conditions satisfied any legitimate public interest in the data
whilst protecting the interests of participants. The University thereby complied
with the Code, which suggested that making research data available to researchers
(only) was ‘particularly appropriate for the handling of anonymised data from
sensitive source material or where there was a significant risk of reidentification’.
24. Finally, the University sought to distinguish the Tribunal’s decision in Matthees: in
addition to the fact that PACE was much larger and countrywide, data from SMILE
had been made available to researchers from the moment the trial results were
published, thereby facilitating legitimate scientific debate: that had not happened
with PACE.
25. Mr Peters submitted a Reply to the University’s Response on 14 October 2018 [52].
He questioned why the various bodies listed by the University as having access to
school records would wish to know trial data. They were allowed access to school
records precisely because they were considered responsible and trustworthy. He
said that he had read a number of documents all of which, as far as he was aware,
referred to Bath and Bristol as being the catchment area.
26. The University made Further Submissions on 13 November 2018. It said it was not
suggesting that Mr Peters himself was a motivated intruder but the unusually low
attendance records associated with CFS/ME would enable a match to be made with
age and gender in the trial data. The number of individuals (including parents) and
organisations with access to school attendance records might enable a motivated
intruder using investigative techniques or advertising to access the records.
Removal of age and gender would make the data worthless.
8
27. Mr Peters responded by his witness statement. He said he was not aware of any
attempts to identify participants in the SMILE trial (or indeed of PACE participants,
including after some PACE data was released). Those who had self-identified as
participants in PACE had, he believed, met only with support from other patients,
and those who used pseudonyms had faced no pressure to identify or attempts at
identification. The Commissioner had accepted that school attendance records had
a motivated defender 12 and her finally finely balanced decision therefore depended
on the University explaining how information from other sources could be used. It
had not done so. Similarly, the University had not explained what investigation
techniques or advertising could lead to reidentification. To suggest that someone
entrusted with school records would hand them over on seeing an advertisement
was implausible to say the least, Mr Peters argued.
Discussion
The legislation
28. At the time of the request, section 40 FOIA read:
‘(2) Any information to which a request for information relates is also exempt
information if –
(a) It constitutes personal data which do not fall within subsection (1), and
(b) Either the first or the second condition below is satisfied
(3)The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the
definition of “data” in section 1(1) of the Data Protection Act 1998, that the
disclosure of the information to a member of the public otherwise than under this
Act would contravene –
(i) any of the data protection principles
…’
29. Section 1(1) DPA defined ‘personal data’ as:
‘data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely
to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the
intentions of the data controller or any other person in respect of the individual’.
It is paragraph (b) which is in issue in the present case. Paragraph (a) does not apply
because Mr Peters has asked for the information in anonymised form.
12 See para 44 of the Commissioner’s Response
9
(The definition refers to data which can be ‘identified’. However, the parties
sometimes use the term ‘reidentified’, presumably on the basis that the trial
participants have already been identified (to those running the trial), and the
Tribunal will therefore also use ‘reidentified’ and ‘reidentification’).
30. ‘Data controller’ was defined as ‘… a person who (either alone or jointly or in
common with other persons) determines the purposes for which and the manner in
which any personal data are, or are to be processed’. ‘Processing’ included
disclosure. There is no dispute that the requested information falls within the
definition of ‘data’. A ‘data subject’ is a person who is the subject of personal data.
31. Section 2 defined ‘sensitive personal data’. It related to personal data consisting of
information about, inter alia, physical or mental health or condition. It follows that
data which is not personal cannot be sensitive personal data.
Does the requested information ‘relate to’ a living individual?
32. It clearly does. This part of the definition of ‘personal data’ therefore applies. The
key question is that of reidentification.
The reference to ‘data controller’ in paragraph (b) of the definition of ‘personal data’
33. On its face, paragraph (b) of the definition of ‘personal data’ only applies where
reidentification is possible from a combination of the data in question (here, the
requested information) and data which is in, or likely to come into, the possession
of the data controller. Where data is held by an organisation, the data controller will,
almost inevitably, be an employee. The reference to other data in the data
controller’s possession (or likely to become so), not on other data which might be
generally available or at least accessible by a motivated intruder, appears to suggest
that the circumstances in which reidentification could apply via the paragraph (b)
extension are limited. That in turn would narrow the definition of ‘personal data’,
which would then mean that the protection of privacy rights via the data protection
principles in the DPA 1998 would be correspondingly limited.
34. However, caselaw has determined that one must ask whether reidentification is
possible from a combination of the data in question and data otherwise available,
not simply to the data controller. For example, in Department of Health, Mr Justice
Cranston explained that, in Common Services Agency, the House of Lords had said
that, even though the data controller holds the key to identification of individuals
to which the data relates, whether data is personal depends on ‘whether any living
individuals can be identified by the public [i.e. not simply the data controller]
10
following disclosure of the information’.13 The Upper Tribunal confirmed that that
was the correct approach in Information Commissioner v Magherafelt District Council.14
35. The issue is therefore whether the trial participants could be reidentified from a
combination of the requested information and other information which is or might
be generally accessible, not simply possessed (or likely to be possessed) by the data
controller. That is certainly consistent with recital (26) of the directive. 15
The motivated intruder test
36. The term ‘motivated intruder’ is not found in the legislation. It seems to come from
the Code. The reference to ‘intruder’ is perhaps unfortunate, because it suggests
someone who is prepared to take the law into their own hands to reidentify a data
subject. In fact, a motivated intruder is not a lawbreaker. Presumably what is meant
is someone who has no compunction about being intrusive about particular
personal information. In any event, the term has received judicial sanction and is
now an established part of the data protection lexicon.
37. In Information Commissioner v Miller, 16 Upper Tribunal Judge Markus summarised
the caselaw and quoted, with evident approval, from the Code:
‘11. In the Department of Health case Cranston J said at paragraph 66 that the
assessment of the likelihood of identification included “assessing a range of every day
factors, such as the likelihood that particular groups, such as campaigners, and the
press, will seek out information of identity and the types of other information, already
in the public domain, which could inform the search.”
12. As for the likelihood of identification, Recital 26 of the preamble to the Directive
[95/46/EC] provides that “account should be taken of all the means likely reasonably to
be used”. In Magherafelt the Upper Tribunal acknowledged the “motivated intruder”
test advanced by the Information Commissioner:
“37 …A ‘motivated intruder’ was ‘…a person who starts without any prior
knowledge but who wishes to identify the individual or individuals referred to
in the purportedly anonymised information and will take all reasonable steps to
do so.’. The question was then one of assessment by a public authority as to ‘…
whether, taking account of the nature of the information, there would be likely
to be a motivated intruder within the public at large who would be able to
identify the individuals to whom the disclosed information relates.’
13. While not expressly adopting that test, the approach of the Upper Tribunal in that
case was consistent with it. A similar approach was taken by the Court of Session
13 Para 52
14 [2013] AACR 14
15 ‘Whereas the principles of protection must apply to any information concerning an identified or
identifiable person; whereas, to determine whether a person is identifiable, account should be taken
of all the means likely reasonably to be used either by the controller or by any other person to
identify the said person; whereas the principles of protection shall not apply to data rendered
anonymous in such a way that the data subject is no longer identifiable …’
16 [2018] UKUT 229 (AAC)
11
(Inner House) in Craigdale Housing Association v The Scottish Information
Commissioner [2010] CSIH 43 at paragraph 24:
“…it is not just the means reasonably likely to be used by the ordinary man on
the street to identify a person, but also the means which are likely to be used by
a determined person with a particular reason to want to identify the
individual…using the touchstone of, say, an investigative journalist…”
14. The Information Commissioner’s Code of Practice on “Anonymisation: managing
data protection risk” provides guidance at page 22/23 on the application of the
“motivated intruder” test:
“The approach assumes that the ‘motivated intruder’ is reasonably competent,
has access to resources such as the internet, libraries, and all public documents,
and would employ investigative techniques such as making enquiries of people
who may have additional knowledge of the identity of the data subject or
advertising for anyone with information to come forward. The ‘motivated
intruder’ is not assumed to have any specialist knowledge such as computer
hacking skills, or to have access to specialist equipment or to resort to
criminality such as burglary, to gain access to data that is kept securely.”
15. The guidance also addresses the risk of re-identification where one individual or
group of individuals already knows a great deal about another individual, such as a
family member, colleague or doctor, and says at page 26:
“The starting point for assessing re-identification risk should be recorded
information and established fact. It is easier to establish that particular recorded
information is available, than to establish that an individual – or group of
individuals - has the knowledge necessary to allow re-identification. However,
there is no doubt that non-recorded personal knowledge, in combination with
anonymised data, can lead to identification. It can be harder though to
substantiate or argue convincingly. There must be a plausible and
reasonable basis for non-recorded personal knowledge to be considered
to present a significant re-identification risk.”
16. The guidance also distinguishes between identification and an educated guess:
“[Identification] implies a degree of certainty that information is about one
person and not another. Identification involves more than making an educated
guess that information is about someone; the guess could be wrong. The
possibility of making an educated guess about an individual’s identity may
present a privacy risk but not a data protection one because no personal data has
been disclosed to the guesser. Even where a guess based on anonymised data
turns out to be correct, this does not mean that a disclosure of personal data has
taken place’” (the judge’s emphasis).
38. The Code adds 17 that one should assume that the motivated intruder is
reasonably competent and might advertise for anyone with relevant information
to come forward. The test was useful ‘because it sets the bar for the risk of
identification higher than considering whether a “relatively inexpert” member of
the public can achieve re-identification, but lower than considering whether
someone with access to a great deal of specialist expertise, analytical power or
prior knowledge could do so’.
17 p22
12
39. The key elements of the motivated intruder test are therefore as follows:
• The intruder starts without any prior knowledge
• He or she will have a particular reason to identify the subjects of anonymised
data and will take all reasonable steps to do so, will be determined and
competent, will have access to resources such as the internet, libraries and public
documents but will not resort to criminality (such as computer hacking or
burglary)
• He or she is similar to an investigative journalist but will not have specialist
equipment
• Non-recorded personal knowledge can suffice but there must be a plausible and
reasonable basis for believing that such knowledge presents a significant re-
identification risk
• There must be a likelihood of success
• Educated guesswork does not suffice.
Should one assume that there is a motivated intruder in a particular case?
40. The caselaw is not altogether clear as to whether it is necessary to assess in a
particular case whether there is in fact likely to be a motivated intruder, anxious to
reidentify the subjects of the requested data, or whether one should simply assume
that there is and then assess whether a hypothetical motivated intruder would be
likely to be able to reidentify data subjects.
41. This matters in the present case because Mr Peters asserts, with some cogency, that
no one would have any desire to find out who the trial participants were.
Campaigners such as himself simply wish to access the trial’s raw data in order to
assess whether the trial is methodologically sound and whether the conclusions
which have been drawn are justified by the data. He points to the experience of the
PCAE trial, where, he says, no attempts have been made to identify anonymous
participants and no pressure has been put on self-identifiers. It should be said,
however, that a motivated intruder might not just be drawn from CFS/ME
campaigners.
42. In the Tribunal’s view, there has to be an assessment of whether there is at least a
realistic possibility of a motivated intruder in a particular case. Otherwise, a
requester might be denied information to which he or she would otherwise be
entitled simply because of a risk which was not grounded in reality. This is
consistent with the dictum of Mr Justice Cranston in Department of Health that
13
assessing the likelihood of reidentification included ‘… the likelihood that
particular groups such as campaigners and the press will seek out information of
identify … ‘.
43. Ultimately, it does not matter in the present case whether a motivated intruder is
likely: the Tribunal has proceeded on the basis that it is (albeit that the University
accepts that Mr Peters does not himself don the mantle).
The standard of proof
44. As with all issues under FOIA, the standard of proof is the balance of probabilities:
on the balance of probabilities, is there a reasonable likelihood of reidentification
from a combination of the requested data and other data?
45. That said, the balance of probabilities standard is flexible: in some situations the bar
is higher than in others, reflecting the relative gravity of getting the judgements in
question wrong. The confidentiality of clinical trial data, like other patient
information, is a very important public good. There is a strong public interest in
encouraging participation in trials, and patients would be deterred if they feared
that their medical data might become public knowledge without their consent. The
sensitivity of the medical data of children might not be any greater than that of
adults, but it is certainly not any lesser. The University is behaving entirely
responsibly in wishing to protect participants’ confidentiality. The Tribunal, whilst
remaining faithful to the balance of probabilities standard, has therefore paid
anxious scrutiny to whether there is a reasonable likelihood of reidentification.
46. However, the University asked itself the wrong question when conducting its
internal review [57]: ‘The university must be certain that the release of the requested
information could not lead to the re-identification of the research participants’
(emphasis added). That sets the bar too high. In its Response, the University
adjusted its position – asking in paragraph 15 whether there was a real risk that a
motivated intruder might be able successfully to identify some, if not all, of the trial
participants – but then came close to repeating its original error when it suggested,
in paragraph 20, that ‘even a small risk of reidentification of a single child
participant would be unacceptable in this context’. As already noted, its aversion to
risk is understandable but the avoidance of even a small risk is not the correct
threshold. As the Commissioner correctly says in her Code, 18 ‘[t]he DPA is not
framed in terms of the possibility of an individual being identified. Its definition of
personal data is based on the identification or likely identification of an individual
… ‘ (her emphasis).
18 p16
14
Is the motivated intruder test satisfied?
47. The University puts its case squarely on triangulation of the trial data (falling within
the requested information) and school attendance records. It has not responded to
the Commissioner’s prompt of demonstrating a realistic risk of triangulation via
social media blogs and forums or other sources of information.
48. Mr Peters says his understanding is that the participants came from Bristol and
Bath, which would mean the pool of possible schools would be around 60. In his
Reply to the University’s Response, he quotes from the feasibility paper for the
trial (not in the bundle): ‘Children were recruited between October 2010 and June
2012 at initial clinical assessment appointments conducted by Bath and Bristol
specialist paediatric CFS/ME service …’. The University says that the recruitment
centre was based in Bath and most of the children were recruited from that city. It
believed that the number of schools from which participants were recruited was
between three and nine at any one time, mainly from the Bath area.
49. Of course, the University must be taken to know where participants came from
(although it does not claim that all came from Bath and the RUH in fact attracts
CFS/ME patients from all over the UK and Western Europe). Ultimately, however,
the precise delineation of the catchment area is not determinative, for the following
reasons. First and foremost, even if the motivated intruder knew which schools or
group of schools to target, there is no reason to believe that he or she would be
able to access the school attendance records. Attendance records are confidential
and, as the Commissioner has noted, would therefore have motivated defenders,
in the schools holding them. It is true that some other bodies may be given access,
but those bodies would equally be bound by confidentiality. Parents would only
be entitled to know their own child’s attendance record. As Mr Peters has said, the
University has not explained what (lawful) investigative techniques a motivated
intruder might employ to access school records and it is not credible that a school
would simply respond to an advertisement. The trial started some eight years ago
such that, as Mr Peters suggests, some of the records might well by now have been
archived.
50. But, second, even if the motivated intruder was able to get hold of school records,
that would not enable him or her to identify the trial participants. The University
says that mean school attendance for teenagers attending a specialist CFS/ME
service is 40% (two days a week), an exceptionally low individual attendance rate
such that the children would stand out clearly in any school attendance records.
However, that does not mean that only children with CFS/ME have such low
attendance records. Sadly, there are a number of childhood diseases which can
lead to low attendance. Children undergoing chemotherapy, for example, are often
unable to attend much school for long periods. Simply noting that a particular
child had a poor attendance record would not tell the motivated intruder that the
15
child must have CFS/ME (school attendance records would not identify the
condition from which a child was suffering 19). As the Code, in a passage endorsed
by UTJ Marcus, makes clear, an educated guess, even if justified here, would not
be sufficient.
51. Third, even if the motivated intruder was entitled to assume that an entry
showing a poor attendance record meant that the child had CFS/ME, the record
would not indicate whether the child was on the SMILE trial. The University’s
press release says that the RUH assesses and treats over 400 children from across
the UK and Western Europe every year. Only a relatively small proportion of the
patient pool for the years in question would have been on the trial and the
motivated intruder could have no idea which children with poor attendance
records were on the trial. Indeed, Prof Crawley is quoted as saying in the press
release that ‘[m]any children and families in our service did not want to have LP
…’. They cannot, therefore, have consented to take part in a trial in which they
might be randomised into receiving LP. But their attendance records would be just
as poor.
52. The University is therefore wrong to say, in paragraph 7 of its Further
Submissions, that ‘any child with unusually low attendance would be immediately
identifiable as a likely trial participant’, particularly given that age and gender are
out of scope. Self-evidently, a motivated intruder would have had no incentive to
obtain attendance records which would not give the reidentifying information
sought.
53. The Tribunal has taken account of the fact that the requested information contains
individual patient detail (as opposed to being aggregated or further anonymised).
However, the fact remains that reidentification would not be possible via school
attendance records (even if obtainable) and the University has not identified any
other vehicle.
Is the fact that the University is making the trial data available to researchers as
controlled data relevant to the personal data issue?
54. It is not. It is no doubt laudable that the University is willing to share information
with other researchers but it is not relevant to the question whether the requested
information constitutes personal data. Whether sharing of information in this way
satisfies any legitimate public interest in it, as the University suggests in paragraph
22 of its Response, misses the point.
19 The University, in paragraph 16 of its Response, says that school attendance records distinguish
between, for example, children who are truanting and those with medical reasons to miss school,
but it does not suggest that the medical reason is given
16
Conclusion on the personal data issue
55. The Tribunal has concluded that the requested information does not constitute
personal data, because the trial participants could not be identified from a
combination of the requested information and other information which a motivated
intruder could access with reasonable likelihood.
56. Because the requested information is not personal data, it cannot be sensitive
personal data either.
57. It follows that the exemption in section 40(2) FOIA is not available to the University.
It has not claimed any other exemption.
Would DPP1 have applied?
58. Had the requested information constituted personal data, the Tribunal would have
had to consider whether any of the data protection principles, and in particular
DPP1, would have been breached by disclosure. Although it does not make a
definitive ruling, it is likely that the Tribunal would have decided that DPP1 would
have been breached, and in particular that condition 6(1) of schedule 2 did not
apply. Mr Peters has identified a legitimate interest in seeing the trial data – in
particular, assessing whether a trial which might well influence treatment decisions
for children suffering from a common and debilitating condition represents good
science – but this is probably outweighed by the strong need to protect the identity
of the trial participants and the confidentiality of their medical data. The limited
sharing of the data with other researchers would have been relevant to the condition
6(1) balancing exercise.
Would the result be any different under the Data Protection Act 2018 (DPA 2018)?
59. Paragraph 52 of schedule 20 to the DPA 2018 provides:
‘(1) This paragraph applies where a request for information was made to a public
authority under the 2000 Act before the relevant time.
(2) To the extent that the request is dealt with after the relevant time, the amendments
of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act have effect for the
purposes of determining whether the authority deals with the request in accordance
with Part 1 of the 2000 Act.
(3) To the extent that the request was dealt with before the relevant time—
(a) the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act
do not have effect for the purposes of determining whether the authority dealt
with the request in accordance with Part 1 of the 2000 Act, but
17
(b) the powers of the Commissioner and the Tribunal, on an application or appeal
under the 2000 Act, do not include power to require the authority to take steps
which it would not be required to take in order to comply with Part 1 of the
2000 Act as amended by Schedule 19 to this Act.
(4) In this paragraph—
“public authority” has the same meaning as in the 2000 Act;
“the relevant time” means the time when the amendments of sections 2 and 40 of the
2000 Act in Schedule 19 to this Act come into force’.
60. In other words, although Mr Peters’ request must be dealt with under DPA 1998
(because it was processed prior to the coming into force of DPA 2018) the Tribunal
should not order the disclosure of the requested information if that would not be
consistent with DPA 2018. In the Tribunal’s judgment, the result would be the same
under DPA 2018 and there is therefore no bar to disclosure. 20
Conclusion
61. For these reasons, the appeal is allowed. The decision is unanimous. Because they
are outside the scope of the request, the University does not need to disclose age
and gender.
Signed
David Thomas
Judge of the First-tier Tribunal
Date: 11 March 2019
Promulgated: 12 March 2019
20 Article 4(1) of the GDPR, incorporated by section 5 DPA 2018, defines ‘personal data’ as ‘any
information relating to an identified or identifiable natural person (‘data subject’); an identifiable
natural person is one who can be identified, directly or indirectly, in particular by reference to an
identifier such as a name, an identification number, location data, an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person’. The question remains, therefore, whether someone is identifiable as
well as identified
18