Neutral citation number: [2023] UKFTT 00006 (GRC)
Appeal References:
EA.2019/0307/0308/0309/0310/0311
First-tier Tribunal
General Regulatory Chamber
Information Rights
Determined, by consent, on written evidence and submissions
Considered on the papers on 22 February 2022 and 5 December 2022
Decision given on: 04/01/2023
Before
TRIBUNAL JUDGE Stephen Cragg KC
TRIBUNAL MEMBER Anne Chafer
TRIBUNAL MEMBER Dan Palmer-Dunk
Between
COLLETTE LLOYD
Appellant
And
INFORMATION COMMISSIONER
Respondent
And
SHERWOOD FOREST HOSPITALS NHS FOUNDATION TRUST
(IN EA/2019.0309 only)
Second Respondent
And
WHITTINGTON HEALTH NHS TRUST
(in EA/2019/0311 only)
Second Respondent
© CROWN COPYRIGHT 2022
Decision: The appeals are Dismissed.
Substituted Decision Notice: None
REASONS
MODE OF HEARING
1. The parties and the Tribunal agreed that these matters were suitable for determination on
the papers in accordance with rule 32 Chamber’s Procedure Rules.
2. The Tribunal considered an agreed open bundle of evidence in each of the cases, together
with further submissions from the parties submitted after the paper consideration on 22
February 2022.
BACKGROUND
3. In each of these appeals, and in appeal EA/2019/0285, the Appellant had made a request
to an NHS body that read as follows: -
Please could you tell me the total number of live births, the number of prenatal
diagnoses of Down Syndrome and the number of live births with Down syndrome
in your Trust in the past 8 years? If you collect data in financial years please fill in
table A, if you collect data in calendar years please fill in table B [from 2010-2017].
4. In each case the NHS bodies disclosed some information, but in years where the actual
numbers of live births with Down syndrome was under five per year cited the exemption
under section 40(2) FOIA (which relates to the disclosure of personal data) as preventing
the disclosure of further information. In each case the Commissioner upheld this reliance
on s40(2) FOIA.
5. We remind ourselves that section 40 (2) FOIA reads as follows: -
(2) Any information to which a request for information relates is also exempt
information if—
(a) it constitutes personal data which does not fall within subsection (1)
(personal information of the applicant], and
(b) the first, second or third condition below is satisfied.
2
6. Section 3(2) of the Data Protection Act 2018 (DPA) defines personal data as ‘any
information relating to an identified or identifiable living individual’.
7. As there were a number of very similar requests to a number of NHS bodies, appeals
directions were given on 29 October 2019 that the case of Lloyd v Information Commissioner
EA/2019/02851 (which concerned a request made to Airedale NHS Foundation Trust),
would be treated as a lead case under rule 18(2)(a) Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009. The relevant provisions read as follows: -
18.—(1) This rule applies if—
(a) two or more cases have been started before the Tribunal.
(b) in each such case the Tribunal has not made a decision disposing of the
proceedings; and
(c) the cases give rise to common or related issues of fact or law.
(2) The Tribunal may give a direction—
(a) specifying one or more cases falling under paragraph (1) as a lead case or lead
cases; and
(b) staying... the other cases falling under paragraph (1) (“the related cases”).
(3) When the Tribunal makes a decision in respect of the common or related issues—
(a) the Tribunal must send a copy of that decision to each party in each of the
related cases; and
(b) subject to paragraph (4), that decision shall be binding on each of those parties.
8. The decision in EA/2019/0285 was dated 11 February 2021 and the Tribunal upheld
the decision notice in that case and the reliance on s40(2) FOIA in relation to years
where there were under five relevant births. The full decision in that case is included as
an annex to this decision. At paragraph 35 the Tribunal said: -
Thus, in the present case, applying the Appellant’s own approach, if the numbers
in this case are disclosed, she will know exactly how many children were born in
the area with Down syndrome. As the Appellant says, if she takes that
information and obtains further information from a Down syndrome child or
the child’s parents (or obtains the information from social media platforms as
the Appellant suggests could happen), the Appellant (or anyone else) would be
able to tell the child and/or their parents the exact size of the cohort of those
born with Down syndrome in that year and place the child in that cohort. In our
1
https://informationrights.decisions.tribunals.gov.uk/DBFiles/Decision/i2774/Decision%20lloyd%20s40.pdf
3
view the Commissioner has correctly identified, therefore, the information as
personal data.
9. The Registrar issued further directions on 23 February 2021 that these current appeals
were to be placed before a Judge for consideration of disposal on the basis of the lead
case’s decision, citing rules 18(4) and (5) which read: -
(4) Within 28 days after the date on which the Tribunal sent a copy of the decision to
a party under paragraph 3(a), that party may apply in writing for a direction that the
decision does not apply to, and is not binding upon the parties to, a particular related
case.
(5) The Tribunal must give directions in respect of cases which are stayed under
paragraph 2(b), providing for the disposal of or further directions in those cases.
10. The directions went on to say: -
If, by 16 April 2021, the Tribunal has not received any application(s) under rule 18(4)
these appeals will be placed before a Judge for consideration of disposal on the basis
of the lead case’s decision.
11. No such applications to the effect that the lead case did not apply to these appeals were
received and the matters came before the Tribunal to be considered on the papers on 22
February 2022 (almost exactly one year after the directions given by the Registrar). The
expectation at that point was that the Tribunal would confirm that the decision in
EA/2019/0285 would be binding in the cases that had been stayed.
12. However, since the date of those 2021 directions, and before the consideration by the
Tribunal on 22 Febraury 2022, the Upper Tribunal (UT) gave judgment in the case of
NHS Business Services v Information Commisisoner and Spivack [2021] UKUT 192 (AAC)
(Spivack) on 6 August 2021, which dealt with the issue as to what should be considered to
be ‘personal data’ and which are potentially relevant to these appeals: -
(a) The UT reviewed the current case law (much of which was considered in the
EA/2019/0285 decision) and noted some uncertainties and ambiguities (see
paragraphs 27 and 31 for example) which needed to be explained and considered
with care.
4
(b) A firm conclusion was reached by the UT in Spivack that the law ‘creates a binary
test: can a living individual be identified, directly or indirectly? If the answer is
‘yes’, the data is personal data. Otherwise, it is not’ (paragraph 12). It is also
stated that ‘The test has to be applied on the basis of all the information that is
reasonably likely to be used, including information that would be sought out by
a motivated inquirer….’ (paragraph 13).
(c) The guidance issued by the Commissioner (relied on by the Commissioner in
EA/2019/0285) does not assist and ‘will not be useful’ (paragraph 8).
(d) There is a common practice ‘for statistical publications and releases to redact or
round small numbers, or otherwise adapt tables and results so that numbers
lower than some thresholds are usually suppressed’ for the purposes of reducing
risk of disclosure of personal information, but ‘this is not what the law requires’
(paragraph 36).
13. Following the consideration of these cases on the papers on 22 February 2022 the
Tribunal issued further directions which are dated 2 May 2022.
14. The Tribunal noted that in the current cases (as in EA/2019/0285) the decision notices
set out that the withheld data ‘may link with other information or knowledge’ such as to
‘make identification of the data subjects possible’, and then conclude that the
Commissioner ‘is satisfied that this information both relates to and identifies the children.
This information therefore falls within the definition of ‘personal data’ in section 3(2) of
the DPA’. The directions of 2 May 2022 stated that ‘it seems to the Tribunal that, applying
Spivack, unless the factors referred to can definitely be said to identify the data subjects
when linked with the withheld data, then the information sought is not personal data’.
15. The Tribunal decided that-
Upon consideration of the judgment in Spivack this Tribunal is no longer of the
view that that the decision in EA/2019/0285 should be treated as binding upon
the parties in the current appeals on the specific issue only as to whether the
requested information amounts to personal data and should no longer be treated
as a lead case in relation to that issue.
5
16. Effectively, the Tribunal reversed the decision that EA/2019/0285 should be considered
as a lead case pursuant to rule 18(2)(a), and then went on to give the parties an opportunity
to make further submissions before reaching a conclusion on each of the appeals.
17. The Tribunal also invited submissions from the two NHS bodies who were parties to the
appeals and invited the other NHS bodies to apply to be joined as parties if they wished
to make submissions. In the end there were no further submissions from the NHS bodies
but there were further submissions from the Commissioner and the Appellant.
SUMMARY OF THE POSITION IN EACH CASE
Appeal EA/2019/0307 Northern Devon Healthcare NHS Trust
18. The relevant part of the decision notice (Reference: FS50841713) in this case states: -
22. The Trust stated that the information relates to individuals within a small
geographical area, and it remains ’convinced that the release of extremely small
patient numbers can very easily be combined with other information already in
the public domain or released in the future as part of a mosaic or jigsaw affect
and allow identification of individual Downs syndrome children within our small
rural area’.
23. The Trust stated that its concerns related to both:
‘Self-identification; where the child or their parents/close family are able
to recognise or identify themselves /the child from this disclosed
information. It is highly likely that distress would be caused by this self-
identification as negative emotions are involved from recognising the
child’s disability and isolation within the community.
Motivated intruder risk: where a third party (media, commercial, or action
group) for whatever reason is able to determine or infer who the data
relates to or is able to piece this information together with other
information to identify the child(ren) in question. The additional
information potentially coming from: the educational sector, media or
social media.’
24. The Trust gave an example of its concerned route to identification as a ‘child
born in 2011 (8 years old) with Downs syndrome in the town or near vicinity of
Barnstaple (where our Maternity Unit is based and given the age of the child on
the balance of probabilities the family still lives in the area).
6
Appeal EA/2019/0308 East Lancashire Hospitals NHS Trust
19. The relevant part of the decision notice (Reference: FS50841725) in this case stated
that: -
22. The Trust considered the steps that a motivated individual could take to
identify the individuals from the numbers if disclosed.
- The data relates to children who, dependant on the year, will now be of
school age. Children with Down syndrome can require additional support
and although they may attend a mainstream school, it is likely that they
will attend a school that is able to cater for their specific special needs.
- It is possible to look at other freely available information, such as the list
of schools for children with special educational needs to see which schools
fall within the boundary of the Trust.
https://www.lancashire.gov.uk/children-educationfamilies/special-
educational-needs-anddisabilities/education/schools/special-schools-
and-short-stayschools and https://www.blackburn.gov.uk/schools-
andeducation/school-lists/special-schools.
- It is highly probable that these children now attend one of these schools.
Indeed, two schools for children with special educational needs are located
next to the hospital and would cater to children that fall within the years
requested.
- The requester could send additional POIA requests to the schools or
councils asking for a breakdown on the number of children that attend
and what conditions they have or search for information that may now be
in the public domain from past requests. Should the school confirm that
they did have students attending with Down syndrome, there would be a
possibility for a motivated individual to take steps to identify them.
- Once the information is released in response to a POIA request it is in
the public domain and there is nothing to stop a motivated individual with
ulterior motives from using this to target those individuals in question.
20. Thus, East Lancashire Hospitals NHS Trust appears to have addressed a test of
remoteness or likelihood, rather than whether the information sought can lead to the
identification of a living individual, directly or indirectly.
Appeal EA/2019/0309 Sherwood Forest Hospitals NHS Foundation Trust
7
21. The relevant part of the decision notice (Reference: FS50840752) in this case provided
that: -
20. The Trust stated that ‘due to the very small numbers of patients with this
diagnosis, combined with additional datasets likely to be available from our Trust
or other public bodies such as education authorities/council. It may be distinctly
possible for a ‘motivated intruder’ to combine or link datasets and risk
inappropriately identifying the sensitive genetic data of individual patients
involved.
21. The Trust also stated that ’the information to be released constitutes physical
and genetic data that relates to an identifiable living individual.’
22. Thus, it appears that the Sherwood Forest Hospitals NHS Foundation Trust has
addressed a test of remoteness or likelihood, rather than whether the information sought
can lead to the identification of a living individual, directly or indirectly.
Appeal EA/2019/0310 Poole Hospital NHS Foundation Trust
23. The relevant part of the decision notice (Reference: FS50846461) in this case provided
that: -
20. The Trust stated that to assist the complainant it had provided an overall
total for the years requested. The Trust appreciated that with disclosure of the
suppressed figures ’it might have been difficult to identify individuals, but along
with any other information obtained this may have become extremely easy, and
we must maintain patient confidentiality’.
21. The Trust referred to the Commissioner’s guidance on the physical,
physiological and genetic, identifiers of an individual and stated its concerns ’if
the information obtained were to be published, and the Trust were identified
along with this data, it has the potential to identify, and could lead to possible
complaints and action taken against the Trust.
24. Thus, Poole Hospital NHS Foundation Trust appears to have addressed a test of
remoteness or likelihood, rather than whether the information sought can lead to the
identification of a living individual, directly or indirectly.
Appeal EA/ 2019/ 0311 – Whittington Health NHS Trust
8
25. The relevant part of the decision notice (Reference: FS50841731) in this case provided
that: -
20. The Trust stated that the information relates to individuals who ‘could be
identified indirectly in particular by reference to factors specific to the physical
and physiological identity of the individual...’
21. The Trust took the decision to aggregate the numbers and provide a range
of 1-5 rather than exempt the request as a whole. The range took into account
’the risk of identification of a mother/child with a rare medical and genetic
condition affecting only a single gender (the mother who gave birth) localised to
a single hospital. The patients affected by this request are categorised as a
vulnerable patient group.’
22.The Trust also considered whether there was any further information
currently available in the public domain that if combined with this dataset, could
increase the risk of identification of an individual. The Trust provided the
Commissioner with examples of data currently available for its hospital
(ethnicity, age, EM and numbers of mothers booked in for birth per month -
source: https://digital.nhs.uk/data- and information/data-collections-and—
data sets/data sets/maternity services- data set/maternity-services-dashboard).
THE APPEAL AND RESPONSES
26. The Appellant relied on the same grounds as were summarised in EA/2019/0285 as
follows at paragraph 25: -
(a) ‘The Personal Data Ground’: The Appellant appears to dispute the
Commissioner’s finding on the facts that the data sought was "personal data".
(b) ‘The Special Category Ground’: The Appellant contends, in respect of
paragraph 31 of the decision notice that ‘the physical characteristics of the
natural person/child in this case are the identifier and that disclosing how
many children with that genetic make-up were born at a particular location
in a particular year, adds nothing to their identification’. As understood, the
Appellant does not dispute the finding that the data sought was special
category data.
(c) ‘The Necessity Ground’: The Appellant disputes the Commissioner's
findings at paragraphs 49 and 50 of the decision notices.
9
(i) As to paragraph 49, she asserts that " ... people with Down
syndrome can be subject to prejudice and bullying, however, this
would be due to the physical characteristics, not because they are one
of 4 born in that year or even that they were the only one born in that
year. I would strongly suspect, due to early intervention, Facebook
and support groups that the parents are already very aware of other
children around the same age as their own who happen to have Down
syndrome. Further, it is notoriously difficult to work out what age a
child with Down syndrome is, due to them often looking significantly
younger than they are, and sometimes, not always, being placed out
of year in an educational placement."
(ii) As to paragraph 50, the Appellant disputes that NDSCR, which
is published by region (not by hospital trust) meets her legitimate
interest. The Appellant asserts: "... it is important (a) to gain correct
baseline data for national evaluation, and in the case of trusts that are
already offering NIPT, this data may be skewed and (b) to anticipate
the effects on live birth rates of this national roll-out."
27. However, and as pointed out by the Commissioner (and by the Tribunal in paragraph 35
of EA/2019/0285) the Appellant also stated in her grounds of appeal that the information
sought ‘would not make anything about that person identifiable that was not already
known’. The Appellant went on to say that ‘The information I would be given would, at
the most, allow me to meet someone with a child with Down syndrome, and be able to
say (after verbally asking where they were born and in what year) that they were the only,
or one of two, three or four babies that were born with Down syndrome at that hospital
trust in that year’.
28. That is a submission which is repeated in all these appeals.
29. The Commissioner’s essential submission was that, whether or not the Commissioner had
adopted a Spivack-compliant approach in the decision notice, the Tribunal, in its decision
in EA/2019/0285, had applied the correct approach and so, applying the same approach
to these appeals would produce a result which would mean the appeals should be
dismissed. The Commissioner relies, to an extent, on the above submission made by the
Appellant in all her appeals as supporting this position.
30. In response the Appellant says as follows: -
I note the heavy reliance on the example I gave as a way of potentially identifying
an individual. In that example I was trying to illustrate the ridiculousness of all
the processes that would have to be gone through, the complicities of the
10
caretaker in answering the questions around date of birth etc and how no-one
would do this, ever. In fact, I have now had this data for many, many hospitals
for five years and despite numerous stories in the media about Down Syndrome,
no one has ever attempted this convoluted set of steps in order to attempt to
identify individuals. Further if they ever did, I sincerely doubt that they would
be able to as it would require cooperation from the caregivers. Therefore, it
would not be possible within any reasonable scenario to identify someone using
the data I need. Please can someone think about this in the real world. The fact
that my convoluted example has been taken as a potential scenario and used as
the basis of this dismissal is very surprising.
DISCUSSION
31. As set out above, in Spivack at paragraph 12, having set out this definition of ‘personal
data’ in section 3 DPA and Recital 26 to the General Data Protection Regulation (EU)
2016/ 679, UTJ Jacobs held:
Section 3 of the 2018 Act creates a binary test: can a living individual be
identified, directly or indirectly? If the answer is ‘yes’, the data is personal data.
Otherwise, it is not. That is what the Act says, and it is consistent with the
Regulation. There is no mention of any test of remoteness or likelihood.
32. Whilst the Commissioner found in each of the decision notices under appeal in this case
that the information sought itself did not ‘directly identify individuals’ that does not mean
an individual is unable to be ‘indirectly’ identified from that information (which, as
Spivack confirmed, also comes within the definition of s3 DPA).
33. In Information Commissioner v Miller [2018] UKUT 220 (AAC) at paragraphs 12-16, the
Upper Tribunal acknowledged the ‘motivated intruder’ test, which relates to ‘…a person
who starts without any prior knowledge but who wishes to identify the individual or
individuals referred to in the purportedly anonymised information and will take all
reasonable steps to do so.’
34. Again, in Miller the UT noted that a similar approach was taken by the Court of Session
(Inner House) in Craigdale Housing Association v The Scottish Information Commissioner [2010]
CSIH 43 at paragraph 24:
…it is not just the means reasonably likely to be used by the ordinary man on
the street to identify a person, but also the means which are likely to be used by
a determined person with a particular reason to want to identify the
individual…using the touchstone of, say, an investigative journalist…
11
35. The adoption of this test was confirmed in Spivack at paragraph 33.
36. As set out above, the Tribunal found at paragraph 35 of the EA/2019/0285 case that the
information in that case was personal data, essentially applying the ‘motivated intruder’
test and the description by the Appellant in her appeal as to how, if she were so motivated,
she would be able to discover the identity of a Down syndrome child by combining the
withheld information with other available information.
37. In relation to these appeals, the Appellant disputes whether her approach would, in fact,
enable the identification of individuals. We are, of course, not bound to follow the
approach of the Tribunal in EA/2019/0285. The Appellant now says that she presented
her example ‘to illustrate the ridiculousness of all the processes that would have to be
gone through’ to identify a Down child if the withheld information were disclosed. She
says that ‘no one has ever attempted this convoluted set of steps in order to attempt to
identify individuals.
38. However, simply because someone has not attempted to combine the withheld
information with other information available to identify a child does not mean that it
cannot or will not be done. We have to consider (to cite the Craigdale case) ‘the means
which are likely to be used by a determined person with a particular reason to want to
identify the individual…using the touchstone of, say, an investigative journalist’. It seems
to us that when considering the submissions by the public authorities (as cited in the
extracts from the various decision notices set out above), as to how individual children
would be identifiable (albeit ‘indirectly’) together with the approach suggested by the
Appellant, that individual children would indeed be identifiable if the withheld
information is disclosed.
39. That was the approach in the EA/2019/0285 case as explained by the Tribunal at
paragraphs 28-35. Having considered the further submissions of the parties and the
decision in Spivack, we agree with the Commissioner that the Tribunal decision in
EA/2019/0285 is correct, and therefore applying the same approach to the information
in these appeals produces the result that the withheld information is personal data.
40. Having reached that conclusion, we are also of the view that the same approach as in
EA/2019/0285 should be adopted (see paragraph 36-41). Thus: -
12
(a) The information sought is also special category information and none of the
exceptions in Art 9(2) GDPR apply (see paragraphs 36-37).
(b) Even if the information is not special category information, then disclosure is not
necessary to meet the Appellant’s legitimate interests, applying Art 6 GDPR (see
paragraphs 38-40).
(c) The fact that the Appellant has offered to give an undertaking not to disseminate
the information further cannot be a factor to take into account because, once
disclosed under FOIA, the information is in the public domain (see paragraph 41).
41. Having reached those conclusions, these appeals are dismissed.
Signed Judge Stephen Cragg KC Date: 22 December 2022
13