First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2019/0285P
Determined, by consent, on written evidence and submissions
Considered on the papers on 15 January 2021.
Before
Judge Stephen Cragg Q.C.
Tribunal Members
Mr Andrew Whetnall
and
Mr Dan Palmer-Dunk
Between
Collette Lloyd
Appellant
And
The Information Commissioner
Respondent
DECISION AND REASONS
1
DECISION
1. The appeal is dismissed.
MODE OF HEARING
2. The parties and the Tribunal agreed that this matter was suitable for
determination on the papers in accordance with rule 32 Chamber’s Procedure
Rules.
3. The Tribunal considered an agreed open bundle of evidence comprising pages
1 to 76 and a closed bundle.
INTRODUCTION
4. On 12 February 2019 the Appellant requested information relating to
numbers of Down syndrome births from the Airedale NHS Foundation Trust
(the Trust). The Trust refused to provide the requested information citing the
exemption under section 40(2) FOIA (third party personal data) as its basis
for doing so. The request read as follows: -
‘Please could you tell me the total number of live births, the number of
prenatal diagnoses of Down Syndrome and the number of live births
with Down syndrome in your Trust in the past 8 years? If you collect data
in financial years please fill in table A, if you collect data in calendar years
please fill in table B [from 2010-2017].’
5. On 28 February 2019 the Trust disclosed information about the total number
of live births per year in the Trust but stated that the actual numbers of live
2
births with Down syndrome was under five per year and again cited the
exemption under section 40(2) FOIA as preventing the disclosure of further
information.
6. On 17 April 2019 the Trust provided the outcome of an internal review. It
upheld the decision to refuse the suppressed numbers citing section 40(2)
FOIA.
7. The Appellant contacted the Commissioner on 18 April 2019 to complain
about the way the request for information had been handled.
8. During the investigation the Trust disclosed the data for the years 2011 and
2013 to the Appellant as the values were zero in those years. The Trust also
offered to provide the total number of live births with Down syndrome over
the whole of the remaining years: ‘this would provide the requester with a
more accurate figure’.
THE STATUTORY FRAMEWORK
9. Section 40 (2) FOIA reads as follows: -
(2) Any information to which a request for information relates is also
exempt information if—
(a) it constitutes personal data which does not fall within subsection
(1) (personal information of the applicant], and
(b) the first, second or third condition below is satisfied.
10. Section 3(2) of the DPA 2018 defines personal data as ‘“any information
relating to an identified or identifiable living individual”.
11. The relevant condition (as referred to in s40(2)(b) FOIA) in this case is found
in s40(3A) (a): -
3
(3A) The first condition is that the disclosure of the information to a
member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles.
12. Under s40(7) FOIA the relevant data protection principles in this case are to be
found, first, in Article 5(1) of the GDPR. Materially, Article 5(1)(a) reads: -
Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in
relation to the data subject (‘lawfulness, fairness and
transparency’).
13. Further, by Article 6(1) GDPR: -
Processing shall be lawful only if and to the extent that at least one
of the following applies:
(a) the data subject has given consent to the processing of his
or her personal data for one or more specific purposes;
…
(f) processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party, except
where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which
require protection of personal data…
14. Lastly, information relating to special category data is given special status in
the GDPR. Article 9 of the GDPR defines ‘special category’ as being personal
data which reveals racial, political, religious or philosophical beliefs, or trade
union membership, and the genetic data, biometric data for the purpose of
uniquely identifying a natural person, data concerning health or data
concerning a natural person’s sex life or sexual orientation.
15. There are only very strict exceptions which would allow disclosure of special
category information, as set out in Article 9(2). The only two that could apply
in this case are that the data subject has given explicit consent to the processing
4
of those personal data for one or more specified purposes, or that processing
relates to personal data which are manifestly made public by the data subject.
THE DECISION NOTICE
16. The Commissioner recorded the reasoning put forward by the Trust for not
disclosing more information in a decision notice dated 15 July 2019 as follows:
-
21. The Trust stated that it is a small Trust in a rural area and the number
of relevant patients is very small. … ‘We believe that the relevant
patient(s) themselves, or their family, friends, colleagues or neighbours,
may be able to identify an individual to whom our figures refer if we were
to disclose them as requested. This information is personal and neither the
child nor the mother would have any expectation that information about
their pregnancy, or outcome, could be published or examined in public in
the future.’
22. The Trust explained that the nature of the syndrome to which this data
refers comprises specific physical characteristics. ‘We also consider that
some types of data are more attractive to a motivated intruder than others
– and more consequential for individuals. We believe this is the case in
relation to this data which may leave an individual if identified subject to
distress plus given the relatively short passage of time from the year 2010
to date, the subjects would still be young children…’
17. The Commissioner considered this reasoning and concluded as follows in
relation to whether the information held was personal information: -
23. The Commissioner notes that these numbers relate to a number of
identifiers - location, medical health, year of birth/age and physical
characteristics of the individual(s). She accepts that the withheld data may
link with other information or knowledge, such as information from the
educational sector, media or social media, to make identification of the
data subjects possible. Given the age of the children, it is likely that the
families still live in the same area.
5
24. She is satisfied that this information both relates to and identifies the
children. This information therefore falls within the definition of ‘personal
data’ in section 3(2) of the DPA.
18. The fact that information constitutes the personal data of an identifiable living
individual does not automatically exclude it from disclosure under FOIA.
19. Applying the framework above the Commissioner then considered the second
element of the test to determine whether disclosure would contravene any of
the data protection principles. Having considered the question: - ‘would
disclosure contravene principle (a)?’, the Commissioner concluded that: -
28…. the information can only be disclosed if to do so would be lawful (i.e.
it would meet one of the bases of lawful processing listed in Article 6(1)
GDPR as well as being generally lawful), be fair, and be transparent.
20. In relation to whether the information was ‘special category data’ the
Commissioner noted and decided that: -
32. Having considered the wording of the request, and viewed the
withheld information, the Commissioner finds that the requested
information does include special category data. She has reached this
conclusion on the basis that the data relates to a lifelong health condition
and a specific genetic profile of the data subjects.
33. Special category data is particularly sensitive and therefore warrants
special protection. As stated above, it can only be processed, which
includes disclosure in response to an information request, if one of the
stringent conditions of Article 9 can be met.
34. The Commissioner considers that the only conditions that could be
relevant to a disclosure under FOIA are conditions (a) (consent from the
data subject) or (e) (data made manifestly public by the data subject) in
Article 9.
35. The Trust has stated that the data subjects are children under 9 years
and has not sought consent from them. ‘The Trust does not believe it is
appropriate to seek consent from the parents or guardians of the children
to whom this data relates. We believe it may be distressing for them to
6
discover that their families are the subject of a Freedom of Information
request and that there may be a risk of identification of the children by
persons unknown.’
36. The Commissioner has seen no evidence or indication that the
individuals concerned have specifically consented to this data being
disclosed to the world in response to the FOI request or that they have
deliberately made this data public.
37. As none of the conditions required for processing special category data
are satisfied there is no legal basis for its disclosure. Processing this special
category data would therefore breach principle (a) and so this information
is exempt under section 40(2) of FOIA.
21. For completeness, the Commissioner moved on to consider whether there
were any legitimate interest(s) in the disclosure of the requested personal
information. The Commissioner recognised that such interest(s) can include
broad general principles of accountability and transparency for their own
sakes, as well as case-specific interests: -
45. In the circumstances of this case the Commissioner understands that
the complainant is interested in actual numbers of live births with Down
syndrome per year per Trust.
46. The Commissioner is inclined to accept that the complainant has a
legitimate interest in making this request and has gone on to consider
whether disclosure is necessary in order to meet the legitimate interest.
22. The Commissioner considered whether disclosure was necessary to meet the
legitimate interests: -
50. The Trust also informed the Commissioner that the legitimate interest
could be met elsewhere:
The National Down Syndrome Cytogenetic Register (NDSCR)
for England and Wales has already disclosed some of the requested
information with a view to satisfying the public interest in its
annual reports e.g. the NDSCR anonymous data reports include
Down’s syndrome diagnosed since January 1989 until 2013 in
England and Wales. NCARDRS congenital anomaly statistics
7
provides annual data from 2014 onwards. We understand data
collection in newly established regions started from 1 April 2017
and national coverage of congenital anomaly reporting including
Down syndrome will be possible from 2019.
51. The Commissioner fully accepts that the Trust has considered at length
what information it can lawfully provide to the complainant. She
considers that further disclosure in the detail requested is not necessary to
meet the complainant’s legitimate interest in this case and could be
intrusive to the data subjects.
52. As the Commissioner has decided in this case that disclosure is not
necessary to meet the legitimate interest in disclosure, she has not gone
on to conduct the balancing test. As disclosure is not necessary, there is
no lawful basis for this processing and it is unlawful. It therefore does
not meet the requirements of principle (a).
THE APPEAL AND RESPONSE
23. The Appellant’s appeal is dated 14 August 2019. In her Response, the
Commissioner has summarised the appeal grounds, and the Appellant has
agreed that the summary reflects the points made in the appeal notice. The
summary reads as follows: -
(a) ‘The Personal Data Ground’: The Appellant appears to dispute the
Commissioner’s finding on the facts that the data sought was "personal
data".
(b) ‘The Special Category Ground’: The Appellant contends, in respect of
paragraph 31 of the decision notice that ‘the physical characteristics of the
natural person/child in this case are the identifier and that disclosing how
many children with that genetic make-up were born at a particular
location in a particular year, adds nothing to their identification’. As
understood, the Appellant does not dispute the finding that the data
sought was special category data.
(c) ‘The Necessity Ground’: The Appellant disputes the Commissioner's
findings at paragraphs 49 and 50 of the decision notice.
8
(i) As to paragraph 49, she asserts that " ... people with Down
syndrome can be subject to prejudice and bullying, however, this
would be due to the physical characteristics, not because they are
one of 4 born in that year or even that they were the only one born
in that year. I would strongly suspect, due to early intervention,
Facebook and support groups that the parents are already very
aware of other children around the same age as their own who
happen to have Down syndrome. Further, it is notoriously difficult
to work out what age a child with Down syndrome is, due to them
often looking significantly younger than they are, and sometimes,
not always, being placed out of year in an educational placement."
(ii) As to paragraph 50, the Appellant disputes that NDSCR, which
is published by region (not by hospital trust) meets her legitimate
interest. The Appellant asserts: "... it is important (a) to gain correct
baseline data for national evaluation, and in the case of trusts that
are already offering NIPT, this data may be skewed and (b) to
anticipate the effects on live birth rates of this national roll-out."
24. We also note that the Appellant offered to provide an undertaking not to
publish the data.
25. It appears that the Appellant has a number of similar appeal cases pending
against other health care bodies raising similar issues (although we have not
seen any of the papers in those cases). Case Management Directions were
made in this case on 29 October 2019 (amended on 1 November 2019), in which
the parties were informed that this case (EA/2019/0285) will be considered as
a lead case for the purposes of rule 18 (the cases give rise to common or related
issues of fact or law), behind which EA/2019/0307, EA/2019/0308,
EA/2019/0309, EA/2019/0310, and EA/2019/0311 are stayed.
26. The Commissioner’s Response to the appeal can be summarised as follows: -
(a) In relation to the Personal Data Ground the Commissioner notes the case
law which confirms that that whether something is personal data is to be
judged on the basis as to whether someone such as a ‘determined intruder’
9
or an ‘investigative journalist’ would be able to identify a person from the
information disclosed and submitted that the Commissioner had taken the
right approach in the decision notice. The Commissioner noted that the
Appellant herself recognises that her information request could lead to the
direct identification of the specific individuals about whom the data refers
when her Grounds of Appeal state: ‘The information I would be given
would, at the most, allow me to meet someone with a child with Down
syndrome, and be able to say (after verbally asking where they were born
and in what year) that they were the only, or one of two, three or four
babies that were born with Down syndrome at that hospital trust in that
year’.
(b) In relation to the Special Category Ground the Commissioner says that if
the Appellant is disputing that the data sought was special category data,
then that is mistaken and that the Commissioner was correct to find that
‘the data relates to a lifelong health condition and a specific genetic profile
of the data subjects’ , such as to constitute special category data under
Article 9 GDPR, and that there are no exceptions in Article 9(2) GDPR
applied on the facts.
(c) In relation to the Necessity Ground the Commissioner argues that the
Appellant has said contradictory things in her appeal grounds. On the one
hand she says she needs the information to calculate national trends over
time, but on the other hand she has commented that the data might be of
limited value because of the mobility of families with a Down syndrome
child, or because of late Down syndrome diagnosis in some cases after a
child has left hospital. The Commissioner submits that the decision notice
was correct to find that disclosure was not necessary for calculating
national trends, and that the Appellant has not explained why data in the
form of ‘less than five’ is not sufficient in any event.
10
(d) In relation to the undertaking given by the Appellant the Commissioner
says that if the data were provided it would be susceptible to further
dissemination and being placed in the public domain and that the
Appellant’s proposed undertaking would not provide protection of the
special category data in issue in those circumstances.
27. The Appellant has responded to these points: -
(a) She disputes the likelihood that a ‘motivated intruder’ would be able to
identify a person from the information if disclosed. She states that if a child
had stayed in the area: -
…."a motivated intruder" would have far easier means of finding
the person, including joining online support groups or arriving at
one of the many events put on by local Down syndrome support
groups. Having the birth data, would not change the likelihood of
being able to find that person.
Knowing the size of the group that a child belongs to therefore,
does not constitute personal data, and could not be used for the
purposes suggested in law.
(b) The Appellant says that she does dispute that the information is special
category data, and that what she is asking for is the size of the group.
Therefore, that is not special category data, as it does not refer to the
disability.
(c) In relation to ‘necessity’, the Appellant says that knowing the actual
numbers is important for future service planning such as the national
evaluative roll out for non-invasive pregnancy testing (NIPT): -
Knowing the "likely" size of the group would help with planning -
although it would, admittedly, only be loose planning, but seeing
whether the size of the group is increasing or decreasing in a
particular area is important. As we are dealing with such small
numbers, knowing that the group is 4 strong, as opposed to 1
11
strong, or previously was 4 strong and now is consistently (for the
past few years) is 1 strong, would be helpful. There is a significant
difference in employing people to run specialist services or
organising specialist services, if there is l child a year born in your
area for the last three Years or 4.
(d) The Appellant reiterates her undertaking to keep the information
confidential.
DISCUSSION
28. The first important point in this case is whether the requested information
constitutes personal data. We understand the Appellant’s argument that, on
its face, no individual can be identified by the revelation that a particular
number of children, less than five, were born in the Trust’s area for a
particular year.
29. However, as the Commissioner says, the interpretation by the courts as to
when data is personal information needs to be considered. The case that
brings together the caselaw most conveniently is Information Commissioner v
Miller [2018] UKUT 229 (AAC). In that case it was confirmed that applying
the judgment in R (Department of Health) v Information Commissioner [2011]
EWHC 1430 (Admin): -
10.…the proper approach to whether anonymised information is personal
data within section 1(1)(b), for the purposes of a disclosure request, is to
consider whether an individual or individuals could be identified from it
and other information which is in the possession of, or likely to come into
the possession of a person other than the data controller after disclosure.
30. In the Department of Health case Cranston J said at paragraph 66 that the
assessment of the likelihood of identification included ‘assessing a range of
every day factors, such as the likelihood that particular groups, such as
campaigners, and the press, will seek out information of identity and the
12
types of other information, already in the public domain, which could inform
the search’.
31. In Miller the UT noted the ‘motivated intruder’ test relates to ‘…a person who
starts without any prior knowledge but who wishes to identify the individual
or individuals referred to in the purportedly anonymised information and
will take all reasonable steps to do so.’ Again, in Miller the UT noted that a
similar approach was taken by the Court of Session (Inner House) in Craigdale
Housing Association v The Scottish Information Commissioner [2010] CSIH 43 at
paragraph 24:
“…it is not just the means reasonably likely to be used by the ordinary
man on the street to identify a person, but also the means which are likely
to be used by a determined person with a particular reason to want to
identify the individual…using the touchstone of, say, an investigative
journalist…”.
32. Further, the Commissioner’s Code of Practice on “Anonymisation: managing
data protection risk” provides guidance at page 22-23 on the application of the
“motivated intruder” test:
“The approach assumes that the ‘motivated intruder’ is reasonably
competent, has access to resources such as the internet, libraries, and all
public documents, and would employ investigative techniques such as
making enquiries of people who may have additional knowledge of the
identity of the data subject or advertising for anyone with information to
come forward. The ‘motivated intruder’ is not assumed to have any
specialist knowledge such as computer hacking skills, or to have access to
specialist equipment or to resort to criminality such as burglary, to gain
access to data that is kept securely.”
33. In our view the Commissioner in this case has applied this approach correctly.
At paragraph 23 of the decision notice the Commissioner noted that the
numbers sought by the Appellant ‘relate to a number of identifiers - location,
medical health, year or birth/age and physical characteristics of the
individual(s). She accepts that the withheld data may link with other
13
information or knowledge, such as information from the educational sector,
media or social media, to make identification of the data subjects possible.
Given the age of the children, it is likely that the families still live in the same
area’.
34. This view is reinforced by the Appellant’s own submission, as set out above,
that if the information is disclosed, she would be able, with minimal additional
information, to tell the child ‘that they were the only, or one of two, three or
four babies that were born with Down syndrome at that hospital trust in that
year’. The Commissioner submits that the Anonymisation Code provides that
a like course of conduct to that described by the Appellant would constitute
re-identification of personal data. At page 19 the Code states: -
There are two main ways for re-identification to come about.
• An intruder takes personal data it already has and searches an
anonymised dataset for a match.
• An intruder takes a record from an anonymised dataset and seeks
a match in publicly available information.
Generally, the latter risk scenario is of greater concern for data
custodians because of the confidentiality pledges that are often given
to those appearing in an anonymised dataset. However, both risk
scenarios are relevant and can carry with them different probabilities
of re-identification. In either case though it can be difficult, even
impossible, to assess risk with certainty.
35. Thus in the present case, applying the Appellant’s own approach, if the
numbers in this case are disclosed, she will know exactly how many children
were born in the area with Down syndrome. As the Appellant says, if she takes
that information and obtains further information from a Down syndrome
child or the child’s parents (or obtains the information from social media
platforms as the Appellant suggests could happen), the Appellant (or anyone
else) would be able to tell the child and/or their parents the exact size of the
cohort of those born with Down syndrome in that year, and place the child in
14
that cohort. In our view the Commissioner has correctly identified, therefore,
the information as personal data.
36. If the information is personal data, then the question arises as to whether it is
also special category data. The Appellant’s case is that as she is simply asking
for the ‘size of the group’ then that is not special category data. However, it
seems to us clear that on the face of the request the information must ‘relate’
to lifelong health condition and a specific genetic profile of the data subjects’,
and therefore Art 9 GDPR applies. The Appellant has not contended that any
of the exceptions in Art 9(2) GDPR (see above) apply.
37. If Art 9 GDPR applies and none of the exceptions are applicable, then that is
the end of the matter and the information cannot be disclosed. However, on
the basis that the information is simply ‘personal data’ (and not special
category data) the Commissioner went on to consider the ‘Necessity Ground’
as set out in Art 6 GDPR, and so do we.
38. We accept, as did the Commissioner, that the Appellant has a legitimate
interest in the disclosure of the information for the purposes of considering
national trends over time, and local trends which may assist in local service
provision. However, like the Commissioner, we have difficulty seeing why
disclosure is necessary for either of these purposes. As to long term trends,
these are already considered in the National Down Syndrome Cytogenetic
Register (NDSCR) as the Commissioner noted, and it is difficult to see how
disclosure of the specificity required by the Appellant would improve the
position. In relation to local services, as recorded above, the Appellant is
already concerned about late diagnosis and families moving away such that
again, and it is not clear why the exact figures (rather than the ‘less than five’
approach) would assist.
39. In South Lanarkshire Council v Scottish IC [2013] UKSC 55 at paragraph 27, Lady
Hale stated that a ‘measure would not be necessary if the legitimate aim could
15
be achieved by something less’. Applying that to the context of this case, in
our view the ‘legitimate aim’ of the Appellant as described by her can be met
by the disclosure of the information she has already received.
40. We agree, therefore, that disclosure is not necessary to meet the Appellant’s
legitimate interests. On that basis we do not go on to consider where the
balance might lie between the Appellant’s legitimate interests and the
fundamental rights and freedoms of those to whom the personal data relates.
41. Finally, we mention the Appellant’s offer to give an undertaking not to
disseminate the information further. However, neither the Commissioner nor
the Tribunal have any powers under FOIA to ask for or to enforce such an
undertaking. Thus, in Office of Government Commerce v Information
Commissioner [2010] QB 98 Stanley Burton J said at paragraph 72 that: -
72 Disclosure under FOIA is always to the person making the request
under section 1 . However, once such a request has been complied with by
disclosure to the applicant, the information is in the public domain. It
ceases to be protected by any confidentiality it had prior to disclosure. This
underlines the need for exemptions from disclosure.
42. For all these reasons the appeal is dismissed.
Stephen Cragg QC
Judge of the First-tier Tribunal
Date: 11 February 2021.
Promulgated Date: 16 February 2021
16